d459f7386545f7750d4d239116197622a23e2af5ab81cd7af93bd62221d3bbe6

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_20afb806487475b37c304e4866fa082b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 606KB
Sample261003-tk599asbqc
SHA256 d459f7386545f7750d4d239116197622a23e2af5ab81cd7af93bd62221d3bbe6
MD5 20afb806487475b37c304e4866fa082b
SHA1 3ded02b7f4a742b0a7739261745f5c77d31f7ec5
SHA512 3e6c70bf23a67749fa315a1456b6f78f46220c3df834c182f6b36a1ad3309964d0f06c26c793386aef50b1a978926e992e96df5729671a3810d3f39022c8e7df
SSDEEP 12288:D1ipnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:EpJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1A4D42366B9C8947EC823967B1D76D6C1194B7D8233C876663AADE27B4B36DC00737302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1132	elevation_service.exe
1020	elevation_service.exe
3504	maintenanceservice.exe
2776	OSE.EXE
3692	PerceptionSimulationService.exe
5188	perfhost.exe
120	ReFsDedupSvc.exe
576	SensorDataService.exe
2652	ssh-agent.exe
4872	AgentService.exe
4292	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-10-02_20afb806487475b37c304e4866fa082b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-02_20afb806487475b37c304e4866fa082b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-02_20afb806487475b37c304e4866fa082b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-02_20afb806487475b37c304e4866fa082b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-02_20afb806487475b37c304e4866fa082b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e79a04b4612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-02_20afb806487475b37c304e4866fa082b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-02_20afb806487475b37c304e4866fa082b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-02_20afb806487475b37c304e4866fa082b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-02_20afb806487475b37c304e4866fa082b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_20afb806487475b37c304e4866fa082b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5ab11685153dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b7f52a85153dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000579a4b675153dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b50475a85153dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000abb373675153dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd3f35685153dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000aa6a3c685153dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1132	elevation_service.exe
1132	elevation_service.exe
1132	elevation_service.exe
1132	elevation_service.exe
1132	elevation_service.exe
1132	elevation_service.exe
1132	elevation_service.exe
1020	elevation_service.exe
1020	elevation_service.exe
1020	elevation_service.exe
1020	elevation_service.exe
1020	elevation_service.exe
1020	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6064	2026-10-02_20afb806487475b37c304e4866fa082b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	1132	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4872	AgentService.exe
Token: SeBackupPrivilege	120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	120	ReFsDedupSvc.exe
Token: 33	4292	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4292	SearchIndexer.exe
Token: SeBackupPrivilege	120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	120	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1132	elevation_service.exe
Token: SeDebugPrivilege	1020	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4684	4292	SearchIndexer.exe	100
PID 4292 wrote to memory of 4744	4292	SearchIndexer.exe	101
PID 4292 wrote to memory of 4352	4292	SearchIndexer.exe	102
PID 4292 wrote to memory of 5372	4292	SearchIndexer.exe	103
PID 4292 wrote to memory of 3104	4292	SearchIndexer.exe	111
PID 4292 wrote to memory of 5040	4292	SearchIndexer.exe	112
PID 4292 wrote to memory of 1340	4292	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-10-02_20afb806487475b37c304e4866fa082b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_20afb806487475b37c304e4866fa082b_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3504

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2776

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3692

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5188

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:120

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:576

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2652

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4684
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 55787145a895d1417409cccd999424c66d5407cc99fe5c1e7a7270c5cd57e90a
MD5 c3171622c7314de43d9d4149039a17dc
SHA1 64b247ecc44325a2330366c144c1dbe918cbe51e
SHA512 ef8889006e566e7039a745fbed69d1ad29e8903fb3bec9a25fa1641fe1f57a416581045c9b09635a5177e66813c8f00b85b8d3c4a94db4a90b179a355b8b9fc4
SSDEEP 49152:Wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn6Y1+DMCjz7PU5u:I3q6HjBM1+DMU72u
TLSH
T12ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 867aa773265bd687b4b12d73096cf246aca42304a981589a4f3857101e1e0e4f
MD5 f01fb9f2284080872ed89e7531989e50
SHA1 4e7de17e169fe84a289f068513e5d46f279c3714
SHA512 d579fd059f5251968d1ecead2538eadc3cf9525e9ae9fd0a672b730dc59ef6ba3265b1493cd1a71468c895e8d44dcec552305c4a001a93c049d14e3e7dddc97e
SSDEEP 24576:uXYfDtczA3JJI1+DMp7CjWgNlPU51Ncv:ttc0Y1+DMCjz7PU5u
TLSH
T1D805F129B7D409FDEC67823DCDA28501E673B89543A4E79B03A8D5260F336C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 68e761253d43b8f1a47d3a063c0d9461ef9838ccbab0b58cd030500589934601
MD5 31667e5916895d603a9189d947c59f83
SHA1 a58bb941a7b85fb6608aa6c4be70148c4213d563
SHA512 909e685ed79e60a3c5b23c11f8ebd1b581ff6e0b1297a3d86ad4f587ff0ea37c0871082bd54f33ae680ed8b9755a83f41df48bee1a11a0aeec5bd15710b88ce1
SSDEEP 24576:90Le5ji0hmxirMrJJI1+DMp7CjWgNlPU51Ncv:9Pji0AcYY1+DMCjz7PU5u
TLSH
T110359E16F6788335D073C0B9C5D2A68EE972308617308ACB4296D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9e83cd07955a2ff43f81de946eafef84b2d3a2ffff9cff9019b3eee6cb34c8ea
MD5 af520828105a272324ba0cf737c6abdf
SHA1 36ffb531cbd52c055ac78b3c548598d59efd8a37
SHA512 e8b26a57cf3fa7fd9c66f659510eb4e77cffd9dc34c19e2e58f9d9d14a579276f96da75a7c77fe96cb6012054ac90500b49ea7d32d0eb74db56fc166a7e129b2
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWE6q8wyuNJJI1+DMp7CjWgNlPU51Ncv:f/ezSC6vUzPvxHjykY1+DMCjz7PU5u
TLSH
T1AB756D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9543db1e7d37aa1d1d721a5ccda563e962549f66b833849eee3920ece77c340a
MD5 edbd02832ef6acd95403b96f3d9b8c6f
SHA1 4d408f064476ee9b152a6675be6043252c3ac0bb
SHA512 2dd7b10a5a2ace62fa837491e0569f9eca9b0cbc7989c911cbf77cd19db71cee77f3f330b8c47be7fed15fb0b520e29919ad47d3dc0926fd9f27999307683b3d
SSDEEP 24576:VVbqPb88hv/l+6GJJI1+DMp7CjWgNlPU51Ncv:VVO88hXl+nY1+DMCjz7PU5u
TLSH
T12A55AE66F5748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 5576afeb8f1aa74a823738fcf02667d4461c026310ca647a55730a8c01edc511
MD5 9a93f0651924304b746fe60ade99d2aa
SHA1 843aa084a91d420bca1357d9cd71ef7f23c7e70b
SHA512 6f76a4c1ef9e503bc022ba21f3f21ef8ac552c351fb9f4e0191ffefccb5dca88bdd467110dd6928bb50c065642801819020472aed3f6bdcb58db4f494957a9e6
SSDEEP 12288:SRvnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:SRvJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1C2C42397ABCC15CDDE7792372EB799C61443ADC231C87B7166BDF266493DC808263A02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 78f1a356ec2cc9b9f445571503646b007ef1c90c7b46fa9565d676679bca1e90
MD5 c3820fbdcfd09435400a1d9ebb6a22c1
SHA1 61a6f2ac0d1eefcdfab798d7938e8eba2d2a0b2a
SHA512 a2104d1589910e9df5c07c84f61522d22a5a49fd56b0cabf1ac28dc11d486ce8e7ee1710cb2f2235936c037e4462853a3ea78f31d166d6b5f9f567d5b2f29594
SSDEEP 12288:4eBNUbTVO86UenJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:4JIUeJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1D705CF3BEE28FCD2C27A8DB95B918640A76278714B51A3CBD175C30ECE235D05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 22722489146d953039ca86290f6e5c92d66ee25a6d6a209ae58f4157534658c9
MD5 71382a80ceddb285c995c13125b81433
SHA1 df2f5e638b3c84c52addcb806964fc45f57abf09
SHA512 c569a0c4462e43261022ea643b866a097c81422a4f007669aee4be3966c72a5e9c17ac7e2fe357dd81e2b0f8568ca2f9e40ca439b253726742b0b31b2e7e247a
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THy:gQvGAdlCEL8c/yRNw5C21+DMU72u
TLSH
T1E0266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 9cb86a8f10fdf7b14faf1ce085c5ee048c835ca7e1f1367c74acd853867f61fe
MD5 7cce73495bf5cb69cc04025c91322eaf
SHA1 45154a46c596af88ee58abe783b63372d40b271b
SHA512 c9bad0f172fc902b022de7d46941700c6933d6e2291e7e39ab4f8a66a97391aa2090f89c9acb61819033cb022b33cd0f8d4bb2ebdba531870dfeeec307a9578c
SSDEEP 12288:qAwSfxL/2Dc34DLLmt0LDQewsAjInJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkL:/dewsAjIJJI1+DMp7CjWgNlPU51Ncv
TLSH
T13F15E031FE74E036C67B0DB61B36C716146DB9604B912AC3E3F89A9E49346C22376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1603eacf1ab2ee8855f9752f7d472513e8684621959325f395fd4d7eaf140263
MD5 562074ea46b6c45f25b9e30d9c3e19f1
SHA1 7d696cc4a529c02d17977e98996ce99f9cd671ec
SHA512 cad548f7df8d71b4bdd90a7d5b0438769b1f4d83d507166c785caa39979364af80f1e543dd5f024abcd99ca5ad6dce0076a419d4d2e9293b499ae9808c102c56
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHBcl72u:aUEtQevvqc2W1cpV2EI32BcVv
TLSH
T1B0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e6139d824ac1e924c502d3a54236891e7ea94c72d8ec4c9113aca858e74b56cc
MD5 a42f6eea365cb422238bf4ef1b870a61
SHA1 7958b86ac81b1fba5ffae9b805cea405c817ebcf
SHA512 cf1b6e857c8eadd4f1fbef7a477768b2fc87045cd04a40f866f0906965af7261486a1185fb5a7117664ea5c2549a3cf89e4e60331f287fc37e0058204b0656df
SSDEEP 49152:NCbRquA/m2yL5zifFiV+XenmE3/zoY1+DMCjz7PU5u:qoqHVjnmi1+DMU72u
TLSH
T17BD58D0976B882E4D1F6C77886A2C647F37178154B31A7FF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f909e2e987cf787353168fb21746b8fe809beb44e09cdd7f76700b77b8e7ff09
MD5 42b43ba7a13fc21e778e755c44e2995e
SHA1 367d0a373e7fcc8d034e5e3cc288e01df55d93a1
SHA512 7891bb44bb4d9df43f6de3af26abd86c1357eb9fa91d18aca28f74366e6cf9ae745cec9896f0a7c8769f8172a6b61f09eae33ec546a38fa427cfc29c0208b5ca
SSDEEP 24576:uAhGLJIFoiwtA5l7S53ZJJI1+DMp7CjWgNlPU51Ncv:uAMyFoiq5pY1+DMCjz7PU5u
TLSH
T1DC359D81EBF915D4F5B3AA7899B68171AA77BCA65E31D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e0c6406837a64868961ca4ad4f88bcb80ed320a711e00c4792e2da151edeece5
MD5 e394c98144ab41ca11ecae37fdf7a883
SHA1 ea37b348cf65767b52aac8ebec532311f3d96c9e
SHA512 be4a1a97aebe70816179059993da286360f86f5dc7d398c9300634c41eea0232f1d76cb146268bd77b3ad870b894c692e8b36de171714c41f85044e630d691df
SSDEEP 12288:imw5HEjsChNVBFgl0WDm+CEnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLm:7wuoOWBJJI1+DMp7CjWgNlPU51Ncv
TLSH
T19905F14677E80CF9E96782398597C136F7B3BC022625DB2F1360C65B5F372516E2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c8943ad81f267af84277b999123d762e64a948a1bbe725dcc98ed06378027198
MD5 a6043bc609bb8038e8a26d945789f6db
SHA1 9df6f5bcb9bfc26cf47d4f21c629e6fd23630c9c
SHA512 30e3387c078aea04f128dcea87f3ac44909b8e3dcc0d2f717699271774c56dd3225660cec4d1bafb842d1d6ab667e2d6ea79969cac98646063bf4f97edc6c33b
SSDEEP 12288:IBZ1Iy4nJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:2ZujJJI1+DMp7CjWgNlPU51Ncv
TLSH
T14DE4129A33D820FDE563923E8DF246459363789333A553DF1268926A1F37EC11E36722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4835a0d6b72dfde5024d4bb6f8296e0e6d5db0ca92b2c433552a6c0d5b114355
MD5 b887b61c55553e1992b58fcab880eacf
SHA1 f3859dcf95efe9636f44ad3edfaba3caff11c3fc
SHA512 8cb1e9f8871300636d9f0962f6b1ee6e6832f35b2a1b9db185f7eadf987ed0dcb4206498e4e77d31eb060e7985434b74547738741a36fd76c86daebf2381f57a
SSDEEP 98304:TQRQyi36YOcPQLvw2gAf+PN3z1+DMU72u:CQyiKayX+PNDcl72u
TLSH
T11B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a7097f68089ff6fa15e2feb6a2501a9a2f01abe6954007b3fcaa5cfceb14d739
MD5 5c288f4a46cd31d72acfa644acb0a468
SHA1 67b1f95a3ae10e5919bb4737fbf778da3f38f0cc
SHA512 58191d8a378842c1a50fa1ab2a4c1157fc8ca4e258df6dc52bf0a82a63215c4b23f1ca98b372d0795ad801894ed3ad81494e1d75d712290fd4cab8c5945f932f
SSDEEP 98304:UQRQyi36YOcPQLvw2gAf+PN3z1+DMU72u:7QyiKayX+PNDcl72u
TLSH
T1D7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f273c8c2419dbc3f9ef8afebf000e6de4dc619819235f88202f277ff94361e94
MD5 eedd4da3d8f696c5df0a4705700d663a
SHA1 3a6cc98e622c37ac664a7b32e1c0be0f944b7011
SHA512 0fce28d7d3f0b355895d959f0b3c9e5e026f80d279af6a67fa72247ac4f3c534e05c1be68ed7b0c1acb87b1473227864b4018755363dbba35c0ae0b72b8f8ef8
SSDEEP 49152:G68Qg55nhheWu7PNU3/YY1+DMCjz7PU5u:kthWRc/51+DMU72u
TLSH
T10AB55A33B2F60099C44DE1769F4A872196D27C718FE0E3DB8515721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 464d73a2c41c9ba946ca705dc827e83b200d328ae22ea18702d73525a1042cac
MD5 b620886459e8326915918ef0caae3479
SHA1 79b84902c705b33ee1b4cba6f06c6fb8e752b15b
SHA512 f8e28103aadd21d3eeccf985cd3806f6cce00497c9ad29d303506d3e7947bf3c80967ed348e3f54665e0ebc826e0498b187b5656cffa950f6557c443b09babcc
SSDEEP 98304:hy5112gYy5azzVvL69nLKnhZw1+DMU72u:8LIHmWh6cl72u
TLSH
T180167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3d08d48cfdf2931eead1aa8b2cf4f5934f985a2bf6a85f153efb4b01a304c555
MD5 b489aec72d7563e87dcec314cf2590a2
SHA1 fd25252d186433e8ac81049d8e896977954b076e
SHA512 08fa169e12609b410e3e44d0f03b8a2e5caa4458d612f0c624c5cb4af3698ae71a5018bceaa22d069a16faef3225842acaeb0d5fe9b2c9b6b86076e0976594b9
SSDEEP 49152:RB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glHY1+DMCjz7PU5u:Hu6JmVxd2d41+DMU72u
TLSH
T100D59D13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a340dd721ad8c9200850c5f19e0fdcd658d6edf4005495109ebd4a3c03a2eed2
MD5 5bfd477f928f70e7586ad86bca0bdca2
SHA1 d85eecf055561eb0c59c4b045d6b369e6008823f
SHA512 da609dc16743c301d1f3f09e0556e54a226d99b30ad4509799e5eb9b70bb6418f8b7e6e6ce777816305e70cb18f98ca69769bd665c1e94eac43ea880aa7c0433
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4x+Y1+DMCjz7PU5u:jmifPbRi1+DMU72u
TLSH
T13EB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9b7aeb33c055313c5d2b3e26aa6277e108b1934d7ffdb481daf3b31a1120ee77
MD5 601476757a73c524940a39d05586e5f4
SHA1 4c46e72f7170fba147f4f4cdc4c18b950340afa9
SHA512 030aa80bb838e3951de8459a09d39a06c2abf310f82557859416f0d570f2f59fe608d71757895774de7d3df79b7b666c44be47ce9d105c63d247d7d619202ab3
SSDEEP 49152:aSuZQIY0Be2KRRVtOnks6NMHqjY1+DMCjz7PU5u:E5dKTi61k1+DMU72u
TLSH
T1A4C5BF13F2E901E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5b8caabf4e06af9936c363273c312fb352c080c83762b5a1201cf1598b62b730
MD5 0ae16db56e0bcd2749efd224a4b34bbf
SHA1 4be5d6e279cbea6893f2a2ed46ee63fd7fcff561
SHA512 c453313892a19b7a24e0cbd09b418e91fad87415f9a69a0ea60a8854339a223f1b47b3305a4b663a60f172cf7dde49ca366b9d4ebb48a87ee5dd6d8b49d5bdae
SSDEEP 49152:ohtSn8EApI0figngiDn0AP5wCY1+DMCjz7PU5u:5X2iyphO1+DMU72u
TLSH
T18C95BE13F2D900E8D05ED179C7568632E962BC160B34BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 37ab7706ded55aeebc1aaf48306fbeb287268c4c1b828fd81c8bac4412872676
MD5 6cb110b2174b1c871eddcffbf3b1692c
SHA1 aff547763043805c21dfe43c279b6d1cdeff3cb6
SHA512 9ad308a59c3c1d1511e7a45342deaa897d9920185abaa7a46286ad8e97727e9fbfe2bec9dcababb00823a4e4a04915806ff72c22cffd804b69d98028058af6c7
SSDEEP 12288:VnnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:VnJJI1+DMp7CjWgNlPU51Ncv
TLSH
T11EC42356BACD15CDE827D2375EA756C61483BEC772C9377532BEF1264A3AC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 643f136a22d9c381fa30d09e8d05727514efcb0d3cd6a29609955da716785e27
MD5 f44f658c02fa737ea71944a8b732018e
SHA1 c89a92380d514e64f7d22475c743b8a5940b7c87
SHA512 83b62b241642f31e690ca4d38155243ae43191430da8c1adca7ebec5b48714bc8bc9237f82fd7f3b9817b9bc5075a75641c67d1982061afe091438c569edba7a
SSDEEP 12288:LMnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:LMJJI1+DMp7CjWgNlPU51Ncv
TLSH
T133C42366BACD05CDE827D2371EA796C61443BEC732C9377536BDF1264A3AC801363A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3336b188fb93e1536b61f204f14c17924966c71324e42a2e576f850bdc600061
MD5 2e1de8facee78699f48ca68ed1073671
SHA1 e7c2afbe5a16c74b42923457b7f54f89ebd54bef
SHA512 861d1ab1d40ec21125e7cbcdaafc9bc8e916ce9d45e0cb922c73bf5a18414b9ddd1566cca5ad054b3cee96f344edd24c52a2371b5f3c06ad124bcadeecf62f1f
SSDEEP 12288:uWnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:uWJJI1+DMp7CjWgNlPU51Ncv
TLSH
T133C42366BACD15CDE827D23B1EA756C61483BDC732C9377576BEF1264A3AC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 87f7487f2a4db939e9bd7ce9291aefba88aa8547341e17e80d852284a09bddb4
MD5 4befe19f42b7e7b21c38ab5597c24f06
SHA1 3099cc0d74b6873fc8cec99d2b9bd21c963bf40b
SHA512 a28e522a709d81f8e620f8486206a5811e574f1dab5130a912d0cb9c74c32eac433f35eb223a6af47decdd794dd93e12ae59f000decff0e59d94ce3171bbc1a2
SSDEEP 12288:/V5nJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:PJJI1+DMp7CjWgNlPU51Ncv
TLSH
T196D422567BDD01CDD827D23B8EB2858121A3BCC6739577BB6669E12A0E36EC01633B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d621416461255428471bb8aa739c500a5904c92c715f66a81ee5bf0c210c2780
MD5 b25d164ed3c9cfddfbfde1645bf57ba3
SHA1 dfeff3cf9fff55f0925ba6330ea21582ffa9ae52
SHA512 a4e7b2cdca8971c1d07aad6dd63dd7d6e55c9f480737efe76f48828d0c235c81033970756b890f4606d17febc190402c60976d095d45131e26534d7a39bcd2e6
SSDEEP 12288:GBnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:GBJJI1+DMp7CjWgNlPU51Ncv
TLSH
T18AC42366BACD15CDE827D2371EA756C61483BEC732C9377576BEF1264A3AC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c022a92b87dede0fb09f659de82a538c1d95885921142467ad4ee17e79ca7158
MD5 81cf30eee6598377db9795e340a73536
SHA1 e693a587f85198cfa3252d6a3bf04bd216886800
SHA512 943e7d12987c3e54aa6dd6777b8b070512948d75354a6417539f5d13f3811fdfa2a23dddc47324c264d26e959cedfd6077736fd3d0a3217fa85c0824c9054b33
SSDEEP 12288:uAnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:uAJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1CDC42366BACD05CDE827D2371EA396C61443BEC732C9377536BDF1264A3AC800363A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 ab8cb6ef9eccb4c8888d0f6876ac256ab61be51f6557bfb70a9bea6516af558d
MD5 d0963241571b825f1697e3a016d83ef0
SHA1 34f6944b1f5335b1c0d12b97955637f15646f6ea
SHA512 e97fb7a4907a04d09670b1ce7b88bb9ec7bed28e2781db6b85de6d67733df488a56d7303b1a75822d86312348b00a819bcedd864b718aabcb53c5da27297be34
SSDEEP 12288:sUnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:sUJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1E7C42366FACD058DE827D23B1EA296C51483BEC732C9377176BDF1264A3EC801363A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1df927c865d5c483749546a5ec59313da21c0647950e36053b806cba9e7a9ce6
MD5 0dadedead585eeaec40cefc767266234
SHA1 0ff2b5245c919032cf7faec7383d761910ecb6a6
SHA512 8c62080e70701c551d5bbc6ac83d4b2d34565c83f162b6a48e55d23ced9af4873ae07c02e145bb0ee8e78629b9473d4664834828ad01f8f24d3df7c70a02631c
SSDEEP 24576:OZMSzFVSOsJJI1+DMp7CjWgNlPU51Ncv:OZMSzfwY1+DMCjz7PU5u
TLSH
T1960501A5B39018F8EC67823ECD668906D2B27C5A17A0C61F13B872275F337911D3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 031adf6704f4294abde196f7b9920ac46dffe142027c5a4e70113655d9ff4f55
MD5 adc2433d31d394bbfdde15ff3316787a
SHA1 1e8259fe92b32dea6499ffea8b23b49e20a3583d
SHA512 e50262f47688a809d9aab7a71fb7228b2973c5593b4a0f844ff6d29ff4c6e6bd39648a26dc402a560e8abe0dd4f1e91093c8ca1c62ea7d13894bf52118df65d0
SSDEEP 12288:ATnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:ATJJI1+DMp7CjWgNlPU51Ncv
TLSH
T104C42367BACD15CDE927D23B1EA756C51483BEC732C9377166BEF1264A3AC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5ece0a3f5017c77160e92bda837a8517ff01922abb9a8d4dcda4c621d4bdf5fe
MD5 0f82ab6b5bdc28d30aded808132c590f
SHA1 bac7824b17d5aa3ca5f98998a658a7956143257c
SHA512 833cde544c6c020a1afdd1418cfc52ad56fa317f709226b26eba07e5a7b954745ad23ca126c95cd4d2fae4dcb9ae58d17ac98d96574de780a41f129b5b1d3449
SSDEEP 12288:GfnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:GfJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1CBC42367BACD05CDE927D23B1EA356C51443BEC772C9377166BEF1264A3AC800363A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 cb2e693439af64a837b8f689655d971d7baa945debb4ed439d014b141cd06133
MD5 2ec606a99b7e5a2ba915c75db4432585
SHA1 38172c2ae7f87552d9b0a18aae7ac8c6071af6e6
SHA512 471a9333da7fed78b99c53221a0913347d9b0f5c34a3214576e01c4c32f57a1da7860db410b1c87f297372e68e990e9438832c92609927e4e7291b4a20c6e835
SSDEEP 12288:5yPz5L84nJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:4zy4JJI1+DMp7CjWgNlPU51Ncv
TLSH
T1BCF4025777A530FDD53782398DA21A42B372B87217549BAF13A482761F37AC05E3BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 fee35b67a5e42430227ac6fed3211cb63348eeb1ec2f87785f1522f0708781f5
MD5 7534e3233ef1a6ccab1b7e629c0fc6bd
SHA1 060c45ec59cfd58eefd39a4f85c2ac3bad38b5f3
SHA512 16e3a82b6912dbe3c33b1212e1ab1035a7588207d846ad3549a159fdfe72e625b0318fb5887ec4a593b38fdb5239662eb8e2d9c3132b981b73141b02352d1435
SSDEEP 12288:vTnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:vTJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1AFC42367BACD15CDE827D23B1EA756C51487BEC732C9377166BEF1264A3AC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 032f6e6e6f1133df8c831517aa19dad328a6855d9d43d4358c35c1b74ba27efb
MD5 3e98c1fbc9db911574f584cc7c2927ec
SHA1 1909973bbc376816ff7b0fe2e5c5e92dc1963c95
SHA512 b565590189b6d4a087dc73abeadc13cff91ceb6a0b383abfcfb540f041e9aa1aec0cdd13898a7fce391089a390fe437580d2b8a0baf7c6473b1ac538bb58b697
SSDEEP 12288:BTnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:BTJJI1+DMp7CjWgNlPU51Ncv
TLSH
T161C42367BACD15CDE827D23B1EA756C51487BEC732C9377166BEF1264A3AC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 7e634ca0115590c6a8660e83d47a9c739682496105eae8e1dc2373d7ad4174f2
MD5 614ac3cf4305bed8e65f8d6a29bc6a48
SHA1 cbf38c7f4b6dd921e3da380bdf9d55f1427e0abc
SHA512 4c125bc8bdd4006f42e0edccac4eaf7c1d69ea3fa33f85f09184df443ed5fa46240147606ba83920fa9fe5e4a808169a426db8c45961d41553274bb95e5da873
SSDEEP 12288:WyPz5L84nJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:rzy4JJI1+DMp7CjWgNlPU51Ncv
TLSH
T12EF4025777A530FDD43792398DA21A42B372B87217549BAF13A482761F37AC05E3BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 214d38b9ae7e94d8baf0ecdf1e9eb75895087c38fd29f0630842b940ecdcf8f2
MD5 8013a3db8479ba1ca1290d0caf7b7866
SHA1 6666acfbc278d502d8481c064869a28e7edaa98a
SHA512 9f85bb8ed4f066f1af6a746a7e3fb6c2439cd121383d4855d404780904079ac864cf7addfe031c3318206dd468214266a971d59db3ce51cccceb64b5d5604445
SSDEEP 24576:ETHaLl3z0zDmJJI1+DMp7CjWgNlPU51Ncv:ET6LljNY1+DMCjz7PU5u
TLSH
T1790501A5B39018F8EC67823ECD668946D2B27C5A17A0C61F13B872275F337901D3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 116d683c9c2dbab3ff4ecb4cda1a1a66d72360ec1e3366724a1b57f63307769b
MD5 0f50097b0b16fae372067de9a1d59c0e
SHA1 0c71c912a8248d7ca1f1192a8c6f9a10be97fbb4
SHA512 c8013db7baa24abc4d3eaf80670b32eb6b4169304f0a6eda9a493299f826c74a37e86bbc881d5c06dbd42bf7c5833f3ab9a1644a2d6a459190cc7cd788107268
SSDEEP 24576:037d9CHKy7GZaJJI1+DMp7CjWgNlPU51Ncv:+7d9CHKyawY1+DMCjz7PU5u
TLSH
T14125CF90F3E414E8F0B7DA358D764501DAB67C9A1B61DE8F03A8651A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 e4a4ab03c223f09c23b1bbf1c0dd8729f17e9b78b2b778fb50c42bb460975183
MD5 4f9934228338273dce1b04a198351f75
SHA1 3c172ab14ef6fac84f3280dd868dc9ebc5c2eb54
SHA512 d3d0f524a4a8d889631bdb22be11e83d84f09afe186f01498333f25d0207bb027a00d4fee47dbbb5b5de849b401906ab2d387a11626956081dbc787e60e87c6a
SSDEEP 12288:B2nJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:B2JJI1+DMp7CjWgNlPU51Ncv
TLSH
T17BC42366BACD15CDE827D23B1EA756C61483BDC732C9377576BEF1264A3AC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 e90f116913fe99934e7251b269e3257759fe03d3cb89c5331534674005c65bb9
MD5 427596b658879b0731ea1b1364e46cf5
SHA1 32758c33b485ad0c3c68262d3bb18edd8fdeff7b
SHA512 e52ede46089601bc0c957150dce4c449cd81043e3203df5f343590b4d9f3d865b09dedd221ec1b95609ab46c4bf5cda17c724a9e86e01aa34101fee8ccb527e9
SSDEEP 12288:BYnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:BYJJI1+DMp7CjWgNlPU51Ncv
TLSH
T101C42366BACD05CDE827D2771EA75AC51483BEC772C9377176BDE1264A3EC800363A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 b17c68170b672deb2c3fc08b69f5c412d18742101b873754796bf44356ab4e46
MD5 b20eda71f282a21b69e9f7dc23b2be61
SHA1 bc046b38daf1a0338d53844ad9d80b34e8f91dae
SHA512 d6084fbc79b0c7759310169817f3eee5e218b9cf1720ae83b8592c473e9098e01467372cb55db380b810225f5b1722c589fd14a693cbf6e9d382732779969896
SSDEEP 12288:I1nJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:I1JJI1+DMp7CjWgNlPU51Ncv
TLSH
T130C423A6BACD158DD827D23B1EA756C51483BEC732C9377576BEF1264A3EC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 af2406319a5b72a2696167b08d10a07b1a254958d373f5ac49cab3986af702fa
MD5 8db918cd867ca64d9e010d9d252fbcb5
SHA1 0f252c327256e1c0df37df53aac82386c352a3d1
SHA512 792628855a9669600e4a24108d6c76f24452337b375534a3a7fcb3f9bbc7107bb628e0145ba6b551b5a87a067225cb7439b6f6d3c5a2eb0f8aabe01f6831842b
SSDEEP 12288:NTnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:NTJJI1+DMp7CjWgNlPU51Ncv
TLSH
T15BC42367BACD15CDE927D23B1EA356C51483BDC732C9377566BEF1264A3AC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 78942fbf0862650a2d65295d360d471e23bd5ead3e79d3604282e1343e6ed7cd
MD5 9b694fa1930146a31cee1b6c3affce1a
SHA1 921a622a91d2f82aec1603e5fb0caaf1d8c055a8
SHA512 da53c0be736ec4d589174fc45b42c550bc28d7c63a9639eced354e576a77f9d802d8bb0c1ec011f4cfc0372a8ec5e9d49ddc3717c042c1949c68dbb8ec6f797c
SSDEEP 12288:r2nJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:r2JJI1+DMp7CjWgNlPU51Ncv
TLSH
T14FC423A6BACD15CDE827D2371EA756C61483BDC732C9377576BEF1264A3AC800363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 9e0e104ae3a40857ef4a384383183b8d72480a77613530e51cec0f33502e1afe
MD5 c3ada5003a6ed1eb882496227cf8ff65
SHA1 b8c17e902468329629153235026839e2fae17d1c
SHA512 1f7748acf3f9fdb6e101ae2986d79ea52a1e1f3a957de307ae00ead38af4444f16979749c32595909dab65df41a7fe2f1506b4e96ec654cede2cc9bedefc3899
SSDEEP 12288:+7nJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:+7JJI1+DMp7CjWgNlPU51Ncv
TLSH
T163C42366BACD05CDD827D2771EA35AC61487BEC732C9377176BEF1264A3AC800363A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 1aa646f93f1064546960a8a7fbbd9e4b8ee76a47227d33750b8fbdfb744581dd
MD5 05093e07294fdba297af5142634c81fc
SHA1 35dfed026dc97151143267cacac58311fe1cd66e
SHA512 36ae4f839812b9fa4b6b8ee42f523ff1ad94a173323f75bf7c1d7525224a5f75898097015f2edb190242bef878cd4d539c8abe47a753cd9c505d75d4f0f5668f
SSDEEP 12288:6BnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:6BJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1DEC42366BACD15CDE827D2371EA356C614837DC732C9377576BEF1264A3AC801363A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 20be30aa840b57630023dd1b0532f87be8ff45b00e9b76ab92f5fb61f7e0feae
MD5 e35b7dadda401dbe7473ada8dbf24cf7
SHA1 54ef8a000fa694ee33d43f3945daac3e9f04b711
SHA512 43184e1c84f96f181a86df35075bd77dd520c73fa20a4ddde90b4bd83f8ed1f1fbd78b43b1a67e11b1952e5d6bcb45fff4cc88d5e5cda0eddea5e6e3da2bed2c
SSDEEP 24576:9fwvok9RX6wkyAIPJJI1+DMp7CjWgNlPU51Ncv:7MnYIPY1+DMCjz7PU5u
TLSH
T13735DF29EBDC04E5E177923C99B3460AF6B278591B31C6CF129A536D0E37ED05E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 87c7dab826e05e6cdc14e2ea8efcfd6f056544b423dd28fb185c0a0a45c5be47
MD5 ac543a1411fae7b10244a98501bff2ab
SHA1 f81f40317975b447050978c83c8e89b7b4e2f8e8
SHA512 ea08dbac8efce21a9d0945795829da418ef929bedf3250364dc0dc607cf4619ae391b38ac795752f8814e62725de0aa0f36f3360ba5b319b248cd7b62c670e1b
SSDEEP 49152:XYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iY1+DMCjz7PUw:zySzPT1+DMU72u
TLSH
T1A7066C56A1A801D9C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 31495f2d470ae3b9b22cb0fab68111fa10d14b34616353a25358c74e0088d4bf
MD5 cc0386ee4d39915406ef3e84f9c28bd4
SHA1 8a55d02038903d8894317daa2103d7f09322c100
SHA512 2dea045e689a60f7b55966c81c27aedcb7d88a6b39d0c4acecc080581f7ead6f886b106ede3a350e9feda4bd107d8d438c2edaf677d112148cf70e058c0bff9e
SSDEEP 24576:z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYcJJI1+DMp7CjWgNlPU51Ncv:z47JUQj1irIhCnDHUPfF/SY1+DMCjz7v
TLSH
T1F965AE1EA3EC01E5E1BAD27885154A5AEA71742E1B31DACF2270837D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 e0231fe927ebf481146c1cb3bb535f9892c655a66765c0ae39f76c526b9b1319
MD5 50094c91e7ce79766c8a7c40f12482cd
SHA1 38403285892b13851148b5cffedbadfe08ab3400
SHA512 962552e9835f5434ef2b2280f8dc70ca191a9aeb98aec6a097701ebb292c37fb8b6baa62e1302d2a9f1a87d9bd829fef2291d591630f22c7c5875fbe12075e94
SSDEEP 12288:yNsfjnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:LjJJI1+DMp7CjWgNlPU51Ncv
TLSH
T1EAE4F15AD29802D8C46EA23ACB564A41B3637C5653E1E3DB53D4F53E0F369C05EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 2aaf81f86df0c6faec59fecc0fdcc6593507da10e39938fd12b624ae7fdaa3ec
MD5 d758d886f17bd2cdf689c124dbfc49de
SHA1 55d8ce099e3a2ba6b0c8692216ede9688afd5a24
SHA512 5e7b8321c8603b64f4590abbbc47c14179b45218406dfcbb585b18353200e60dc444309a77c69f2e71a568bb3d0b8cbded5722d3ae3297f0e99eda09d7e10c34
SSDEEP 12288:4M8/5RU3fCZgNbzlUdcUqnyDmf/TcqAWl5mLHLZkGH:4vHUPHTUSUqyDOrc1WDmLHL
TLSH
T1F7452800766ACB4FC66940326E72C2CCA7707C45EE44AF0773C9873F9576658BAF2692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 b58a48158da4c848a2e7b13db7e120e06f7c506ca38c2d212662cbc1dab4b0b9
MD5 d81b5b1de0bb79a4f23c5bd7b04a542e
SHA1 72e09e1dfd6700dc989468379b8f98124f39b76c
SHA512 87e65d4187a192e8f5a59aecc686599eaa34a3c3fe9f0e85b22be9e799f3ac34c330a1bccf683c80e641ac183d969ae38c4f2252e1611b5cd869541a3eb67064
SSDEEP 12288:XShnPoBdLdLYB4Y2ucRV0A12TEatqqfpL4:MgL1
TLSH
T15455E941643B978FD1B75032032A5B8C77A4EC16BB496F26B389457ED82AB11B1F83C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 111d349f8df81d693a69d02dd77770e2f77914482fdf158500dff5d9ff205a89
MD5 6cb1c910959a5df34e933dad5a8e0ed1
SHA1 1106826dde5edb772d76f7e7713d51c66d88471f
SHA512 05f21e11790cb5b60a8bda080de2d9ce9cceec38b9158da264154ac1b3fda588be427bb92988665f4d240e5f6e3329c4538617ad12b80c19e61e00c25ec864c9
SSDEEP 12288:Tz7LnJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+Wh:DLJJI1+DMp7CjWgNlPU51Ncv
TLSH
T126D42362ABCC198DEC3B92361DAB95512107BD963784B6F3B56DF2664939CC00F73B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cc6a344d2106085f8e761ebc8b1427298b108fff4b7d44f58c63529e91e48461
MD5 c38cb40a657eb02d6aadab8b475154b2
SHA1 111a61160064b39178b0f4b32bf8337aac3e1957
SHA512 e4f2b5924256cf9a4f255a121e97ad416e41a30cba52d3ac68a2c56d60f6fe3e6d3982baaaf79ad2da9ad26d5bc035ad0dc40a60d942f34ef9324b468ba15337
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYNJJI1+DMp7CjWgNlPU51Ncv:xgb4mBIBhGFcY1+DMCjz7PU5u
TLSH
T17E659E1E22EC02F5E0FAD2B89DA64417D6B378161731D2DF1151422D2F3BEE89D3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 dac39b66c57c0a5c86cc81ebc0c63d28a47e32de30241da279310afb4cedc7db
MD5 0c4efe2f2a1d6160e761721c2f664e74
SHA1 0471d989f32a71bf19eee0b0905ba5245142c9b9
SHA512 3c568da44d8d932b2acddc578e81c7a48d7099109be29843db267ea257cdde5210d025c03f563746eac778d5bd62e6ed2ec746b44d3f34bc2fa9337705ff19db
SSDEEP 24576:AG88u8FpJqH1bzria7/msJJI1+DMp7CjWgNlPU51Ncv:T7ZFPqVea7/VY1+DMCjz7PU5u
TLSH
T1BD35F16577E501F4D47BD1388A824663F6B2B8251364FBEF06AC8A511F23AD10B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 e224e3aa234b27127295c6bee8b6383985789acc1e91e7d0ecc9926fe923b2fc
MD5 935cf2d6627e8cb80d216842b29a60cc
SHA1 554073458ba1edd46ef93bbf4dd24e07fe46b37e
SHA512 7741fd61fdcafc615926bf8a4e3ba353a18f82b5596cec364586775ee0808dc61bceab0b772f668c1e37d5ea918b228d0dc652ffc81f765bca3599461530cd05
SSDEEP 12288:JHvUrBFrEjwaQ9nJJI1+XxiDT+PlidX7ZyjjEn1gNlPFY4eVkyY4tLBOkEBtj/+G:JPUr+NQ9JJI1+DMp7CjWgNlPU51Ncv
TLSH
T13E05E12F66EC18E9E676E17D89828709F772B4521351A2DF02E0C17E4F27DD86D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8df823561065416859c568e6413f897477453bdfb67e536489c217de8c4e3cef
MD5 9f77019ed9a303353966f020fad7a3d2
SHA1 e5b5a81f4210cc6a43fe737c9b806ecd3ae3b0d5
SHA512 b58961f825ab5f5e3cc888c52277ea254207647125324474a8474af9817e0520e4b94d02247e0e11cd4227a8e361ecf76b2459a6916149a9af8712638c36db08
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAY1+DMCjz7PU5u:RG05lO43bI1+DMU72u
TLSH
T167D5C06E62EC11F9D0BBD17CDAC64A0BEBB23815032556CF02A486A91F27FF4567E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 49bd9912c9c0520e9121e4f72d1ae81fce6412557936e5fcc8213c5e3426bfc9
MD5 576024b7113ac8bdc77e2b128c9f0814
SHA1 3907a2542edf86bf8d9a20c85c30ee342c2aae94
SHA512 972a0b8a46bb501b57125f9207e9e5bb2a85dc483cba26326c99dd6f70daf356a85028cc703761397ce6fa8407965afae73fac32fa4775a405d98c149821184c
SSDEEP 24576:ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidniJJI1+DMp7CjWgNlPU51Ncv:qa5POZ3+Jt2pasx2+mYY1+DMCjz7PU5u
TLSH
T19365BF5EA6FC01D5D579D17DC583861AF5B2342253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a3506ac58b12e565d29604e512a6adac154d2d1aaad305bb622ce3efafb776c2
MD5 20fb655bca2da7c415bb9d794033424d
SHA1 04ede40dd24ce723db884f99594c01183dfcbd46
SHA512 71d682f23d3868c2b7741ebb53793d9057d23a669cd3dfaf329d785f61d39eceb81f786b7861c0c03c713a83d835d00e7bf5c9ab31ff254bf8370bf8b50f909e
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FkkJJI1+DMp7CjWgNlPU51Ncv:cNc/zEOVHF1Y1+DMCjz7PU5u
TLSH
T135857B2623E901E4F5BBE1BE89779546FA71786513309ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1e3ce4f46b94f9bc930b36797e60b90559586b1cb96c54b6bcd8f10799a30fc2
MD5 1a773d48f2dc3c80b8651bab983b1868
SHA1 eacf8bd8c8ca35f59efec32fcc173ae940687409
SHA512 de196fb9ea325d1c8889970082204f9c888933e78bb8dada24880b7861ba6663d0bd12c2824338b622ddedfc3a98533a046ffbe0affea39e3b7651e01d3ac085
SSDEEP 24576:r8kNvNnaFeYhJNtmZBmjJJI1+DMp7CjWgNlPU51Ncv:r8MwBtOmjY1+DMCjz7PU5u
TLSH
T11955AF6EBAF806E4D1FEC6B58D238512E6727461173293CB5290C13F0E279D89E76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 5604130e34e808909df7c139a073ec89c2fc3977f925218b052b7b6e1fdadc73
MD5 49b289720919ba11aeec9876a9d17906
SHA1 b09f51b8f2a0b05da716cd4cffb18f4a42053b89
SHA512 9d6fd4d9761c56c0fe0920ac19f326350f59bc03a0984c1074c5e82ce100fe540f2abd4b0dc014464a88f7ec8918a72d3749de4b8d50f905a7e0e6aa7e284945
SSDEEP 24576:wD3FHshBIYQgAHJJI1+DMp7CjWgNlPU51Ncv:wDVHeBIAAHY1+DMCjz7PU5u
TLSH
T14125E17EE79C04E4D47BD17CDA638A06E67238A9032166DB12D4C1B65F2BED42D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/120-91-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/120-97-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/120-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/120-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/120-330-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/576-103-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/576-111-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/576-315-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/576-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/576-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/576-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1020-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1020-116-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1020-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1020-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1132-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1132-14-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1132-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/1132-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2652-125-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2652-117-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2652-314-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2776-282-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2776-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2776-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2776-54-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3504-38-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/3504-46-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/3504-44-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/3504-49-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/3504-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3504-37-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3692-75-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3692-297-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3692-66-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3692-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4292-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4292-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4292-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4292-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4872-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4872-131-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4872-137-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4872-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4872-139-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5188-81-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5188-87-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/5188-82-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/5188-311-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6064-78-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/6064-0-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/6064-7-0x0000000002140000-0x00000000021A7000-memory.dmp

Download

memory/6064-6-0x0000000002140000-0x00000000021A7000-memory.dmp

Download

memory/6064-1-0x0000000002140000-0x00000000021A7000-memory.dmp

Download