81f2d3531e81442ffa5ea7f082e46df76c165305ef3fbb877091ea1c25be617f

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
Size 2.3MB
Sample261011-e4bgnaxz7m
SHA256 81f2d3531e81442ffa5ea7f082e46df76c165305ef3fbb877091ea1c25be617f
MD5 b7a667400bba0c8eee0e2e26ccdefd82
SHA1 25056579bb1772c0f8e93060f1c632392c8a9af6
SHA512 e1312d2065c7d57957c4a0249714d547a3834333db3f8ceb0c7666819c12dc0d2f55373e19d328f9a8be14f0b08c9b69e34ada02728751cf6652824c0e18dda6
SSDEEP 24576:f3dCN/j2GLl3iFSE33b9xLaKngL2jdshRTdG1YxITqvfPkbIcbjL:fkN/j2U4FHdarSj8RoTCC
TLSH
T157B52375FAC0D630D01B57781AADDE942D12BFF8E11B884ADAD11BFF5A797E0923A000
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
3264	elevation_service.exe
5456	elevation_service.exe
5012	OSE.EXE
2572	PerceptionSimulationService.exe
124	perfhost.exe
5660	ReFsDedupSvc.exe
6096	SensorDataService.exe
6128	ssh-agent.exe
4280	AgentService.exe
4156	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a2675a17e4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2716-0-0x0000000000400000-0x0000000000CC6000-memory.dmp	upx
behavioral2/memory/2716-67-0x0000000000400000-0x0000000000CC6000-memory.dmp	upx
behavioral2/files/0x0001000000009952-73.dat	upx
behavioral2/files/0x000100000001b98a-76.dat	upx
behavioral2/files/0x00010000000093b6-72.dat	upx
behavioral2/files/0x0001000000009329-71.dat	upx
behavioral2/memory/2716-91-0x0000000000400000-0x0000000000CC6000-memory.dmp	upx
behavioral2/files/0x000100000001b98a-348.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5128	2716	WerFault.exe	89

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ffaa3203959dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000413bfe623959dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b29e1e633959dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000e785633959dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d17192203959dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
3264	elevation_service.exe
5456	elevation_service.exe
5456	elevation_service.exe
5456	elevation_service.exe
5456	elevation_service.exe
5456	elevation_service.exe
5456	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2716	2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	3264	elevation_service.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4280	AgentService.exe
Token: 33	4156	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4156	SearchIndexer.exe
Token: SeDebugPrivilege	3264	elevation_service.exe
Token: SeDebugPrivilege	5456	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 4768	4156	SearchIndexer.exe	104
PID 4156 wrote to memory of 5628	4156	SearchIndexer.exe	105
PID 4156 wrote to memory of 4688	4156	SearchIndexer.exe	106
PID 4156 wrote to memory of 4860	4156	SearchIndexer.exe	107
PID 4156 wrote to memory of 3484	4156	SearchIndexer.exe	111
PID 4156 wrote to memory of 2700	4156	SearchIndexer.exe	112
PID 4156 wrote to memory of 4924	4156	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_b7a667400bba0c8eee0e2e26ccdefd82_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 728
  2⤵
  - Program crash
  PID:5128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2716 -ip 2716
1⤵
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5456

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5012

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2572

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:124

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5660

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6096

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6128

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 3056 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3008 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3008 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2700
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 3056 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c850ca460c1162ad44b0aecab3f1e03cdd3944449d9c91124b6f24845d8f9d31
MD5 edf6e4b176cc276315a3117de76a351d
SHA1 7f61b1b140bb21b39b20a46a94472f75f84a3870
SHA512 16c6130e24a792b53584349844621f3bee5be4e400881cda2e0c22c123289da2ff6950795e19f70c4122c7b6b3067ae167b330615c9f02c939262e153cd6740d
SSDEEP 49152:Ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnS0N/j2U4FH:O3q6HjBMj2jF
TLSH
T14FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ad655a572e77176db3f368cd271b00eeff573572f06dc7422f53cce8ea3b8407
MD5 ea93e8be95d7e43a417a69ffae6947bc
SHA1 32361f6da0ff0f420e983a49c91aefdf1d7cee5e
SHA512 ed8e0ec23af576eec6829c87f000b0cba1fb87e2dd4b9af2bc5be008391c15673a40915733c42ed3f3e7d312c5cd448bb8b455102bb8bbb534b6f1623074b133
SSDEEP 24576:+XYVDtczA8aKngL2jdshRTdG1YxITqvfPkbIcbjLVdCN/j2GLl3iFSE33b9:rtcdarSj8RoTCCaN/j2U4FH
TLSH
T156751228A7D009F8EC6B827CC9A2C905EA3378948755D78F03E099A91F377D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1017KB
SHA256 bb2a8ee47df2151408c5294311e5ffdb57be35541c6312759ecdb142e745bc21
MD5 c7b44aa734aadbd0619c53b13e2c5917
SHA1 ba0b536a07e4d729cf21fdd33fa4c6cc9a0660fa
SHA512 46942b0a0ab390a1249fb59829c2f3801765b81cc3f0be047c8dee8b94a89063c7c79e24309ff8375e837685a928af75c617871eedb577c1a746573de6b68046
SSDEEP 24576:qXYVDtczA8aKngL2jdshRTdG1YxITqvfPkbIcbjLm:3tcdarSj8RoTCCW
TLSH
T1C6250229A7D009F8EC6B927CCDA2C905EA7378554764E78F03E499691F233D85E3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 b91fd40a4748b881e2a175156ab0417000764c7cf3cc0112005ac7c021505f52
MD5 2dc2f45733189f9cfb6efe4e55c27066
SHA1 950a1e43367680d465fc1767322735f6e9ef791b
SHA512 c480fda30b8c1a68060fd4eeb952d2564d4c1cabfe0d072c4689061bb0cfc926c93bf7db9235561ec8a397d13e8aa72924330d6d1019370c2ab22074afb97b29
SSDEEP 24576:h0Le5ji0hmxirMKdCN/j2GLl3iFSE33b9:hPji0AcwN/j2U4FH
TLSH
T190A5AE26F6748335D073C0B9C5D2A69AE97130865B308ACB4286D77C3F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 10848b859ede325383ac38caf5bc2df1c8f499d66c6e53f96a1f18ef55972a21
MD5 f408f38e07f5bb3eb3844af59d522144
SHA1 fc7dd5c2aa93fff926fc70b32ebdaa16b8b127c7
SHA512 19b273463973c609ee098ada91b63f0d614ebc6c7df1f0ea2edf6ae00eb52b99aa48ebc395c8a5881760265160796ce4318100c260c4d1bc3130dc8db7c7621f
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyuEdCN/j2GLl3iFSE33b9:D/ezSC6vUzPvxHjykN/j2U4FH
TLSH
T141755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 83c732b8379022f80c1b3949013972c583be563f91b1d58832e96c3e7e0b0197
MD5 f83a0cccd8184e1e5471dfd66e6be269
SHA1 2fffa26b992ebf19a4f57920c55666e46eb282de
SHA512 7fe20afd2986dc4fc491dcf3deaf603a97e5dca17d50d82d9dab3c1c5ba94057e148f13b7b3cadc7c72498c4a1c26a40b1d3f769ad5a451bf4c20e85383628dc
SSDEEP 24576:IVbqPb88hv/l+6xdCN/j2GLl3iFSE33b9:IVO88hXl+RN/j2U4FH
TLSH
T15D559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 bd2141b99e4cd3e6a8bba5571bba47432fa868dacbfd8de4fdd3f65fbae0cc3b
MD5 43c778780d7e5140f6f4ce1a2a800662
SHA1 eaa2e61786c5e7944d8b34a0348d342f85d1a684
SHA512 dfdde338d871066ed42cd40d73b25754c4da643513d6935edb4575b011dfd24d5c051c1bdc09932f4afa64d8a62c31444088530aece3ebd4c966bb2c604cd94c
SSDEEP 12288:6R6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHq:6RGdCN/j2GLl3iFSE33b9b
TLSH
T18D752364DAA4B565F66F837903ADDE615200FEE8E525884386917BEF117CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 da805df159d20f153b93a5cc4c88c5687573515013cf810cdf1a98fcebd38a60
MD5 275e918de0f356f09de5f081041216f1
SHA1 19b85a0cb7ae7cbcfd27c7ea8838e84daac3ebdb
SHA512 7434c4f0205e242773912e05626bd06256c353e39c21aaabdf9f18c3b5ac9a4e0a4ece1efe312aeac569a486f72624939ac9c453428d304c6aedbbf97ae5b407
SSDEEP 12288:PeBNUbTVO86UtJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PJIU5dCN/j2GLl3iFSE33b9
TLSH
T16685CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bc6ec06e0b5ee11bcf6e9f661f919736d7c3bedf7d6a0ffca4fc5f605386feb7
MD5 34172bebe0e0fec63cf07a9b4713c8e9
SHA1 5031e16d910f1573bfe4724712e73d0f03375ab7
SHA512 4debc03b8a4fff685cc0b25c352cd452d51a2d1cfc6ba21be23bdc5302cb872941c13b743e69283c0c46a09a238ffaa54e2d63c8824d30e4fc55594fb3a37638
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THv:dQvGAdlCEL8c/yRNw5Chj2jF
TLSH
T1CB267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 6ea58b5830389a7602cf9e81c480a5c9bbd6cf32ccee7939b33a19956e53c52c
MD5 582230db364f11096bcb039b75f73ed8
SHA1 79060c522a660acbfa84cc0fe3254e4f1f84d1f4
SHA512 a940522e10a3b04f404744743a1639301b11424f3fa4b2ee1450d795b6f250a495afb3d0dbc5cca6042b393a46fe9088462c9e3dd61b9e3ff8453fd3a6da777e
SSDEEP 12288:5AwSfxL/2Dc34DLLmt0LDQewsAj7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9/:qdewsAjjdCN/j2GLl3iFSE33b9/
TLSH
T16195E031FE74E436C2BF0DB61B36C716142CBA608B6119C3E3E84E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fb49ddddc78961fe8a9e4eb70cdfd9a7f60d009570a2eb83fbce79fc4e1f7787
MD5 e0a6f7bcd1424a9b83115b0a6307f94d
SHA1 936ff90967f24ea8dae44972cf4ff329b51758ea
SHA512 da04b7e9cff82c2cef89b448fef21ff1709d2e5d9295d98dd30ecb6484d697fca04513ef2fa580162b30c644b4ad16c517389cef6bc0582e6d72a621a1249b44
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHE8F:0UEtQevvqc2W1cpV2EI32E
TLSH
T17C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9a00ee0cc37b7bbeea822b7db18c309e6665bf5fa703a6ac7b5339354f96e22b
MD5 35dffd7a6ee9d82fc39e1d2eb507171a
SHA1 b1b06f52c0fa27b03a979bba635035fc014fe0d5
SHA512 875eb9c89649c409aaf16b7bcbacefa3099311f77039707d327d5db95152708cd4954b725a6b5302d52ea9bb60a27c1cf4335ce51f7f3da4a5657afab3915683
SSDEEP 49152:iCbRquA/m2yL5zQfFiV+XenmE3/zAN/j2U4FH:noqtVjnmtj2jF
TLSH
T101D58D1976B8C2E4D1F6C37886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3aad1d2287987c197a18538a3a1acdeb2fdeacb7abf21779f9b7f1e9dea436fa
MD5 8acffd43aef77aa8109871a1303121dc
SHA1 2cb3947dfd74794a33999063931b0efd2d79e7d2
SHA512 5a2d8d295b8c7d1ec6468bc9350835d41f5ac1f0f7f2840eb6333de3bd256b0aa93f0199f740201e70cd8444b76ea7022a9b50f660efb4d5e50e2fe25315df4b
SSDEEP 24576:9AhGLJIFoiwtA5l7S53YdCN/j2GLl3iFSE33b9:9AMyFoiq5TN/j2U4FH
TLSH
T10835AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 bcf9bb23fa8ac459081d8180db7c68126bd37578ae06263a7441c8f98fde9b62
MD5 7c617646b83904215adb69a56d520f64
SHA1 246749d69ea5ed5e8cd1a987e81e9477caa2051d
SHA512 8c8bf7779d0ed90b21ba6c9a52c9b3aba698094e1ef2de342507efd84fb85075101eb058faea91d73ca982d066c94bad15935439fc7f703e324d343c2498642d
SSDEEP 12288:Pmw5HEjsChNVBFgl0WDm+C0HJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:uwuoOWJHdCN/j2GLl3iFSE33b9
TLSH
T10385F14577E41CF9E96782398697C536F7B2BC512A21CB0F03A0C69B5F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 fd29f1958c6a92a74e67252cf75ba8e0e373a3d694bf06bc403e5c0e573b522c
MD5 231b461cd94b292e09c8035e0fb39ee1
SHA1 313fcb9924fb650cacb7712a84c0ba671b648ec0
SHA512 6a6171667582fd92a1a59aff9fed81e8dce5b222739d4ce6a482cef248ad41c4478b369e6200dabfab0df040eaa89e6b90fa028382463c8d1d0d6611b0a1fa5a
SSDEEP 12288:iBZ1IyLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:MZuSdCN/j2GLl3iFSE33b9
TLSH
T1A275125933E471F9E1A7823C8AE59A05D321B8A5A73243CF026147EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 22688e1a7b5bbffb44267a9cdd89c5f0c1972425200558434d2d81a058f9b718
MD5 f40156cb00438731ff6429530902603e
SHA1 b2dc57bdaee0761ae5f83b794cd5d5201fbc3f97
SHA512 b10556727b5d9e635382a02c2a212d2024f5b980b4e7c34e7d25f936a86777232e8e6442e273aeaf601865deea61d043cdae7317f35e91aca0fca52fbff9fbc5
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uz:tQRQyi36YOcPQLvw2gAf+PN3ij2jF
TLSH
T11E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c7c3c8b83d38e2608d3e54054007dcc83f5504e15d6ea32e6f2542b8ad6151b2
MD5 48df23841be9ebc1858435e8de8a446c
SHA1 b7f880cdd9cea4df482698806873b4366c5a3ca9
SHA512 588f42ab391b78a19ae7a0e5f0a2d151296d1df2e0873a1562c358ea03564abd3dfb48779fee267c2369d759a6a6e75d7393dfe5b1a8db14e6525b3d8646218f
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uz:vQRQyi36YOcPQLvw2gAf+PN3ij2jF
TLSH
T1A0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2f980c936f602fb9e498d958d15c60db1442c8b250a0ecdf898534f4cd64a67c
MD5 c753bfb3ab2e2239d3df8953e8336206
SHA1 d6a861d4274110809211358ef793143b123a7b15
SHA512 ede984038e85f5beb4e9c56a3e92612ec4df9dd0f4a2f8057546dc51a0a6b5e3ba8b389684662fc7145b58861e4d3b5508ebb7524396a016a8bdac31720ce5aa
SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0idCN/j2GLl3iFS+:j68Qg55nhheWu7PNU3/wN/j2U4FH
TLSH
T197B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 48094781bed4333b5f0284af5c18d3f101060703f150bbd8d71f040556cb8d78
MD5 2b0dce4fd91cfde142d76ebaf3ed1505
SHA1 6b409afa6abca6982fd1b9eb6fd6933e205877e3
SHA512 e5783b6ce0eb667b7008bab71234cbcbe8ed8a0c56df9cfb2fdc6841047779bfac9290bad40462d84f43591639be02528e2cd0c57b784524c06ecb93baa1a9db
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99x:vy5112gYy5azzVvL69nLKnhZHj2jF
TLSH
T164168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 685381643f1d2a1da7d436a2eed6c9d3c7ce0fbfd6613b14915784a363828ec9
MD5 613234e080a59e68493e83399138f4c0
SHA1 8f7c844b8df255ba91c7509dcdcaf3c3751f590d
SHA512 e1e7dd7779c599db9b9b01b43f5daa71855f35030a6990c107b12e85d29d625da7cf2cee3c2acddaa617d1a1fe1c300134e5388141f3aa864e7b3c394a2b9585
SSDEEP 49152:GB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glv0N/j2U4FH:0u6JmVxd2dgj2jF
TLSH
T104D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 49a6012d8c615779d92761d30a10a29f668dd8a02212692909cb1de415dda056
MD5 57c0da5721d4280308f24f66446f9afd
SHA1 1e21b0483a6738b359128df675d1e03e0f2e2a8e
SHA512 f9dc1c4ec722c3ff4ef15e3747e72e197491be5417ecaff59be15036b5e2756d78820c1bcb1cb8ec574267de292d1a380972f8b17170f1f61c6f7e2d875c5032
SSDEEP 49152:g1hpsNoJpF1A6UU44CwH7R4xuN/j2U4FH:gmifPbRtj2jF
TLSH
T1C6B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0da52d6d5be4c1de4fa0892cfbf1a565f75e2d3dd6d7d5f1061a04df96696bf5
MD5 17e856e9ca522862aed8c14c01f26c1d
SHA1 fc314a6763a57fdf7d2177b34a12b12d289bc782
SHA512 089a9e35f4c52b41e1dfdcb54d11797c7627a219d3e532c5565b13c1e87fdc4370d0e14e091acd8d2a9b252bff721adbd4e03ed145d6bff4ed8f7251e45ae247
SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHqVN/j2U4FH:Y5dKTi617j2jF
TLSH
T1D1C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5785858ae9a80189136e88812fa965e18b858cbe1d404fb157ec33fd9c30c3f0
MD5 b4f61385bf87e4e7d08becb634189760
SHA1 35e08537546865aca19327e2dd691ffd972d0e50
SHA512 cd74e92dbb2a3b973d54b9975db127bef2bdc4cc6f47f62cccba08381463f74ac2d721de357c6fee330ec8143127e8724ed38a094ebd81ff7a6ac78f885da59f
SSDEEP 49152:WhtSn8EApI0figngiDn0AP5wqN/j2U4FH:3X2iyphJj2jF
TLSH
T16095BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 c7caeffe1a76f199b798d5c0940882e708c99bddd5e99958bdc30108630ceb6c
MD5 1465b0181830d8470cfdb9319bb602fe
SHA1 a3657f268ed64aa3042ed2a8116ca6132fd0a5e0
SHA512 6e16aa92490c1fbc36158695aa220ab3efb849e775fc05b4fc64bc576139f10bd95e450bcc77084192d4f0692a11e3ae006efb9bf8387cbf438cb21d41f6d1c3
SSDEEP 12288:ySJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:yOdCN/j2GLl3iFSE33b9
TLSH
T1FC752364E9E6B669F15BC37943A9DF515100FEE8F6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 f3621acf5b2df5a8e456113975658211922cee1b2b0da8cda196a9d989595054
MD5 7e91d8b4005a5707c38f5407f3803c2a
SHA1 9396810754ce2ebe8c15938c774c4592baffbdbe
SHA512 0e8a0737a211aac2be9c11908165962b556696329ecfcfacc53b87e0a88c1464a8e59ee1bdd2d1c93d23aa1336b124c41a8d96c06fcb48911b09dc2e4f9823fc
SSDEEP 12288:TfJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:TPdCN/j2GLl3iFSE33b9
TLSH
T1CD752364E9F6B669F15AC37943A9DF515100FEE8F6224487868156EB637CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 7ced918a0a79d33709ac2cc121d945f6c7526ea496dfd90e36cbc51b90d48501
MD5 2fa643e0bb136d2c3e735ebfb26cb5fc
SHA1 98728ad1323e5dda4e284d7bf9e074ed62cd516d
SHA512 455264e65b0388e89449e3fe67906d68ff082ed19aaec9cf101467e52e339bd25fba36ff37109da192a955c81883672544fcbaaac4447456a917f2a4028088f1
SSDEEP 12288:NFJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NBdCN/j2GLl3iFSE33b9
TLSH
T1A7752364E9F6B659F15AC37D43A9DF515100FEE8F6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 5bf5c799eace539855574152b332110fc8d8eb74f853c220c599989700ce8e6a
MD5 43ebf2b61991816d84548559c3afb9f3
SHA1 745ed03669f2a555d98c044e6446fa7a67d6d14d
SHA512 5976b317ed25eed6ddc5866774d9e33b3f5dc4a5d8793aec8b9744bb6e80dc4ef7c5cafd605230df6a96b5c1503285474d406689448026c984df2131a39affe7
SSDEEP 12288:RV4JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kdCN/j2GLl3iFSE33b9
TLSH
T1E4752360A7F561D5E46BC37C83B5DA21E220FDE8E73245CF87400AEB1B75BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 2c6d7f04f9350d8916c00e6ee385136c56ad2718893a84e4514a80fade03e86f
MD5 518533ea54a16e991ca1029fed7b0f61
SHA1 7da955646422031ba14128943206bd2dd64dcccb
SHA512 39f1dd3cdd9f515ffe4aba83b61e5c719ba229b29d62b6a7e343aa989b5c9a917b520696ed14c025c307b5be066e6e01be54de9b2ac89451eefdbe047434b415
SSDEEP 12288:VAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VwdCN/j2GLl3iFSE33b9
TLSH
T18F752364E9E6B659F15AC37943A9DF615100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 8b73544a534e3be98628faa459f88256cebd3325217eca91012db2b950eeb77a
MD5 7bc2eb916074fc10511b4fec64e787e2
SHA1 ef98e0ddd12c96c3dedd780a73cd023cca70ac76
SHA512 d0ae2d88c5781040333650a39439125e07c8e14a721aa42ddd71857320e84bec4732d523967d67d092a01c83c428f36539bd8a9016a20e19caf9d2c45a657dce
SSDEEP 12288:WTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WrdCN/j2GLl3iFSE33b9
TLSH
T1BA752364E9E6B669F15BC37943A8DF515100FEE8F6264487868156EB637CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 3575848a4b55d467dae38e6d0ba0eae3012fbbf811fd9909320d55af9a9511dd
MD5 bf4b7fd1b4b9d28dc6e93b427f5e0d82
SHA1 063a96bbfb36ae22791406285f29e11004da1143
SHA512 820dd6d7856f0742953247c0ddba0cde10645509272dde4aa5c8cb9313f415c1da9df4053a242f628dac3d168db121e05056bfe84ab187045c80a89399bbae57
SSDEEP 12288:knJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kndCN/j2GLl3iFSE33b9
TLSH
T157752364E9E6B659F15BC37943A8DF615100FEE8F6264487868156EB237CFFC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 1b08c0c3d222e6063888a8d6df0c3715212857a9fd3c0d61413b98c09f0d5c8c
MD5 cc6d5d5f217955f173224dad5f227414
SHA1 f3da74223372498c43739561a8aadf2b5822b7c8
SHA512 05a0415dff8905d3c1873e56d4b7e740f1da418a3dc62ca1e83453d58fc471765823b4f9bdc42e7705bf747e06ad6032b1b276c5b14ce409a5e07f11516bb556
SSDEEP 12288:1iZwb6zzFEoS2cPvy/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4ZMSzFVSOvdCN/j2GLl3iFSE33b9
TLSH
T17D8502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 a3eb1265a50d17ae5b02c57a74b5ce33734615e144dc1a1825ade2e478a9876d
MD5 17ed5d6f5ece0181f70309123dd430c8
SHA1 204726a402285eed1c8816d10ab7d25577ec2ba3
SHA512 a17b85dee42b55204e30e262c8e7726dde134a5ddfdc6690dd5b9eb08f3749914dfdaf03e0ca615da51000874d5e965d1e57fa46e7ebe4ded146ed555703f8c5
SSDEEP 12288:JuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:JCdCN/j2GLl3iFSE33b9
TLSH
T16B752364E9E6B659F15AC37D43A9DF515100FEECF6224487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 a07418d84677a17db04a4653d6706d268bbf04bc9528b7412bd3853d8959a016
MD5 898274574f46dc72c8003871676edabb
SHA1 0695a71496b1943e6f576362fc19f17976d3b392
SHA512 8e487e4090c4d65cc72b5f4a0b54329716f21a3f5b2990c6081609ec17e7d46333ff3816f4a2e091efab95ab7cf3d8c367786232a15dd366e0cc10a836c165b1
SSDEEP 12288:mKJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:m2dCN/j2GLl3iFSE33b9
TLSH
T119752364E9E5B669F11BC37943A9DF615100FEECF6264487868556EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 15c1e328c4eb7b078b5f5d67c9bb62415c153655ad92eec38caabe6c51e8b37b
MD5 6f8837f38b161a638ff4b2e7d1f03951
SHA1 d2e2fd5441b78375fb8b5f087963ca81de226d3a
SHA512 059c4378ae674665be272ad0b4bf8100e6c5e77f051a2082eedddfba2e4916e2682f252e7897dfd32c88c35fba7930913a96fe2764c2d940b4b4bde392d77a92
SSDEEP 12288:fyPz5L8LJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SzyTdCN/j2GLl3iFSE33b9
TLSH
T11785021773A131F9D167823889A55A12F331B87597208A9F43A007BB2F377E49D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 bb72ece369cf3fde860793f3b01cb93e668b4706b52fc389efef2ec5ee48f955
MD5 a48b3ce39fe2342eda0f55c21c760fe6
SHA1 42099271bd01eb2a4d83f3896c5ed75adc2bac6d
SHA512 e1d6179796cc8bee8187f009dbd18d35d2ca87c09d36bcefd557ada4c3745a911a91e13bc36ba5a6246bb7aacf90d6aa90752b57e36c0ae44cfa3091a290cdc7
SSDEEP 12288:kuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kCdCN/j2GLl3iFSE33b9
TLSH
T10B752364E9E6B659F15AC37D43A9DF615100FEE8F6224487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 a88c4efb72a0d42c2e53d0bd3b2f298a4982d71115661d84007c024c5ed8f499
MD5 688611c14dcebb8b780dc1fc6977375f
SHA1 02b7404379f988ce500b931b35db19e81e364c76
SHA512 a6c0e67e64a44918f0e71e3bddc168427e7e7811f501ec445be970b9af0618398db23425a166a039f4bcef039905392b2ac67a56fff9a29959166416a6e8e7d0
SSDEEP 12288:5uJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5CdCN/j2GLl3iFSE33b9
TLSH
T158752364E9E5B669F15AC37D43A9DF615100FEECF6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 ca3611119dce7f29b60621078530acd66a7db4fedc03527f7457573a17e783dc
MD5 9f019bf5050ab83e828e9755388fb742
SHA1 d42b1e53d5412b1940800b287b5e33dabab8fd87
SHA512 84140e50a8122b063e68a6a6d78e8ad394181aa21c428727be0c697cf603c17c5a4831dd940c73560c5cfe1cdec95d4a6573e29541107f4165b9d28d605ce875
SSDEEP 12288:ZyPz5L8LJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YzyTdCN/j2GLl3iFSE33b9
TLSH
T15085021773A131F9D167823889A55A12F331B87597208A9F43A007BB2F377E49D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 c4de00678faa1ba4f525e67f5c4bcdd79f13dc1618be006404f63aca7681147a
MD5 dbd26cf10ed95f3755ccb0b551e7109a
SHA1 ee5640e951a07316ff3c79e60067511b81be749b
SHA512 6478e484fcefbef34f9a0af5554bc4487cb033d69294923567c00b8fdc5ba0999766bdd5cbc71c60ef773b548111a08a1cc9bdf79045c999593c0ce8f4351cee
SSDEEP 12288:jCd9eWYoaLHF3z0z04PDvh1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OTHaLl3z0zDRdCN/j2GLl3iFSE33b9
TLSH
T1048502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 e4a9b82c4db70149815e5da2a16603a8e4918645cfd61fb2562168260fd278d4
MD5 9308974026e5b82beb59c6163149c095
SHA1 6199cf8dfac57aa72bc6fa25c23738d7d3cf4451
SHA512 11186e216fc573dc724790c180878604ab98656e0232d695f7885599701e6e559fa78b781c64de30e4547def2d27c8bc8775e6c8a94047c9e020ba7fb3f3e31e
SSDEEP 12288:Ui4e7+RdTfgwCHKy7GLbbdIv0JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:U37d9CHKy7GZddCN/j2GLl3iFSE33b9
TLSH
T11D95CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 b49d1b86ff6f50cdd4b9a51934e22a532fa5235e07fdd77a69c5b20112048c13
MD5 9ddd4fd7ab672884678c7059b54906eb
SHA1 507561e9981a6c8094970d9a869ac5db9acd3672
SHA512 e1d14987bfd2fc1a0c45cc237c07d1a6e9f920906c019512237b07e34d4187373476b28b7547b676146a58b0f805276e175a84accb83b90ee0f59035a41f6769
SSDEEP 12288:WlJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WhdCN/j2GLl3iFSE33b9
TLSH
T1A5752364E9E6B659F15AC37943A9DF615100FEECF6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 8410c91da8e2d6a8923eb0fcc44f0c80a4c088ebb3801ce391966eb1feabe7c2
MD5 28c2ec9d22b7f63d28e3a48d72ca3e3b
SHA1 cf97152bc507a6cf460185c39a3ae15a4d05a4a7
SHA512 a3b87b4cf7a86861a8d4aecb1654224fd08c68e431e133da96bc521665a1ea3463781da8b5af3e4a391ceaa742a1d8f237a475bae5ad17e1dd75822238171111
SSDEEP 12288:0rJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:0zdCN/j2GLl3iFSE33b9
TLSH
T162752364E9F5B669F15EC3B943A9DF515200FEE8F6264487868156EB237CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 9b89518716b762bf9640539a6f8b5982bf969b0c725755cff2b874e6d663cd50
MD5 0f1d93d6c8747d4baf21b37e9aac0edd
SHA1 2cc75b1ef33ab6b3cbee3f8a10e2b23c42fb7c35
SHA512 567c32dda6f46cb4559e5305b0fddc958a0c6490bca420d8551ee56081c1b9be05480891f172e526fa93d540d9913847b068ba0864ac20bb5bb5a80077785f73
SSDEEP 12288:Y0JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Y8dCN/j2GLl3iFSE33b9
TLSH
T113752364E9E6B659F15AC37D43A9DF615100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 c7f9a60a1203386dd9c0a37ad1910161335e902ee68e96252a8489bdfc16169e
MD5 574794688ab40f9fd8560a6334df9b5b
SHA1 3ebc295e2ec7a7e3f951b9c99c517d19e16a7449
SHA512 c709178bf276b775340423732dde72fcb44c7a3b2bc750666cacc7225a86283bb016d66de62ef0c361dc06f00f83ca099d427e3caa3cd753c5d0ce50ccfd11ea
SSDEEP 12288:8uJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:8CdCN/j2GLl3iFSE33b9
TLSH
T1E2752364E9E6B659F15AC37D43A9DF515100FEE8F6224487868556EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 d774224b610b516656b3b0c07845b270df00426ecea869432d696e4f55fbe4b7
MD5 0af6fefcb5c5341c157d7487a60c2358
SHA1 cbd7c7ba5d3f4762af73c68490b79ea9c21712f5
SHA512 6020db0643a02a83b6a0e079dc3af753c31b08346e0760747e76a427bd6d03d7f8ff36c7b8698e3bcce03c68c8245b78f3632f0fd53814dfcc85969afbfa4a9d
SSDEEP 12288:PlJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PhdCN/j2GLl3iFSE33b9
TLSH
T186752364E9F6B659F15AC37943A9DF615100FEE8F6264487868156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 be69cf7663fe281a8c34616f672b611d6936e58a931675d8bf81f89ade0146f1
MD5 7cdc5350108439c79f604aa5e610eb71
SHA1 562f63c7618ca23a175abe33c7285a4202236fe0
SHA512 2592171163e687ef1b8cb246be9c81b14830675feb762e8035ffe308baecdeaeae0d085a7def5ab40330dda243a8f55d3ecbcd001d80e64805966b9c61b7ba2a
SSDEEP 24576:tfwvok9RX6wkyAImdCN/j2GLl3iFSE33b9:rMnYIpN/j2U4FH
TLSH
T17EA5D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f3f3a3f042774006f584bcaffddfdab1403ffdff7b318798ae54fce3c3ab914f
MD5 c58a69d2d282648a1b2f2d24250d370e
SHA1 027d530964df580d35f38ee75b2693f566fbde31
SHA512 5631a2a98179d5c8dd447391b1d9b899a24dce1f2ad3ac15c64cdac25d1ce16fa9e78053d7901417aa83a0e05d77f48ef8c5fbf602547c64f34f24f8fb76048d
SSDEEP 49152:9YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0KN/j2U4FH:9ySzPCj2jF
TLSH
T13D067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 98958f68d80203a2a1c18a6893d32f84bc56663f9804c7090ffb08d782a74968
MD5 715d24afc61e1fbe03c1b4fbc098bdf4
SHA1 a2d31eec9e6f25ad0e415956c550a546ff939538
SHA512 c76a0b8f66707d14c37a6818439cc0309d149e42cab685c34e07484d98bf155fe807a6595500f49afeae38b4e7354fb80368a3eefd49ede7c9e12c5fc4cf0001
SSDEEP 24576:B47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYfdCN/j2GLl3iFSE33b9:B47JUQj1irIhCnDHUPfF/6N/j2U4FH
TLSH
T18565AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 5bfb0b0f3706386e0586e69f638fdf98e5fbd987e414e06c2ef088f5bc1f03cd
MD5 85182da78891a66d792ada2fa3f0cb81
SHA1 bad9a449602cb1fa5f938d8d7b8813b255f52371
SHA512 316242826407772e456221b408a5d4f631bdba64425dfe9675f34c9139d1e941563dfa1409cdeb63d01c2353a67d8c43b47c9268cf8ca80d9f4ad749ab81ebe8
SSDEEP 12288:NNsfeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:iSdCN/j2GLl3iFSE33b9
TLSH
T10A850119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 69730876396009a8e6d9249f95aedc09e31f87d69ac83cc1d587fe7b8a4c5620
MD5 04f48bbf1873f39a914eb9b29f1a2478
SHA1 9bb49e37936f9aab191ef2492e940e86c7870911
SHA512 52a333597492f73e922efc37e85e1fa6328e3545371988563e7ce1290b8b2192d85d274c55a74202ee6e4f92f22e9e449986d17e3de78b2bc91d41f3b32e5280
SSDEEP 12288:SPYvzoU3f/w55KyXggLB2V126h5X/lloMEGOscqhVMfNxYlWn6mM8Po:SwvkUP/YggLY3z/QMEGBcqLMVxYlU8
TLSH
T1F34517407626CB8FC66940321E36D6CCA770BD05FE48AF0773CA873F9476659BAE5281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 5b41a0492907f1c73c5144b568906148cee391da76c8b354e3a938ab02d14af1
MD5 33526b72ea8db9a493bc41021c5b7349
SHA1 e751b85805798f861569029065523de103fecbf0
SHA512 edbbe24bd594b7b914cc81cc19cfcc5347e244ee6171cef083a14540d4acaf96f349c7be7b7879e3940280d1b73cf0d1e8fe818a33f1ea551a9681d3fb358979
SSDEEP 6:KIoBIbJ/HcISN1BQK0mCtEEEEEEEnsl/l:KIoBgaTWEEEEEEEnE/
TLSH
T1DB8112626B850A6ECEB3A474031D0F5D1732C06DA0D98FDF12DB1A651D582BF0CA1724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 52c0579b4914f2c43327f6e63dd8e5d9a51bbcbdd4df862fdc45be074c427c92
MD5 769d95ecb5a00ca7f2bb1f5782aa9b95
SHA1 47aa578871666f29a4151deb3181b91f7e36df1f
SHA512 ac3138207906f6cc239da0169a319a05842bd9646d619f4f38818b7445c5b2e2bc8bd649f404afe405258d5b172fdc904d48e8eb73e486918f21d69a2d2ca43f
SSDEEP 12288:MX1BJKLVY5IaAa2lDjZyaC8ivRM/9v/33XaYvsbTbgq3UKcuhVO1Ms:CbKm5otL9ee9H3LEcu/wMs
TLSH
T1EC450A0095A7EB4FCD7A9037073286CDBB745C07B7892F057382893C986796EB5E62D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 20c556f0c417e804edaee95aa95add47e144480a61acd96a71ac43aa2f13eed5
MD5 ba35b82dc93ecccdaaaaffd8462db1ea
SHA1 bbaef27b4d5deb525e543ee682d4fb5e9b0ad7dd
SHA512 1258a373a7dbf706e4faab62518ca988daa750f38d350fd6fd31f284f6fa077deda81c6f165b74888946851536480c12d70dc4f15d1b08512f96c8860372cbb2
SSDEEP 12288:2M7GJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH2:zqdCN/j2GLl3iFSE33b9f
TLSH
T19F752360D7E5BA55F47A837803ADDA216200FEF8EB1184C7C54167EB6278FD8D832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2932340b958e7fb3beeb430d0bec1bda7708be7b724a794757c651cad821ca8b
MD5 24c0ecbbb8d93250819ca5d7019dbe98
SHA1 9298ab73463a4005b1b95c5e0f3cf290bfcb6e08
SHA512 36aa0ccc98bd901a457da95401aa265397fe62e0102ddc207d55f89eb95ded29db87d2fe5651c82f65785453cd307e57b103cfc28a06612c119e163bded18bb3
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bYEdCN/j2GLl3iFSE33b9:fgb4mBIBhGFsN/j2U4FH
TLSH
T18565AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 8902f405d6964c26835290da3b85473042e4e8559833b5f8675b7859af70cce2
MD5 c8cf63bccae55d76e3956288eade0110
SHA1 20bb3b1418f429f80a9897b2781d542c9adbe084
SHA512 b3d95fee9e317a514acb74a3a233db6f6afb879ff1330e160c8709504daea842970558a47f831b55574b8fbf18cb35ebe713110cfd1127fb7594fc26b7fe96f8
SSDEEP 24576:uGjlaKngL2jdshRTdG1YxITqvfPkbIcbjLm:uGparSj8RoTCCW
TLSH
T10F05237EA7C566E4C43A977429B6984A3CF33768870A46DF88E0957C5F667E0363CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 9ff7f72019cd6b9e7e9ee113914c8f484b4d8485d0fbb7d2606a36ea19a2777b
MD5 09c91342e22d1992c927297980834982
SHA1 6c76b8a712afb79455cee8f793f1ccca94481838
SHA512 5edf4416c2385526487b37cd079cc19b223163bad3df27540403c70905cd50f61f34ab11615572115fe1e5f940e7ead2a0f347818a428ca70062e0e888a4f76f
SSDEEP 24576:OG88u8FpJqH1bzria7/mvdCN/j2GLl3iFSE33b9:F7ZFPqVea7/HN/j2U4FH
TLSH
T163A5F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f32375731d9c22a743a62699ac76626a001bfa4ceb1163cc3f3a4978ec57163f
MD5 37fbcc4805721a57825f3f2191bef4ea
SHA1 3e089af8dcfcfb4a416a6b4cfa517ce51374f9eb
SHA512 c0dd3f3b257942d3f40ebc0cd4b59519c46f338048d0631727c0cac95e427406f860cbfce6d8ebc880589cf4ba34532fa74dc616033ee49212aa27834a5ffa0e
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjIN/j2U4FH:eG05lO43bvj2jF
TLSH
T16ED5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 957f46e421a09c01629ac1478cda91ec51047f7d450881ac7f69d8de76cedc30
MD5 e7ad30a70498bc661b8b3cc931c02cb0
SHA1 63679700301265068417b8ee8ba34a9183a93c1b
SHA512 0caace8a3f96db12d7a8ae0d421885c173b08da7d0bda29d6cc7f8e50f5eafad2ef130b5c37eaddb77b58b0aa5868657f7e31af9e71341c877ae2c0d60327e60
SSDEEP 24576:tfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnVdCN/j2GLl3iFSE33b9:da5POZ3+Jt2pasx2+mwN/j2U4FH
TLSH
T1E465BF5EA6FC01D5D179D17DC5838A1AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9498b4a6f7bc64572d5dbd72f67fb2cc97a239f12f3a2e38a83e3216062c96fc
MD5 63b882ea924648d65d9fb651be1118c6
SHA1 121061a53e59a2f9990a132a9883c136f3035e2c
SHA512 afdf5871deb2b4552f2476f2f9754e9cc80519695fb78a7f70cddd67b624ceb6e4701a1899c0fa890e40dc792283d5951c74ec7e3c4f7d6fde0371e6a17c76ba
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7Fk3dCN/j2GLl3iFSE33b9:JNc/zEOVHFnN/j2U4FH
TLSH
T145857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 c0aba63b8fb1e5c211a1722e730ad05c140e605dc1c9bec10707c9c09181357d
MD5 d12b6197c8175cb0b6ebefecf49ff529
SHA1 8d6e6c8c1bfaeb038c7c1ba134baa7bc755d9b70
SHA512 17073ed65bf2abb325af96d688cdbed070397e4d76e92bd84ee4123683c070248d77116a162131630421731319a4903d9fabfeb359aeb6abd82b207706dcc636
SSDEEP 24576:j6DIkaKngL2jdshRTdG1YxITqvfPkbIcbjLm:j6DIkarSj8RoTCCW
TLSH
T18225126D63AA01F4D06BE13D96934505E5B2B2B487134ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 1a9e7d56afcd89d1acb2c941673d6d48f0297bb4ee93b1ee9ed7d65610bdd743
MD5 a543872239253f499bebc3258c909d02
SHA1 dc288dcf6ee19d9f9e3f790e89d89ef4b1710cf7
SHA512 2bbb119670fdad061e872bbed630c2a57d03e1d074a72727ba222d7005f9a4140c1fbb92e1999091e9107f08aafaca568b90df2fcf559db15b714d0a8b1c0d8a
SSDEEP 24576:dTkNvNnaFeYhJNtmZBm6aKngL2jdshRTdG1YxITqvfPkbIcbjLm:dTMwBtOm6arSj8RoTCCW
TLSH
T1E675B06EBBE846E4D1FEC6B49D238516EA727461073293CF4290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 6ef8896b3537eb33063a0965efb733dc9daa8063c19fa5ee9809291fefa35803
MD5 d137ef80467c8a1c88724011c1b863d5
SHA1 af9bb8db236dfa429131e3d3f4126526dfdb14f7
SHA512 7598907e3afcab9864bd5b7aa4b47fd7865e69e6975a9d01be5c3166e7856db1f268c96cd101d8655c75f90bd4ad95b8593c09e1c719ae664d602de215c57b7d
SSDEEP 12288:SHvUrBFrEjwaQtHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SPUr+NQtHdCN/j2GLl3iFSE33b9
TLSH
T16585F22E62E918E5E67AD17D86868719F731B8615312D2CF02D0817E4F77EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 8a4b47cd8c9302741c3e5b379d069e8a99ea0795172bb9dfe9954a03a0790ea5
MD5 0cca2d26e2b6b6a9d65fb3a275d4f581
SHA1 ed99fece2387bcfb46ccc9a3ed71c196da4a1088
SHA512 66587c00aea31a02cb13a6a676aa958a6d7689b6110b6862ca3b474cab6f967d78ba32e9e652292efddb06c9a6747ab591d95d51967112c53fdb88bd5a9e1fa4
SSDEEP 24576:gD3FHshBIYQgAudCN/j2GLl3iFSE33b9:gDVHeBIAAxN/j2U4FH
TLSH
T18F95E17DE69C04E4E57BC2BCC6638A06E77178A8433255CB02D481BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-98-0x0000000000B70000-0x0000000000BD7000-memory.dmp

Download

memory/124-309-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/124-97-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/124-92-0x0000000000B70000-0x0000000000BD7000-memory.dmp

Download

memory/2572-78-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/2572-86-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2572-80-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2572-249-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/2716-20-0x0000000003870000-0x00000000038D7000-memory.dmp

Download

memory/2716-0-0x0000000000400000-0x0000000000CC6000-memory.dmp

Download

memory/2716-91-0x0000000000400000-0x0000000000CC6000-memory.dmp

Download

memory/2716-13-0x0000000003870000-0x00000000038D7000-memory.dmp

Download

memory/2716-7-0x0000000000E90000-0x0000000000F15000-memory.dmp

Download

memory/2716-3-0x0000000000E90000-0x0000000000F15000-memory.dmp

Download

memory/2716-1-0x0000000001130000-0x000000000128E000-memory.dmp

Download

memory/2716-67-0x0000000000400000-0x0000000000CC6000-memory.dmp

Download

memory/3264-28-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3264-35-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3264-34-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/3264-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3264-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4156-163-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4156-330-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4156-156-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4156-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4280-147-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4280-149-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4280-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4280-141-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4280-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5012-64-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5012-68-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/5012-58-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5456-49-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5456-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5456-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5456-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5456-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5660-108-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5660-343-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5660-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5660-102-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5660-342-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5660-109-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6096-329-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6096-122-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6096-328-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6096-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6096-115-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6128-137-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/6128-129-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/6128-135-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/6128-326-0x0000000140000000-0x0000000140327000-memory.dmp

Download