fd86b3be7f09f95549c55457b76f619a60bc424d8b9a9ecbde9983de4e31d94c

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_bea61ae90236ca9b987603983907fa6f_elex_redline-stealer_rhadamanthys_stop.exe
Size 2.3MB
Sample261011-d7fecavwft
SHA256 fd86b3be7f09f95549c55457b76f619a60bc424d8b9a9ecbde9983de4e31d94c
MD5 bea61ae90236ca9b987603983907fa6f
SHA1 d5d8535723742bf47ecc4112953dead440b26ea5
SHA512 8fcf8a87b6875cc32b88557c0154f6886537d2062af49b9e59c5137abfe077ada11f34a9552cc44972bea8f10058555c5e52cde5833920fe4ffe5b77c5408891
SSDEEP 24576:f3dCN/j2GLl3iFSE33b9Uw2aKngL2jdshRTdG1YxITqvfPkbIcbjL:fkN/j2U4FHCarSj8RoTCC
TLSH
T1D9B52375FAC0D630D01B57791BADDE942912BFF8E51B884ADAD11BFF5A397E0923A000
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4148	elevation_service.exe
956	maintenanceservice.exe
2308	OSE.EXE
240	PerceptionSimulationService.exe
4240	perfhost.exe
5252	ReFsDedupSvc.exe
1480	SensorDataService.exe
3168	ssh-agent.exe
1876	AgentService.exe
2144	SearchIndexer.exe
5184	elevation_service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-10_bea61ae90236ca9b987603983907fa6f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-10_bea61ae90236ca9b987603983907fa6f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-10_bea61ae90236ca9b987603983907fa6f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\90aa444267fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-10_bea61ae90236ca9b987603983907fa6f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-10_bea61ae90236ca9b987603983907fa6f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-10_bea61ae90236ca9b987603983907fa6f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-10_bea61ae90236ca9b987603983907fa6f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4912-0-0x0000000000400000-0x0000000000CC6000-memory.dmp	upx
behavioral2/memory/4912-55-0x0000000000400000-0x0000000000CC6000-memory.dmp	upx
behavioral2/files/0x00010000000093c8-78.dat	upx
behavioral2/files/0x000100000000994b-79.dat	upx
behavioral2/memory/4912-81-0x0000000000400000-0x0000000000CC6000-memory.dmp	upx
behavioral2/files/0x000100000000932b-77.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-10_bea61ae90236ca9b987603983907fa6f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	OSE.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-10_bea61ae90236ca9b987603983907fa6f_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4560	4912	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_bea61ae90236ca9b987603983907fa6f_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000075043f533259dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1e7d4103259dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0c6a8113259dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040beb0113259dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a80a5533259dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
4148	elevation_service.exe
2308	OSE.EXE
2308	OSE.EXE
2308	OSE.EXE
2308	OSE.EXE
2308	OSE.EXE
2308	OSE.EXE
2308	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4912	2026-10-10_bea61ae90236ca9b987603983907fa6f_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	4148	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1876	AgentService.exe
Token: SeBackupPrivilege	5252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5252	ReFsDedupSvc.exe
Token: 33	2144	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2144	SearchIndexer.exe
Token: SeDebugPrivilege	4148	elevation_service.exe
Token: SeDebugPrivilege	2308	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 3268	2144	SearchIndexer.exe	103
PID 2144 wrote to memory of 2520	2144	SearchIndexer.exe	104
PID 2144 wrote to memory of 2164	2144	SearchIndexer.exe	105
PID 2144 wrote to memory of 5888	2144	SearchIndexer.exe	106
PID 2144 wrote to memory of 3520	2144	SearchIndexer.exe	109
PID 2144 wrote to memory of 4328	2144	SearchIndexer.exe	110
PID 2144 wrote to memory of 3084	2144	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-10-10_bea61ae90236ca9b987603983907fa6f_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_bea61ae90236ca9b987603983907fa6f_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 720
  2⤵
  - Program crash
  PID:4560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4912 -ip 4912
1⤵
PID:1300

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:956

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:240

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4240

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5252

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1480

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3168

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2784 2756 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2776 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2776 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2784 2756 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4ab25a5adf779d752a98536eb0502b9f5f114cd40e483d57edf0b67a0c03bfe2
MD5 3c72b450880dfd4932118bd1b2ae2580
SHA1 dbd711b1f52baba8055835aa8ddf126470e78987
SHA512 d157b37e5766f7f09b7c4b1f9e5a5f67b0d1721fe2a32a25b77308f090cc7ffcabe4b3c93d064b6f35200d51dbbd52936504fe995fad56bf7b15c6a52f608608
SSDEEP 49152:1b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnvN/j2U4FH:L3q6HjBoj2jF
TLSH
T192D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 b6ee5e11f8ff5cdc34caa5426f2e594a0093029b0e80be1042de98b1154b02e6
MD5 249b408815cc3dd30e0c629d6a083c7f
SHA1 9e9e5629dcbb7dbc4fd4b1f15ba36b8476309148
SHA512 04c4b0d27cfd43611873ac64cd40d338cc2e06dd471502e9572bba4be529f7573b8aa6f4d01b3bdfc37f8529a0b0cf5f15bda30e86af0863200f15b350a761e2
SSDEEP 12288:x1XLsswWkxy2lRq2czAUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/XYfDtczAcdCN/j2GLl3iFSE33b9
TLSH
T1BE85F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 fb16f2d72600ae26c93e028088c91993f6f9273fefb7c5e6e8f0ae274e4b6398
MD5 35b82ae683444680d17f283d83bbb33d
SHA1 69f21a021020e0d6f9cbbc6dacee712d25faef4e
SHA512 5f55fdf06403908e23c84b9b633a5627c111fab6f21355edcdb179c3c0c4fdb27e88758854ecb39fb4963d73f93bd00d3fbb1f86a1e8ffbf5a2453269d42b723
SSDEEP 24576:D0Le5ji0hmxirMMdCN/j2GLl3iFSE33b9:DPji0AcGN/j2U4FH
TLSH
T1BDA5AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ec7a83480f2c726262a41ba2a9034287e4b09a03197b3efc5645b07b39a95e70
MD5 e79a1ce363e1709fefbabf60322e7ad4
SHA1 2c17eb46ecd5a7f1d3716c8331091c6ea128df55
SHA512 c0cbd3ed73748401f3c15b803f563dfd9732e390ae5ff73d9a288a4b8c4b98f5b9064140310d19b28f98ee5cc8e8ba416d10c4709d9ae0c14236ce603fec32c2
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWE6q8wyuKdCN/j2GLl3iFSE33b9:J/ezSC6vUzPvxHjyyN/j2U4FH
TLSH
T16B755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f73b4b8bb3886d3b550506148317bd589d7ac7f928f92f0b8b9be7d403db078b
MD5 eb6b2229e63b0303d788a0d905839fe6
SHA1 66e7806627de978a045fa9a383ba57ac52932b86
SHA512 9e06acb721cc06c1ff27934f26e751b0480baeaee5b75971c40fccf98f51866c3a594e7369dce43ad2cf4df8ad57613a8a1cffeb38e6cd5a80a446650cdc1a40
SSDEEP 24576:KVbqPb88hv/l+6zdCN/j2GLl3iFSE33b9:KVO88hXl+DN/j2U4FH
TLSH
T136559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 6494dcbec8800f400d044d0acfe01448827910ae3b2b8079d8090e2d6b14947f
MD5 a9f9fe062460ea60ee15ece4bdc42221
SHA1 6b6f963a6e8f719796d780eb9ac69aa116cd8f50
SHA512 e38d3d1f548aac79cbe0085eaf4ae0a82a366ad5dbe84cd39b9644393f61fc55f111d2724f3d9cea7ce86d1a4877615b1e6f1538b96396ced2a8642df2cbf311
SSDEEP 12288:VRwJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHm:VRAdCN/j2GLl3iFSE33b9f
TLSH
T13C752364DAA4B565F66F837903ADDE615200FEE8E925884786917BEF117CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 e1fb0be95662d9eda2b684a72b5c2e21ca8ffc5c86503fafb09e79fd1cb19bf8
MD5 510da4940bb9468b1ee4ab9c21a18bc8
SHA1 4a2e014204ee4b51d0b58136a987d35d36c3ee90
SHA512 e558c028dfd2e9bec959766b223e162bcab87251875b8529075c459988e50b782ae4bbf70dfd4acc59962c3fde5de4629f228ab26e368814acb68f4b834858ec
SSDEEP 12288:deBNUbTVO86UzJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dJIULdCN/j2GLl3iFSE33b9
TLSH
T17B85CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 213e8279bbbaad93b42b50bf89a112c47adbd336b8bd4a37713af98b0824b5f4
MD5 245893b8e40bc1fbea1d7c74e96a99bc
SHA1 2aec0cd7c1d807cd833f31d0e695dd5b6cd598ce
SHA512 4c3f4523e1e641a9c6fe813654f33e6e9d172aa9928ff1698ae681536e59df78472d3bbad81d3e754470a2baf6a8843937b754c5ac348c1dd29c1455ee0b4f58
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THh:AQvGAdlCEL8c/yRNw5Czj2jF
TLSH
T180267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 4172b5ab716d0f6f673310192f5d5612340e96e242817f8b7e3d9b6d1b4d2a59
MD5 dfbf9a8f2ac8281ca57b546ce80673d0
SHA1 80a227f9087a3cf2ca078dd4dc5776911708c227
SHA512 cda06c360d912a6840f1ce76f6a71653a89084314f5d10505d40235b2b1a6fd8e89c955e8f8b4a657cf1f94345862c7da21f738d2956732278de79878c7cb23a
SSDEEP 12288:SAwSfxL/2Dc34DLLmt0LDQewsAjlJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9x:XdewsAjhdCN/j2GLl3iFSE33b9x
TLSH
T12795E031FE74E036C2BF0DB61B36C716142CBA608B6119C3E3E85E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4f9c45bd938ea218b9a12a18e41b350729f3b742add03ccb557a3bbacbc3db83
MD5 2db67e60c94290b8144b29d50d3821eb
SHA1 d64da8221b26616cb2a149d0e9b79541fe270cf5
SHA512 945bb2fc84756a4312e127b1f7775a081a49c2da3e064c0bbb4381dc2b11aec6ac2a5958454a92098f1dc7027bfafa8591ce89d4d6996517e98b4747ba167024
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHm8F:6UEtQevvqc2W1cpV2EI32m
TLSH
T11B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1c8f3b7e599c96cd3dd82845c983e7aad0ffbeb0243a4feb0f4db381c095ce9a
MD5 52eedfc45421a23edb263d6275998599
SHA1 5a800fa83d7a792da1a0e8891b8c2f50ce235dbf
SHA512 041d64cd8da7d642605a2d5a4764459b3f7fab59994b15358637504b77eea4479b8d8c53ee857ce33323d60fe3a2f585ac9a665ceb4a37d59af77d00c08bd207
SSDEEP 49152:rCbRquA/m2yL5zQfFiV+XenmE3/zWN/j2U4FH:0oqtVjnm3j2jF
TLSH
T1C2D58D0976B8C2E4D1F6C77886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 195faaba72fadd3dc7b37fc018f8e0927ee96296e8a6ef907ce8f468075d7d64
MD5 ed3ed29032fed8064581c8175aad2d7c
SHA1 cf4dbb4418ba7b5d155f3a90a3ebbe65c7469d37
SHA512 6bf0007a5971e91d6287660c598279307bd9c5270bcf877c137894f13798044f0db9eec53c0e70427312f6f18e7faa0d4ab69841fd2944a4177759494d230c0e
SSDEEP 24576:/AhGLJIFoiwtA5l7S53WdCN/j2GLl3iFSE33b9:/AMyFoiq5pN/j2U4FH
TLSH
T17335AD80EBF955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 41ccffaf63823879a9be300aba7f28f1ee9bbf328f5a1297c1a175306f644e2e
MD5 bde2f21da94259f999376af2fc528a79
SHA1 a50a18a8420938f2ae604046da8e2d6de17fa6db
SHA512 440543c904231a4ebe58e0716f350a40b3f5061f33f2795a3482c8608841dfa338ed369e4cbee7ce51abaed4b32f29c134c9b658390d485fbaccfa8bd2fd6d65
SSDEEP 12288:Mmw5HEjsChNVBFgl0WDm+C9JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:pwuoOWGdCN/j2GLl3iFSE33b9
TLSH
T18285F14577E41CF9E96782398697C536F7B2BC512A21CB0F03A0C69B5F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 55b483edcc7d27eea12d6c3af3cb96235a8d4453ac19a8cc6c48f8ebc573565b
MD5 ebb837ab170b3080e33a4b79fa88e13f
SHA1 82befe9bb26b3f1647d2e7494a36c9d0ae17ec05
SHA512 0542835a99c836dc721344c401e98038af097d33b56f4516cc1ab26d153ba65b4b78e3c5e43da1ea7a361cdf6f53d37def17b8467f3359054c11afa12b3bd952
SSDEEP 12288:RBZ1Iy1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/ZukdCN/j2GLl3iFSE33b9
TLSH
T17075125973E471F9E1A7823C8AE59A05D321B8A5A73243CF026047EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c2842741982ae597b8ad80e4dfd87f1772f9fa3f32dcd302376bb2bc18958097
MD5 417de5634499f4fca292c106aea75332
SHA1 3001feb9bbc1f93d619dfbaea62bfc15604e0bab
SHA512 9f8e75c6eca2af4bb0d2cbab9fdd15a0ec9130c3d806c774cff7a6917a1837ff0f63fbbf162bd41d8f0198b875df4fe4bcb650c435ea8031dba592fb7c03043c
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ut:nQRQyi36YOcPQLvw2gAf+PN3Yj2jF
TLSH
T1CC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1e423ac175d7049de8012806b0965e75f049feeb54f7d74520861c51c13790e5
MD5 0f62f09b5eb651d2e240ff465304cad6
SHA1 eb931f70458ca42de6fd948a1232d599649c01c7
SHA512 2042ca2d321e59b145539256efe8258dc7b917f844a2d0a0dcab3510ce921bed4609eef70f07c48c475ca073593aff8f3de04035cef5b68172237647f5fd3046
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ut:pQRQyi36YOcPQLvw2gAf+PN3Yj2jF
TLSH
T1C4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2dce8b4e109259c3e28365e3ad4ad094cc735733d42ddac6b1fa405ce801d069
MD5 5b28fd74d2db66c0918691ba003f6186
SHA1 10d4634e212243c7e803e1f5941a7c63115d1dc2
SHA512 83a09330103e33b105a46b114e14b11d1cc4430e8cd4ff8110acf9077f4e96ad83eb10d51b43fd65c17a0a352a5195d8c4ecd9b6ac5b9091cbb385487d304ebe
SSDEEP 24576:QwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL00dCN/j2GLl3iFS+:W68Qg55nhheWu7PNU3/GN/j2U4FH
TLSH
T120B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1d500cd1bd3657793d156be4e47be1453f6ee858d477633fc9d3a5b7ae01a321
MD5 c5e14b2e189313dab853321faa778e90
SHA1 156898f6d9059b5ac16691fdaf78eab36ff7f2a8
SHA512 9f6935b07e08bb2fb70f13d687e68e2e1546ac47013c27a49f9403f4b05575e38a182bd31eae66102dde9dc0ddc973de6618e5b1d0104f34c48f049148a5a179
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99/:uy5112gYy5azzVvL69nLKnhZFj2jF
TLSH
T128168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3b611fd1c2c922a683e1c6d375c5f59d8d1646edc3d244177f689e6cf8a7e442
MD5 330f7c37a4a048c67872c9fc91dbef6f
SHA1 2d114f9a11a99295d213520201448868154e1e37
SHA512 3dd15256fdbd23409e946e3d817e2e107aaba5b2c8903331c8ffefb305e8e14dd33be86b61311cac129fafabc27bf6596462e58f27f4fbcf274db72c52795a55
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl3N/j2U4FH:Uu6JmVxd2dJj2jF
TLSH
T172D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8948a6a1c746d6b6d66adc0cec67554336cb5d799a2eb60d52fb62f50a2dd4d6
MD5 a4c65b7e9763b82e890c0504ea1dfd89
SHA1 385d0dbac4b4d2d857b1ff1e6f4727be91f586c9
SHA512 816f33a4be35dca3b8200b7ac26bbbd0226a2a90b98df4c2082d119f91b225cb46fa5d92e676e12b1e47459996607d6185ea977b67a9a699796d4f9bda715dba
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4xIN/j2U4FH:amifPbR3j2jF
TLSH
T1BEB5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d435c33be61d4ed7cf1e13e3e2a80864301326d15117ced5a89601591821f37f
MD5 b34b8440cb936e9f99baade400f8a5bc
SHA1 ca9567f6b40a15c3104cd646187dd9777511aa27
SHA512 13ed0d4b034493f195f63618b665e4caef29d3b90ead4a76adb9d5628030ccf03a4fcba276ce4fd480fd878f6e146aaed89dd0754db6059854e3061817c06617
SSDEEP 49152:DSuZQIY0Be2KRRVtOnks6NMHqPN/j2U4FH:h5dKTi61Rj2jF
TLSH
T1BCC5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2cc7ae5a1771da925cf82f9eef4eb63a7b938aada21263977abdf25ab38c444b
MD5 f554ca918782ec591e368eaf3df26aad
SHA1 3bb63f8946a0d0450f136222addf2903dbb23c83
SHA512 a68148116df0909415708d7f6144b345d6c2d851ae4bba19a7f6508c28440bfff9cc7af2f99d20b16b385001e3831f18d7fb6d41e3ab6543741dce3823ca877b
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5wcN/j2U4FH:LX2iyphLj2jF
TLSH
T1B595BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 7f9af9e68eb6d2514cea10a3e413f7af8dfe32a5cc4c505daa2fc2f4a3cf2a4d
MD5 b5c09db688225e5f1826517f7caabfc9
SHA1 97ce7ff3b883099f1469508bdab062c02ed16a9f
SHA512 2b68133cdf96c091b614a8c105b50a0eca5ad7e44a45105fd9aec00e3128fb5473d9307f6ca43fac67f7c12c60dc72ab19205633c4910a34421df38282a3c378
SSDEEP 12288:TYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:TYdCN/j2GLl3iFSE33b9
TLSH
T1E7752364E9F5B669F15BC37943A9DF515100FEE8F6264487868166EB237CFEC8033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 43997401a3ba741a75bd05e3957e10023498b210f804143073d5f4c940066f32
MD5 c66a855fa2a670248ebd3bb8c51809fc
SHA1 c2d8eac5cd74d020a1ac2888a30fc77077e8faba
SHA512 6bfc5fa015bcaf5d89fa8faff02344962b375bd28277fcf60ce11cbd70162cedac9ed93554d9d13cd1b6be18786a3f4db63c0b287546adb86acbc4b97a28a0fe
SSDEEP 12288:yRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:yldCN/j2GLl3iFSE33b9
TLSH
T124752364E9F5B669F11AC37943A9DF519100FEE8F6224487868156EB637CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 7e9d9c66a3d493d27182048409df6be19dec0058779fcb3d1b643716fbfa2835
MD5 769d3289384fc3fa504615302d0ae222
SHA1 296df8aaa3f07ef18c94bf21ed5e0c46f2113baa
SHA512 ab0bd055132570f801995dc77b6bd54f55722d3ba25ff705add1c02148c5f3e6966dcf71d120946ea1f589451fee288ae292abb6dea64eab2f2b27810465e4b8
SSDEEP 12288:zbJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:zDdCN/j2GLl3iFSE33b9
TLSH
T16C752364E9F6B669F15AC37943A9DF515100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 412b0fd117a7c80df2d397ea722905abd82ad07ec745049c73da7c3ad9c05f98
MD5 b05cc9a22c5fca4a01ede25e93543cb9
SHA1 35e2fc558e88f1c3263103b6672aabb77728968e
SHA512 3773b24a5b5f8129ff547e42904e3edc3061df3e9ab6de8cc528f0d1d9b3e4e685c43517d32c09d085401d6f3a6134bf198a9c79f03cb4f707a85008d42750cd
SSDEEP 12288:9VKJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OdCN/j2GLl3iFSE33b9
TLSH
T16B752360ABF561D5E46BC37C83B5DA21E220FDE8E73245CF87400AEB1B75BE89431562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 3efc41e06c742a62569845500ff76542b626f00fb55880849c93fa9c35340b2a
MD5 32f4a1f56d3ef81865d5de4695c8d88f
SHA1 84a30b2694279fe8ed12c1ffab725cad0fe9431d
SHA512 b7b7407f6d0ea91254e10f7a7a359e5848ffb3e09255275f36fcc80c4a082323a13dff4a93cc9da1024e7604512781d0453f6534a5fb822189d562df8641b9af
SSDEEP 12288:ciJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:c+dCN/j2GLl3iFSE33b9
TLSH
T1E3752364E9F6B669F15AC37943A9DF615100FEE8F6264487868156EB137CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 5b65f4d20ae1f02b72fed9689b432b296fb2f998831806ff181592876ca812ec
MD5 93809d8e61645dd024613d13daf767cf
SHA1 72aa661baeb1f5d6af9dffb8d560d8361008722e
SHA512 987dca0ffe5aba4dc6a6c2841169040522c78e73b49194ec83455689c432bb33afdb63665d1bb86406aafff8df4a66957dc009a087dbbed38a4da6aea1352026
SSDEEP 12288:oNJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:oZdCN/j2GLl3iFSE33b9
TLSH
T185752364E9F5B669F15BC37943A9DF515100FEE8F6224487868156EB637CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 4f93f29dabe86ec6099adc21a09b5b81c19c25b8570593b61f47309b787de0ba
MD5 32f754c0eb3d845cab3ad5fa76cdd6c5
SHA1 0579ae9ac9d256ec123df57e312243bb203c10d7
SHA512 2c82d99d8d486923e9d6e0616c862058dabfa20a9735279f2c93c097195bf26e4b8d6c8d91403bd01be0fc76948d3e800544e2f482540dd76f61f77222e2a66d
SSDEEP 12288:QJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:QNdCN/j2GLl3iFSE33b9
TLSH
T18C752364E9E5B669F15BC37943A8DF615100FEECF6264487868156EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 296c2d7acc511f3bcf84f868ae38b65b3dbbff441a7de05ff005f3fa7f81113e
MD5 0cae7f56ea34809977f0ad4a3129f936
SHA1 3e0959b0ec0c81c3ef210eb47cb6513cccd707c4
SHA512 4fb40abad4db6eb5bd9f26e64b30d5b62f3f3136effae8fea3b869f6540348586adfeac24585ada92cdc4bad248c228fb85fb842c5c3de9da709ee32117fa925
SSDEEP 12288:XiZwb6zzFEoS2cPvyxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SZMSzFVSOFdCN/j2GLl3iFSE33b9
TLSH
T1B08502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 09f540cb4ef0ec9eee76774aa342019953151d3a065233858134c737a281315b
MD5 1e29025a39d856dfd3c7cee8ec4ae6fe
SHA1 1c5009b3dda4828df65d5139d6ab0e97479cb961
SHA512 0bba157a2886ffc01539b687a434bcae62b3c6142670fbb93a51b4dcf11c33d19674cee69014c03811af0c140e7e6e4ad635102b7273a48c74f0dee2d4772d32
SSDEEP 12288:EcJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:EUdCN/j2GLl3iFSE33b9
TLSH
T1CB752364E9F5B669F15AC37D43A9DF615100FEE8F6224487868556EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 152c24c1cabfe0f0a2d59c263ebe8d8d3693bee0026bf8d820548fcba2402026
MD5 13f117967be99091651eb6c58e46f5c6
SHA1 89d80f6e1830682ea348e4813dec783c78e4a019
SHA512 d9b50fe0e97100a6174cec45900ff98e5f45a25e206fb892813296cd84b04c3201f0adb569c74f989b6ee1aca77069bc35687ab1ef9eb19f6cfaf498b6df70bf
SSDEEP 12288:tAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:twdCN/j2GLl3iFSE33b9
TLSH
T16B752364E9E5B669F11BC37943A9DF615100FEE8F6224487868556EB637CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 07cb3ffba5865c86f448c601c6b7b6176dff299546398e5611b8825a7d18e286
MD5 efffad22b0b077c29dba5629eac7ddab
SHA1 1fb532a4e20767727fe9cc55c1b7b6a086261d2a
SHA512 10f455449ad0f760d9d918c1329a4e2d75a0fbc347398b0aca56f710c81c24fffc6b61b647a806200d66eeda567a392e8391cb46998342b107d06a754b561110
SSDEEP 12288:eyPz5L81JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DzyRdCN/j2GLl3iFSE33b9
TLSH
T141850217B7A130F9D167823889A55A11F331B87597208A9F43A007BB2F377E49D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 f08ccd6107b910c649649dde1747f10b0d1e4b41209d8ee3f57c1ecc1bb1ed64
MD5 69d4dc1676fde79f9c240e7658e05b84
SHA1 3452fe8b35deb057472cc42b6929f98fe8129974
SHA512 3320d31c14f8c132c3da6589d30cc1efbe620c395cd513e41f2344b0e845be04fd16b335ac18360749c63efb7567d4a8127574cd342506dbe78900087bda3c4d
SSDEEP 12288:QcJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:QUdCN/j2GLl3iFSE33b9
TLSH
T1E1752364E9E5B669F15AC37D43A9DF615100FEE8F6224487868156EB637CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 79be36bfdb6ab91a735ef62754e5ad873fcb671e196a05d6b727ec34eec80d2e
MD5 2b8a660738ba8e9b498bce554f662117
SHA1 a51f2b84eafd5b2f01fc3c9291c13e9dec7be04c
SHA512 9e2a18262711d60db0a7e2290d475a4c88dfd2d2f21a3877950c2d859294cdef35a6b0b16cade7127047fa90d244b0604c7fab94f3a77a3bab42055c119e2ebc
SSDEEP 12288:IcJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:IUdCN/j2GLl3iFSE33b9
TLSH
T140752364E9E5B669F15AC37D43A9DF615100FEE8F6224487868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 b863ef1f9c7eb6a69603ace01439756bbad3ae55685cfc0bd8aee86d43cb4475
MD5 752436b5870d2a36b2a1960fa998ecc2
SHA1 62e2167acc5108940cc93eee87e074971b9c6e13
SHA512 d3a154f3db28525cf12219e9c0268bd4e652334654e60e0019a01e304f7b04c822cca772d3f01e8c23c7944d763550dc1ba39a35a3334697708ccd2f048f089b
SSDEEP 12288:1yPz5L81JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:czyRdCN/j2GLl3iFSE33b9
TLSH
T1B7850217B7A130F9D167823889A55A11F331B87597208A9F43A007BB2F377E49D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 a0596089ffa0159a43e14c1b1fcc37079f425aea122ae3d2606240ef660ab0b7
MD5 ade2163db47498943565fd67e35379d9
SHA1 6d3c7dbc19e0094120b1a5b50ecac173c0d4db5d
SHA512 ea396e0511ea033b7e2b79a47820ad35c1da42db80beab20434093fc2babda92065e01c7526b5ef23730abdc1196c1c795af8d9a80a69d6e91a3b584b799d249
SSDEEP 12288:KCd9eWYoaLHF3z0z04PDvhLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7THaLl3z0zDTdCN/j2GLl3iFSE33b9
TLSH
T1108502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 5aa73a2dd0559ff6cc25eab1d33b2b3e9f1610e0aeedc8ab419c52ee50d722c1
MD5 33f5272e0dad3fe62b741cc86d9b8620
SHA1 c8e73350721cc99c8eed283be3f22650a65643be
SHA512 f03f4e18d29b4deb97a9691c73ef954884e2cc50fa302f8fab493807a129425166539b183873bffadcfb45441355e36879f045ec677e27acac8102c3cdff3e42
SSDEEP 12288:Fi4e7+RdTfgwCHKy7GLbbdIveJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:F37d9CHKy7GZndCN/j2GLl3iFSE33b9
TLSH
T1BF95CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 1e6f43b18ec96ea6879ccf99b0fc510f30acfbd7a39f7244ecf21f8f63792ae3
MD5 679aa0e8c8ca639d9a466efa6115d7ab
SHA1 d78824ed0c3481bfd7a566c1dfc79096273e1561
SHA512 edd3ca0d3c8df4e48e3ad84a9cceed985c18b674c219c517513c8b568450e4fffaf2e824f8d1b0171d799d5daa4315b8dc0fda5e619ccc754dce160209d39475
SSDEEP 12288:F7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FjdCN/j2GLl3iFSE33b9
TLSH
T1D8752364E9F6B669F15AC37943A9DF515100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 f1901fba1b049c91094acbb8ceb75463377e1c315cba3b3deaac946bc10b26ec
MD5 8b40e72b3d01ff6476194084e51d1691
SHA1 4166a215daf90b88d40fc8aae1adf2591c3d8055
SHA512 0f51a7e3f42ce82bab2f2e1e55d828b8b7f0b7b3f354633bc84a219c6d906ed2b018788a57317b9503ebf04e35a4c3a0e70832d4ded30e8cf1e1194b7a0f46ae
SSDEEP 12288:CVJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CxdCN/j2GLl3iFSE33b9
TLSH
T1D5752364E9F5B669F15FC3B943A9DF615200FEE8F6264487868156EB137CFE88032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 4966ba4bdc654c132882ed8ad14ded8185a7c62ea99ff987b32cb84062219050
MD5 d32cb2b00a062d14b03249aee3521c0c
SHA1 cd2cce89c6adf8342857a97e0e91332ecf71c9e5
SHA512 4252eddebcf76d17e3a1e3f9981015b9277c64fdf43110d2e85a73411496f89abc0242cae273aaf58e894ea44712edc4a5846be78077eb4d3a9380d0ddc96668
SSDEEP 12288:jeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jSdCN/j2GLl3iFSE33b9
TLSH
T115752364E9F5B669F15AC37D43A9DF615100FEE8F6224487868156EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 4bc2e002b9f6a5c50d6ccbf6234490407a07886b4a077fa567d3accb2975c04a
MD5 3007a4e52ab0699a37d6a8eb869fe958
SHA1 877518015fa3c012e8458603dd716c8452f1c148
SHA512 6e9cf03fe6ba851dc14dee064f2a9fdf6a7a22788a89179f89f2e372b0265e1c70859d77fbd070747202846169f0e8b0c2c4330b043f5bb146dc02585d578572
SSDEEP 12288:FcJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FUdCN/j2GLl3iFSE33b9
TLSH
T15E752364E9E5B669F15AC37D43A9DF615100FEE8F6224487868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 680150b61c7622abfecdbc251ef4cf917472c74b76ce6dd441c8909f3c69c1b7
MD5 2ca94f5ca1e8930d389fca737a996bad
SHA1 6de2a45439b118da8285a795c5335776a07e5cdc
SHA512 40e9e15dd84163302b0f6e37d4f40f6f82bc6a420dbabd6f0fe48db813a209e03f2b36e5c01cf88c293a95c686902954ffbfb275722cabaa92de312d0fe45a19
SSDEEP 12288:F7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FjdCN/j2GLl3iFSE33b9
TLSH
T16F752364E9F5B669F15AC37943A9DF615100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 c3aa0e6e0fdb6ab53baf85a11bb0fa74ad43d66ada60a753fb22835ea55f904f
MD5 bb060b05bad6d5b927c04eab6b8aeea1
SHA1 d88ee20ed7d1cbe1bed54903e70916e79b97c05d
SHA512 d3361baa704b8d5c6c8411cedba081a31148db7d19b3c3799141df9e28f595b589c139a0c6c9985fb42f67362cc28dc0ef9bd5ecd6cdb7c78dac8dba8772f790
SSDEEP 24576:Mfwvok9RX6wkyAIgdCN/j2GLl3iFSE33b9:sMnYIrN/j2U4FH
TLSH
T15EA5D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ac62beea91e1f70f82e3347d935594c9006f59d4f8f885fe90a70b73f5e414e8
MD5 ef15702fd951b588376fe8e572046291
SHA1 fa749ce0b6fe849d156e67ede19d733d6746e5e1
SHA512 218cbb3dc38b6d6d5286e620d9367edc13409acdcb3ae2c22dcb03bff2ea3033d307a3fe6dc85aabb278efa123e1c46de7d5f30b69afb72865e1b6649d445677
SSDEEP 49152:5YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK08N/j2U4FH:hySzP4j2jF
TLSH
T153067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 40bbede82323ccda25440954fab82f1eeddc43aff7392e8acf96023aa0d266e6
MD5 a25cb9216f72f2020efa0ead63f5d6ec
SHA1 b0f4c093b5c7573d3bcdbb90a55fcc82eb47cf28
SHA512 b4960b2dbbd8ae68720ade29c3356f8e798c026c99f0ab0c55b7d7be9802137c01a5c8c14ef3384907c8356c4661c31e1a72bafb41de73f085f4ab373c078efc
SSDEEP 24576:447Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY1dCN/j2GLl3iFSE33b9:447JUQj1irIhCnDHUPfF/sN/j2U4FH
TLSH
T10965AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 34fa064988612bf6c17652987f0480dc0ff51ef6e616d97df9a74936cb66ddef
MD5 9dd5948cc4774378b1903099b6cf117b
SHA1 68307cee15291e26100c7ee8a8920037fd956904
SHA512 602597407c0dcabb7bcfbb1124781e20f7f7ee56c569f10c376f5b58d352247e570ed1937becb450e9583cf439cc79e91ed0a7072e58250f10bd2194b0d76215
SSDEEP 12288:SNsfMJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:rkdCN/j2GLl3iFSE33b9
TLSH
T1BE850119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 45a917e51071651bd83ede273256d18cf321d5085d69031e725f192eaafe5236
MD5 2e362c2f2ceacc7e820dadd36c03973f
SHA1 47f43fa748e4cab8dbeb248269068aeb40863e93
SHA512 eedbbb78cdd8395c86727d15883fcba09c30da2d4ce4fcc643f2372fb7c5024df698ae2822c89616791c0095ce9ef94abe9bbb0d6151629cd85ed90d1e328095
SSDEEP 12288:n0pVU3fDJXF1+E0XpyLaUDIf6i0TQllTt+TSXCSnr:n0DUP310p6rToTtWSXL
TLSH
T1633529117666CB4FC6A940325E33C2CCAB707D05EE45AB0772C98B3FC576658BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 3c40280abdce3e482c024d1f7e09d92d8130baa8c7a47ef1c0d64d017f571c3d
MD5 17c9ffa1e2b5573c60942bf80bcb44d2
SHA1 d5bdb7b3c48671a357ed1818367c242ea6f21df9
SHA512 3b434f6a4d50320aea50cdfe3fd0aa1a523af650a3da7f7bcbbf032fc29f0d5803264741a2dd9f5f2e6a05ca5c7250eaf2a40f8b58b979f007fb2a28485d6d75
SSDEEP 12288:qHvz8WEMZO5AL0L/BJI7yePv2p8nzPl7GLkoBdNH1q7W5zHXUBFAc17484Xwahnx:qHL8WEDJI7ye2p/8IhnzMyW9nM
TLSH
T1A465E7406537E78FD1F76032072A9B4C6B64EC07B7096F26B389453AD86AB11B1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 e827b22640eff9e35bdce89879b70be87b0ee1d168255c5b143066df8bcc9c5f
MD5 ff9be42ed7f5bee7c100bb7470bc7991
SHA1 dfc39a4563910c25b757b590d1cf0041e4d981f0
SHA512 eec0797141fe2c8c4a76fc2a247331d038df9907d440f2d9c5c9e2f19af3e878d8387ff4cf4c1da9d417222656d7b399b235b88120ea8cf15e6361169f7a862f
SSDEEP 12288:AM7EJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHA:hsdCN/j2GLl3iFSE33b9p
TLSH
T1AD752360D7E9AA55F47A837803ADDA316200FEF8EB1184C7C54167EB6278FD8D832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8952d4fe67e65414e504eda64ffa0f91a76107b88fda2ae9087656388739cb24
MD5 2fc615a9d410c493efe3eb7bd6a426f9
SHA1 f1bd2dbad46952b7d2ae85a7f1c8aa2a0521abda
SHA512 1b8773b4beaf0265857485315ef00581efdfcbc18c2aa4e7bbed321038831acfd8cc5f7a131bb93039594f668671a87d5f52c67bc034180e7cc7aeb706443ab8
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYKdCN/j2GLl3iFSE33b9:4gb4mBIBhGFqN/j2U4FH
TLSH
T14D65AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 5645c2353f60ec997daeb7b4ad073cc80a0551476c08126c603510f8204c3e4f
MD5 d65949259057006292eda86cafc95997
SHA1 b5d4900a83564a4d1727acc66dbef165168a9c74
SHA512 2f6ab31a97834ca902d761c2895413f1012ca413cc2ded24c52198c7f5830502c8855d20ab5152c061b38aaf0e43a6f6beffc3524d6db57ba29bcbdbcc92b22e
SSDEEP 24576:uGsaKngL2jdshRTdG1YxITqvfPkbIcbjLm:uGsarSj8RoTCCW
TLSH
T1BC05237EA7C556D4C43AA77829B6A84A3CF33758870A46DF88E0957C4F6A7E0763CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 5f412066963dcd12570a7ed6d72df2d1a911b2c6e23761f231f6284654e9b5d0
MD5 6fa13cc6621f9965e2c48f75d501df14
SHA1 809a5a435f8c5f40e927dabcefef6df98cc8aa1f
SHA512 1da800d5e822efd798d210d1d792cdb308cc928a392f52b109bcae8de3a3f65aa86c473bb95f38b16a6ccb2c054b73417d7f133a2f21246dc2e46c079233a406
SSDEEP 24576:pG88u8FpJqH1bzria7/mFdCN/j2GLl3iFSE33b9:87ZFPqVea7/1N/j2U4FH
TLSH
T1F4A5F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 9a0eb17bd4c7e54e36eaa39ee2c8ed0062479093aa96d6239bb6b882de392733
MD5 4cca696bf94810d5ede705e8a3d66eae
SHA1 461c56b304ec8e3694f383b89d58acef93b86160
SHA512 0ae3f4d449f9f38e72d12eb0698948e130911a98fb7332fdd44a0b74631ccfcd263c1021eaa3525fa689293e743fb8b74999b5b32dd4b5d47d36448b8e03ef3b
SSDEEP 12288:hHvUrBFrEjwaQuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hPUr+NQCdCN/j2GLl3iFSE33b9
TLSH
T11E85F22E62E918E5E67AD17D86868719F731B8615312D2CF02D0817E4F77EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 47266297c56e550cb7089d5ab59d4f7bfbf3d9f1e9b2f3af8597302e07494895
MD5 82d1f20327a4bab74d25e19528b1990d
SHA1 58f3a2c224a0c67d7d3fb5f29b82861f8e038d30
SHA512 7bbe8bcffe3afb14fd5838053953ed50ff1235201121c1372c69c1d2734ed8839a868779d687f6d15a77bf9e20e77b81b22e9069d95847132ae19228b674165f
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuN/j2U4FH:UG05lO43b9j2jF
TLSH
T178D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2fd3052d59e12a19cffb922ed515114f5eb53707b78da9a2abdaff893fe212b0
MD5 c543fe6a48659196892b8f4459472807
SHA1 a6a3a1751999a91d4e0fdb7f916cacad97443285
SHA512 39d00941fb8e1d522f220b4928006531d088ab1e65378b97a77eb3d739d275374ad459dc2928b225de09e17e92bcb3a693988f9ae2e01c8f18bc9a44c3a05754
SSDEEP 24576:Afa5POZ3dpFWVM50JicR2hG0lasx2+47eidnvdCN/j2GLl3iFSE33b9:4a5POZ3+Jt2pasx2+mGN/j2U4FH
TLSH
T1FE65BF5DA6FC01D5D1B9D17DC5838A1AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f231a9f33ae86bcf4cb46db9419340cf76d28b1e80126bbb6908fdc4de6f7e64
MD5 30785e8dbd2ba523b16fc40c101a9b52
SHA1 cc9cab83b6745e2145e0c57d8adc324da55e8fe0
SHA512 2b3c6ba837f86d427060fd35dedfbd07a72d8ed4160dd262f8f188fb5389a2a1245198a1f80f9ba75157143a93057a848422bf693c8c47fa99f033ff17444f5b
SSDEEP 24576:ANcwHdjbyQ4nLC18lb/EOjowL7FkddCN/j2GLl3iFSE33b9:ANc/zEOVHFVN/j2U4FH
TLSH
T1E3857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 301ccb22c7f7d94994bc787e3fbf93d0726d731fddd209d0f5aa06ad089c6ed4
MD5 fefd1ee096ee3ee9a168a352921e1f16
SHA1 a0f20e16048f4f985353cdc061cbdb16ef83fb83
SHA512 4a94d003f6724d912537126227604e93dd4d00fa5b20d540b1b0a4f1d0c98b33721b9cead52082d2740f9212166e0b3e415b62f0f27edb423f3097ce2f6c5d88
SSDEEP 24576:j6DIzaKngL2jdshRTdG1YxITqvfPkbIcbjLm:j6DIzarSj8RoTCCW
TLSH
T1B525126D63AA01F4D06BE13D96934506E5B2B5B483074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 937417cfd91335f39b72a9a13b41cac22012db52c97d64337759241d9710950d
MD5 7c1eb2d2b1b36c24af6d597fecee7c21
SHA1 701c7fd57d761392143d9c1417117ef1f426c313
SHA512 5e085283646b27565c5a9b92bb6df2da80c5b240a579e44c99004b4eb83b74099337e8c3803ba3008b65d465f43683f358f946e44b469f25b745232728b79c1e
SSDEEP 24576:dTkNvNnaFeYhJNtmZBm+aKngL2jdshRTdG1YxITqvfPkbIcbjLm:dTMwBtOm+arSj8RoTCCW
TLSH
T1A875BF6EBAE846E4D1FEC6B49D238516FA727461073293CF4290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 b0137a0bc98a17a4614f6ec921cf601ce5042691cf88efa374e6d77a1fabc37d
MD5 366147aa88f7b1762bf8e1b26efc3ac4
SHA1 b9c5df7aa97052e4676f3a64b66e445cb424a50b
SHA512 072dd7b293c21e7efe71a26a8a35070119ea9af2a09aaef25a3aa81a389e5aec52bf6b4ba71df92b29a69e5f6ccad69d85c0616659a9a702e96f9815b2ac2b3a
SSDEEP 24576:sD3FHshBIYQgA4dCN/j2GLl3iFSE33b9:sDVHeBIAAjN/j2U4FH
TLSH
T19A95E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA1F6BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-98-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/240-296-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/240-92-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/240-85-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/956-56-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/956-44-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/956-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/956-59-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/956-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1480-119-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1480-118-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1480-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1480-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1480-125-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1480-328-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1876-149-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1876-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1876-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1876-143-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1876-151-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2144-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2144-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2144-332-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2144-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2308-182-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/2308-62-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2308-70-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2308-61-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/3168-351-0x00000000007E0000-0x00000000009B2000-memory.dmp

Download

memory/3168-443-0x00000000007E0000-0x00000000009B2000-memory.dmp

Download

memory/3168-327-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/3168-132-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/3168-138-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/3168-131-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/3168-331-0x00000000007E0000-0x00000000009B2000-memory.dmp

Download

memory/4148-29-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4148-35-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4148-36-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4148-28-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4148-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4240-324-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/4240-93-0x0000000000B10000-0x0000000000B77000-memory.dmp

Download

memory/4240-102-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/4240-101-0x0000000000B10000-0x0000000000B77000-memory.dmp

Download

memory/4912-1-0x0000000001000000-0x000000000115E000-memory.dmp

Download

memory/4912-81-0x0000000000400000-0x0000000000CC6000-memory.dmp

Download

memory/4912-7-0x00000000012E0000-0x0000000001365000-memory.dmp

Download

memory/4912-0-0x0000000000400000-0x0000000000CC6000-memory.dmp

Download

memory/4912-2-0x00000000012E0000-0x0000000001365000-memory.dmp

Download

memory/4912-55-0x0000000000400000-0x0000000000CC6000-memory.dmp

Download

memory/4912-8-0x00000000012E0000-0x0000000001365000-memory.dmp

Download

memory/4912-14-0x0000000003880000-0x00000000038E7000-memory.dmp

Download

memory/4912-21-0x0000000003880000-0x00000000038E7000-memory.dmp

Download

memory/5184-369-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5184-375-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5184-368-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5184-426-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5252-106-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5252-348-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5252-350-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5252-112-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5252-105-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5252-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5888-343-0x00000228C1E60000-0x00000228C20EB000-memory.dmp

Download