d1123986a2cc28519ffd77244fb7c1eef8ea12d671b37e755bb893b9ca6b6a64

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_7068ebbefe9348bfb36a6224831a233a_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.2MB
Sample261011-nnbbdstt8m
SHA256 d1123986a2cc28519ffd77244fb7c1eef8ea12d671b37e755bb893b9ca6b6a64
MD5 7068ebbefe9348bfb36a6224831a233a
SHA1 9e71f5b7906b7edced7b0febeeef7d32fa282b72
SHA512 53419dee1d6f0b5a8562fc0ea6b8c54db944b892e0c1d7c3e05e00981dcaba9be4881d4b32ae7af1fa73ebf20563e7358aa6872b18b0c5454a14ec3dbd65fa50
SSDEEP 12288:l5kGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWD:LA8TO5U1JDOSk05bgv06X/09GYwQ
TLSH
T13E5523247DC2D032C080287AE1AEC2B1667ADC711BB59A53FFE76A7B4F353D1651E205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5288	elevation_service.exe
4892	elevation_service.exe
1184	maintenanceservice.exe
2400	OSE.EXE
2748	PerceptionSimulationService.exe
984	perfhost.exe
3484	ReFsDedupSvc.exe
3900	SensorDataService.exe
3180	ssh-agent.exe
3312	AgentService.exe
3512	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dbec58734b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-10_7068ebbefe9348bfb36a6224831a233a_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-10_7068ebbefe9348bfb36a6224831a233a_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-10_7068ebbefe9348bfb36a6224831a233a_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-10_7068ebbefe9348bfb36a6224831a233a_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-10_7068ebbefe9348bfb36a6224831a233a_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-10_7068ebbefe9348bfb36a6224831a233a_elex_redline-stealer_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4628	5080	WerFault.exe	89

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_7068ebbefe9348bfb36a6224831a233a_elex_redline-stealer_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005863052f7459dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b81cc2307459dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029bda92f7459dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007aafb52f7459dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000def0a7747459dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000016c4747459dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2b99c2f7459dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5288	elevation_service.exe
5288	elevation_service.exe
5288	elevation_service.exe
5288	elevation_service.exe
5288	elevation_service.exe
5288	elevation_service.exe
5288	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5080	2026-10-10_7068ebbefe9348bfb36a6224831a233a_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	5288	elevation_service.exe
Token: SeBackupPrivilege	3484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3484	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3312	AgentService.exe
Token: 33	3512	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3512	SearchIndexer.exe
Token: SeDebugPrivilege	5288	elevation_service.exe
Token: SeDebugPrivilege	4892	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 3788	3512	SearchIndexer.exe	104
PID 3512 wrote to memory of 1408	3512	SearchIndexer.exe	105
PID 3512 wrote to memory of 5624	3512	SearchIndexer.exe	106
PID 3512 wrote to memory of 3952	3512	SearchIndexer.exe	107
PID 3512 wrote to memory of 5868	3512	SearchIndexer.exe	109
PID 3512 wrote to memory of 2620	3512	SearchIndexer.exe	110
PID 3512 wrote to memory of 4212	3512	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-10-10_7068ebbefe9348bfb36a6224831a233a_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_7068ebbefe9348bfb36a6224831a233a_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 476
  2⤵
  - Program crash
  PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5080 -ip 5080
1⤵
PID:4436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1184

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2400

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2748

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:984

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3900

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3180

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3312

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2976 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2976 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9f287f688badd42e5904d8ecacff3dd74775965c4124c01f7bdfc5b7fb722c80
MD5 08e5e0addc5ca5de338890d8469844b6
SHA1 5701dd9d4e65534b1e2ab30a5ca791f243b12a88
SHA512 919ef35c65d799e6dc441945b49dc78e41eceb06fed4e60765f384cdef05d4b194d21a664984ee58f170d68d70020f2af1b2f629cfd35ec2881e77dfa282d9c0
SSDEEP 49152:Fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxneO5sraR/0e:b3q6HjBQq01
TLSH
T1C3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 946266ca3bb43c1f176d858a572abaea367a1552f57295d51648de1c909b28c3
MD5 17affcbb2e0e06fc36b9120a4ba9b44d
SHA1 98133da8cbd71b439e3aea4b7d45a5c4ea69b60d
SHA512 616793bcfaeb7f04ee56e8ba9545f1e4dfcc4bf3241378b742be78003584aeb6a94d2914c3dcf7f3237015d142aea7a76c56562387e1a44e8c0a7a7b866f1986
SSDEEP 24576:nXYfDtczAt8TO5U1JDOSk05bgv06X/09GYwj:ytcDO5sraR/0e
TLSH
T1DB65F12877D104F9EDA7823DC9A28512E673B89547A0E79B03F499260F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 bb06b1d45cca7ef2f1e84f9958f721693d3647f202e63caf66051a381079cdec
MD5 4bae6090cb9aaaa02f8d3b3196e9e71d
SHA1 b5a5e2731e97515449855867e44ad769926a9218
SHA512 bf51af658509e78a8922f6eb9045c7a34234f22b5524d9996406e5bf9b565426de8624e6fea85fb8319cd7a031f36738ecf04d37488184cf841be77470ed184a
SSDEEP 24576:V0Le5ji0hmxirMu8TO5U1JDOSk05bgv06X/09GYw4:VPji0AcQO5sraR/0e
TLSH
T12D85AE16F6748335D073C0B9C5D2A68AE97130865B308ACB4296D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4933ea5f1fd9a220e871a05713c8580e9b0ad0c1bb206472eea9026105f01227
MD5 8a039e7eb981505b5d264e306dbd995e
SHA1 ad22cbaddf262363d07afc49ba769cb6092f2e3c
SHA512 af1eb3a756e788f7cde54a280cc74ef1b2567c54290194d83ae79e18ae2f7dbab313efc7ad63838546e2ca59e4d004a33d09f756ceba34d605b95181e06d4b08
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWE6q8wyuc8TO5U1JDOSk05bgv06X/09GYws:y/ezSC6vUzPvxHjysO5sraR/0e
TLSH
T17C756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b214999dbe89b6c22297a0d835817cf5be83ab769fea683fe94e0a24604b8e81
MD5 37ffe1ae93f04ab716b17501639e5e4c
SHA1 7516e204cb54ca99dafb5c7515ab0c62b48cb7fd
SHA512 d86870759476e5a0538011c8de77fac8d9a6b9a118c1338f36253e130b8870a8a1d1f15f285625aeb048e80ffee3a29c8ae9583550a64514b1f78241cd092cd6
SSDEEP 24576:0VbqPb88hv/l+6x8TO5U1JDOSk05bgv06X/09GYwZ:0VO88hXl+5O5sraR/0e
TLSH
T1CB559F66F5B48331D073C0BAC5D39A9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4963115e32e5e96e8ea6c6034714fe234844d4d6db9c821a63c3d0e10fda8042
MD5 2bf16ee3bdf321b3d749a7a6328529cb
SHA1 ed959d425853c2e26d8d63563073e57d81f237ff
SHA512 2285982ff97746a3d382f33d0902002df0fed463293063a65b13f4aea4a6f69498632b2916c6dabec6a7eca9ba18b286273ee1e9bb4ef52947b38bbf58084ea3
SSDEEP 12288:gRGGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWH:gRC8TO5U1JDOSk05bgv06X/09GYwc
TLSH
T1C6452329AFC23055E7E03E7AF2FB80923075CCA55F986B27CBF2F4570979552A40A942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e328bee2c0f0fca35088e9088386c487e8096df562f38448f73009fb66716266
MD5 b53fa6715d2b4f77cb479580e435ec95
SHA1 399ad9bf71c5c3a0ffb6da1f3d9238355c2f9a80
SHA512 70987ed890ddb3cfeda06d82441de3ec95b0b65cb92770c31790a5d76cfa88ad93d03021db2f64b5dc2be185e36fe64670f0f71a6274600f867119c0fdcb6ade
SSDEEP 12288:yeBNUbTVO86U/GxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwW5:yJIUZ8TO5U1JDOSk05bgv06X/09GYw2
TLSH
T18F65CF3BEE28FCD2C27A5DB95691C600A77278704F61A3CBD275C20E8E235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5f999c367ac992009dee9bda1320555d9cdec276d725cc20cfd029ee0798005c
MD5 4bc087f0ee26a527243612015605995b
SHA1 0eac91b319f12913025f54fec418cad9441463d9
SHA512 f2600a4bcce00cdf000db86404144187573388fb0c964b44ef5e42832b899cafa402841111f51eb008d1cd504a8db930e49ed701c49666460d91b5b6da44a0ff
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THj:1QvGAdlCEL8c/yRNw5Ciq01
TLSH
T19E266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 564a0cac85bc1a512462f433f075ea87294afe4495892f2718f47dc5c41924b9
MD5 9977e015db64f992561b1a608fcfa174
SHA1 469eeade0449d5fffb314c1ebbc748f9a6e79229
SHA512 c2739a878f41ed20b9e6190039d2dd746d3097e75abbfcf9fa2a110cf25686f4b1cdd9d67e5faae1396cd769574e1bae05d86d09640aa81cc247687d4ce51aa3
SSDEEP 24576:wdewsAjn8TO5U1JDOSk05bgv06X/09GYw+:AljgO5sraR/0e
TLSH
T17A75E031FE71E036C3BB0DB62B76C716247DA9604F511AC3E3E8999E49342D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 15d700c64e481b05ad27976854f8d7868884fe44b7b005262ddd3c537bea3515
MD5 a056fa60b203256f33b3684c84edf896
SHA1 0fb198ed80f9cac7d658b2d8a8fba024f41df173
SHA512 040628b9d869ffbda82d7333c6101593c0c51c58118af7bf9a2a2b07e4f86578047d6c9e357040490089369acd7065ce3166b41f2f9a0e3c71e1b6ce8c97f74c
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVR1:7UEtQevvqc2W1cpV2EI32F
TLSH
T14C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f1d643f4f24dac63a5ce0ec6eac286a72d8e62494ae1e6ffee2eff8eb8febf9c
MD5 4d1fd8b58935b5076c7eb656512bd5cd
SHA1 fdc0ab0e9b983bbaf00440cac7a63b53375b3774
SHA512 d2eaeab6f5a8b4897bb2daf706613a7bc1a7026529ddc0a161308b33e1adfa3ecd36c518d93cfdb86abae2a17f1d608d4ffd341f1ffcced2a081798fe68ecf59
SSDEEP 49152:oCbRquA/m2yL5zTfFiV+XenmE3/zAO5sraR/0e:BoquVjnmmq01
TLSH
T131D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 67d59c8c4f5ace9e862fdc47d0756633918159aa2e2a80a171d4795b4304271b
MD5 9c43baa203c29814eae4dab2eb7a5c4c
SHA1 ccc2c7b8bfc75dea828249cae4b9767ad9d612a7
SHA512 190f12839c334e73d078598bad07038db8834d93f6681c442d7b8c390d4d254c01e9ebeed6eec7cc8f5e91bc78cde88b1d4432a7eb7d3fefdc92e911bd069599
SSDEEP 24576:UAhGLJIFoiwtA5l7S53I8TO5U1JDOSk05bgv06X/09GYwm:UAMyFoiq5vO5sraR/0e
TLSH
T140359D81EBF551D4F5B3AA7899B68171EA76BCAA5E31C20F1260D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 204188d5f0aabb531b6edd958caeab36d99df931efa4330501c3a8fdcf005d58
MD5 5efb883afec88023e891a5e450b37644
SHA1 6f4c2008827f9e9e71b08814f2e33355af00f064
SHA512 79b4b7b2cd81e4c607d4d128fbe6e0fec403e4a4cc9f2117f2941a79a41328e0fb87aed6d6036e931b307916a86e7495ac401a37006c9bb7b7e59434c116236f
SSDEEP 24576:HwuoOWj8TO5U1JDOSk05bgv06X/09GYwx:HwDOLO5sraR/0e
TLSH
T18065F14937D118F9E9A65639C697C132F3F2BC122A25DB1F47A0C65B1F372216D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 bbac85476ba8d8b1dbe4e26bb0cfe3053be26a0e4a14f46e12befb3b7bea3fa9
MD5 6c5b24bbbf1e416e31a2c2d3c75e895f
SHA1 e07d66e1901f05c3f0bde47c1aceae683997f16c
SHA512 f37e4c2f0e5e547ca4ff49c83ec185aed5cee8c89f00d9d6acd42dbd28799a1bdec6bd0c29b2f7467b5c12f84e792cd79a65bee42447cccf5b5be73c868100e9
SSDEEP 12288:/BZ1IydGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWu:JZu28TO5U1JDOSk05bgv06X/09GYwx
TLSH
T13355125937C130F9E2A2563DD9F28641E372B8A62B7543CF4775926A0F33AD21C39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5a1bcd5bbe699893d9da484dcb0238d6dea2ee34dc1702bf3ec2fa276f276e30
MD5 ed94f063e6de154f12e337dee4df7968
SHA1 1b4e3711a76fe10cfc2eda7aeb9e0de2abc09424
SHA512 3c1ca206705fda3e226489779741fd60845f01a7516e7b4bd1934f4bbafddccb831a3ff2a5c84c8a1f4b46f486c02a5497925fdd79b81a9ae2aa755412624c09
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U3:1QRQyi36YOcPQLvw2gAf+PN3Pq01
TLSH
T14D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6f4c07d233c55f60a79843e329ca8ee2ad40215b999a535229e36292acc1d09c
MD5 25809a0520d76cda2c8f96f6cc8f3a11
SHA1 04eb8f5187402559f8b4b905383fe3273ac2c006
SHA512 782de1ef26142e2b2bf970186e023577ba1be173291cb696dbac903c74a89dc261aa1b39d905dda996a830074e940f7d14382241b059fbb24b0b08fdc3c60cd3
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U3:hQRQyi36YOcPQLvw2gAf+PN3Pq01
TLSH
T1B2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9ac51012042b6a025d7feba43d895839b9680ebb6b2e282e820da311820bfe84
MD5 fd01b0f36c0b8d807618b4869e8bafd6
SHA1 cd78038e3b376b6a02dd67855008c2b3dd3cb897
SHA512 a619cee3fb2d3b539b2c42675d46c75264543de4279cea39241e7fbeb7bdfa095169d8e1e4681dac5b1f7f29fccf9236b105b564fbe18e6b65a8dfea06be4c69
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0G8TO5U1JDOSk05w:w68Qg55nhheWu7PNU3/QO5sraR/0e
TLSH
T1FBB54933B2F200A9C44DE1769F4A872196D17C758FE0E3DB865172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ec45ed007c80d06db28800b4819820c32b86f9aeedb07b6b614215115b47650b
MD5 619474f8eeebabb145a1010b2f206e14
SHA1 37894210b5e6267fb235def45b9e72d1ea473813
SHA512 bca641f04fe11b31bb0c8a56279fc0dfd3b80baa207008902ed47229ee19c61b2d3abadfabc02ac743f39c960f2e6d213b65421a23bc77ebbb65bd3ee98c74dd
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99d:xy5112gYy5azzVvL69nLKnhZUq01
TLSH
T1FF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 968428ed93ffb99ae52737bda2d8f701ca52eb845bd953d1cea586b76077d392
MD5 80fa59bc514baaeb349bdfccbea36a02
SHA1 30fcd02990652c72e884088301d481239e5716ff
SHA512 db302c42db0b8967f18207c45ca79c6d8766654acfb46db2759ddbdfcfbd77a5cc71c590383d582cc27dcdfb19455d477c724e38d9805ca2db6699ddad81bd9b
SSDEEP 49152:wB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glZO5sraR/0e:qu6JmVxd2dMq01
TLSH
T18AD59D13F1DA01E8D06AD478974A9233F962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9715c58f20125bb5d59e78ebdac820800c9b60068d91a6647b9cd1dc1a1c8f31
MD5 386dbf7747cb919cb6e5444d822a7774
SHA1 e37d3a334e7fe641f47ce464bfbc02cddb74e46a
SHA512 cc830c3a04113dd07552df5abd3d951b9223cfaa13db2a6ae1c033880464f2702cde75fbbb29f0b24285ad921ee8a753eb6d1f1855837355a10f26e26a4c5703
SSDEEP 49152:+1hpsNoJpF1A6UU44CwH7R4xSO5sraR/0e:+mifPbRmq01
TLSH
T13AB5BE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ae3717b3e190a9b5e0996f1804fd1a5358bf3b133f42cd38a6154bd230dba06b
MD5 f1dedba6897a69a8cfc3c2054792ed90
SHA1 1a55c2642e1c1f3a02cf2437df05385e417beefe
SHA512 5d6ae6e9e61b441de5a64220a7249068dbcc9ce39e986ae96cde303aef6921839949987ba515f5fe3119e9d1f352192981eb2e832390a435008b4ef21641b30f
SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHqVO5sraR/0e:Y5dKTi61wq01
TLSH
T1DFC5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b6277e43e1d040518725a4373a3b5e383a55f602cd038703a53db925e3db595c
MD5 f9f65d11ed79f45ae60a842b93f75814
SHA1 11ec11557ba5dafb0df50bbcdbce8281540c5004
SHA512 c3611c3ae0f48b1d0732ad17683a123cdac83c890de691659861109509f5043f46f9976fafdba01380f97468fc0e8be5137d671ab4f86f48c87f9a3372c018b9
SSDEEP 49152:ThtSn8EApI0figngiDn0AP5wWO5sraR/0e:SX2iyphqq01
TLSH
T1E295BE13F2D900E8D05ED178C7568632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 335a395b99846c7ebe8e766fe7b742b3c664e503629d39543687df38b33efd43
MD5 fe2d31560a0aab7450e5fe4dda089fcd
SHA1 6a61a54f639cf9f7318f0fb0864697101b343084
SHA512 16eee36a92f38d0061d759d70d16d5752e6e9f65574ae450aa018cbf9b03be63faf2f952032c22a8ddfb54ac42574052a3ccb46d04243841ad7c115962808356
SSDEEP 12288:0OGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwW4:0K8TO5U1JDOSk05bgv06X/09GYwv
TLSH
T19445231C7EC32155E2902E7AF2E781827078DCAB6F99276BCBFBF0170B79552240E951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e59669dfee971d616fb20e24c3fdc295bf35de13d507e53030c7fd60270bfd5c
MD5 ab5dc2b5114b8fe51c315b58bea46518
SHA1 952a6c66b842ea7d1146750a4b1d56af9f6e272c
SHA512 d595185786c2b74ac0677f5d8ecbf72c72c2995ad56d5f071127eec146c59c9df6068db76190eec94aa0875e9edaa3c2d92e6e130dc1ebbca276d98847aa45f8
SSDEEP 12288:NRGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWO:N78TO5U1JDOSk05bgv06X/09GYwB
TLSH
T13345231C7EC32155E2902E7AF2E781827074DCAB6F99276BCBFBF0170B79952240E951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 03b86739c622ff0b819c0e4550df474677163f5c415054dfaa2d8854d8d7ebed
MD5 08e38c5bbf535b4ffd598c11c6364231
SHA1 dbe487a68fda6311f88156f774845345c552059a
SHA512 2750960ae423ad6cbd3df7af7eaf93906471b47bac211e56c3a8b28cea8fb7c309ff4f539d458aff5fc7ebecd85e62db337225d72344da6c9eb20802adc7b2c9
SSDEEP 12288:wnGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWh:wB8TO5U1JDOSk05bgv06X/09GYwC
TLSH
T1EC45231C7EC32155E6902E79F2E781827074CCAB6F99276BCBFBF0170B75552240E991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 cd8274c402cd22e43270bf3d4b4a70125e09f25ab245ad27e121d1a2b70aa4f9
MD5 8c2d4df7f5b166f0f589b6dfe738ba2e
SHA1 d39a012f3909e67f6c1f4369114c4779c8f938d1
SHA512 d6262da2f65460e147d53265d8d5ebe4f2e7cf2d818762623b7d20ca6a2efa02f7c9bb17c9956224cb41d3944bcd6d47c08744203c52b9e1ba67731932972973
SSDEEP 12288:PVsGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWT:S8TO5U1JDOSk05bgv06X/09GYwY
TLSH
T1F34523183FC310D5E5A1AA79E2F38042B1B4FCE6AF6527AFCBA254170E717912829F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 97d697ba4451bd6f27416cb9d3c45adaff2eac5326d16b3d2558c7f0eb4ad333
MD5 de66d521ac4fc84c51185056f2fc6296
SHA1 032368a231d4d30d417fcf969dff465f7daa4656
SHA512 0df41738526241b16bc2811b893bd0cbc710afa885ede12bdf000adcc9a691a943a0aa5058ea705750b0afe5c920f4229fe7c8a520b38dfe4a35b16dff76ef4d
SSDEEP 12288:/EGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWQ:/g8TO5U1JDOSk05bgv06X/09GYwT
TLSH
T10645231C7EC32155E2902E7AF2E781927074CCAB6F99276BCBFBF0170B79552240E991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 25c2bea1a3ac984c0e0206764e3fa8cce83d9cddfdf219f6811e0ec0756c963c
MD5 49e9d292f811e52a211fdacec2242c3b
SHA1 5d1603ec61b15c1375e0d8d749f657e6961c8626
SHA512 17cbdccb3b6494e4a577d72409778437bd41a75d1cd5b311314d027e8b7b006fca4a00f15722ae16ea606050db5a161386c70d881c56bf475cc8098417a31aac
SSDEEP 12288:OVGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWQ:Ov8TO5U1JDOSk05bgv06X/09GYwT
TLSH
T10345231C7EC32155E2902E7AF2E781827064DCAB6F99276BCBFBF0170B79952240E951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cdf76f2b319000081d4847d1adba1f3cfa50ef8204ea3e3e192ef2de7f8859ce
MD5 615f5cb78f4606ccac9dcdd9470f7151
SHA1 38b5d2455f17193e7c259cecbc7fce09452036b9
SHA512 249e218acb6abdd0d1d065f636a3c6969e64777a351c34cc1a161b195ef9e464c17adfa35624a792525c38bde898a706170ffe80b8e2fa6d8663cfa9d72ed114
SSDEEP 12288:SJGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWY:Sz8TO5U1JDOSk05bgv06X/09GYwj
TLSH
T19245231C7EC32155E2902E79F2E681917078CCABAF99276BCBFBF0170B79562240D951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6c946b149ef8f6ac393794f2a06ae36100d853b05675170c7b0c66cd4cbac321
MD5 b066cb7d231a2d8a0dbfab15e1af3e78
SHA1 84d0df878323d32bcb4050fb185e317cddea5cad
SHA512 e797cf7f25c21fe8b0129057243c3a34c386f54429ba343cfe8a9828b4072c91a5db15970b9db3e747747773df3edd317c6e8196133247ad11922bec1f7dd96e
SSDEEP 24576:IZMSzFVSOb8TO5U1JDOSk05bgv06X/09GYw5:IZMSzfIO5sraR/0e
TLSH
T1C465F299B79118F8EC67863EC9658906D2B2BC5A0B60C61F47F436271F333A11C2EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2c943c9d1103ab32351f05b830047a5e172d408fe83d1e218eb59b7bb1eb3032
MD5 317003c168abe2b6bcac85e018fd1d5c
SHA1 b4378b5114830dbda5c38a52feadd479bae60fda
SHA512 5b448ff769a3c35ff1fe4801d876a484ccf442c8c6366b61a44bd3ae4aa6ec37c9a309f21a7dd4d0b8c38077b4b2f076ea2f49a6715190ef38357dff0898d5e9
SSDEEP 12288:2aGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWQ:2m8TO5U1JDOSk05bgv06X/09GYw/
TLSH
T1F045231D7EC32155E2902E79F2E781827078CCAB6F99276BCBFBF0170B79952240E951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 210fc6b6e5009ffc834535e44925acd5e2a7c7a072f90c4e9b4d8d26ab78799f
MD5 d2d77cb9d094f5a03398dad006801a2e
SHA1 1ebd1fa09ed16660447f60e366592fb37c3ddae8
SHA512 d01a4cfc8264df11cdd57a2788d86558f5a20f849fad6628f40a7a33f72b28bc9a0578c2510fab2b5c7187da19647e932a18bfa3ae135069b49d81868205c32d
SSDEEP 12288:QWGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWH:Qy8TO5U1JDOSk05bgv06X/09GYwg
TLSH
T1CF45231D7EC32155E2902E79F2E781827078CCAB6F99276BCBFBF0170B79952240E951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 02110919d6ece2212221caa6a7bcbde7b7ddab5ffa5bab21e54c175161a747d8
MD5 64db88c8ee96813996be09806ceaba40
SHA1 9cb66adf5f91c1eb6ea66c28dfd3fdd667e70f2c
SHA512 d1f2f7ff5d006b3a0c7a9aca45ef45cd76c40457c49ae75f7b03b0aa76f03798696745994519a80c01d61677db3ea89f2de909def546e44642f6d952a5eb73e4
SSDEEP 12288:QyPz5L8dGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWU:hzyX8TO5U1JDOSk05bgv06X/09GYwT
TLSH
T19D55121B779230F8D1769239C9A20A02F371B8760B649BAF47B442771F376A15D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9bfd5c543d4b417a1b9dd803cafc0c611e06a753050eb13098fa3e1a46777ab6
MD5 e93a6f294df7cb872ff73404d052bddf
SHA1 b6d744ba0023bbf3b80ec1c6d64925225b28eae7
SHA512 948ab6b81585dcfc5778ea0ccecb204553df20c2468725949d57f433211ddb377f234271fd22572075cf335dafb37efb28f0cff569036efabf3d0d648ce4c284
SSDEEP 12288:naGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWJ:nm8TO5U1JDOSk05bgv06X/09GYwi
TLSH
T1B945231D7EC32155E2902E79F2E781827078CCAB6F99276BCBFBF0170B79952240E951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e2762fff67afbd453e9279f2bf3e641d816815f04158aec2cdc5059efe0fec26
MD5 1f86526beae1d2117da88496b545c7b9
SHA1 c4525107b0d3bf00f59f5e239c89ff514b3dba57
SHA512 03eafa78691aad87878086b443e43d3c825ddaa8befaee9774726384dcd373e1abaedada59e584d0f88030d842d4784c46a81a63a1bb58a9f668fe2e55797fe7
SSDEEP 12288:paGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWJ:pm8TO5U1JDOSk05bgv06X/09GYwi
TLSH
T1D545231C7EC32155E2902E79F2E781827078DCAB6F99276BCBFBF0170B79952240E951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b8ece91660d30736b6720980f9a588bf6c92c7ebd1c4255e50a14e12e8f5a0ee
MD5 bf5607c31d502b6a1a4fd5e2120f59e9
SHA1 5a5f0bf409659db88453e1a19efa4d8b0daaaccf
SHA512 25205d54886280d267a301853f5b58c340a5b656bda25d4b76237273cf4d77e0c1e3839e56bcaf26763943ca861d999443d3af7ab8e94fa45bfcbb95bbbb927f
SSDEEP 12288:syPz5L8dGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWF:1zyX8TO5U1JDOSk05bgv06X/09GYwK
TLSH
T1FF55121B779230F9D1769239C9A20A02F371B8760B609BAF47B442771F376A15D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ffcabc5984ef365d616c9777650f09a167e93850d9f2025e174ba649af335397
MD5 c573b69a1fe038ebab8a6e43ac2e02d7
SHA1 0ba30f6d9238dc48665badedb5316c14299c66be
SHA512 19264ad64b54b9f2e7b6d6f5300d2bd923b499b047e91a01dee1e9aebbfc95ad7a0cc5287f8dbef6cb8d845ca5b84533d4d5eac2d68e1d531b5f4ceb7bd85d99
SSDEEP 24576:WTHaLl3z0zDR8TO5U1JDOSk05bgv06X/09GYwy:WT6LljTO5sraR/0e
TLSH
T15E65F298B39118F8ED67853EC9668906D2B2BC5A0B60C61F47F436671F333A11C2EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 05f1152698213bc0e0f370cf125c0d5cb976188f568340635d99916bdfa91084
MD5 c3e6fe51baac64e574101cb0a656fc93
SHA1 5fa302bf98440a2cc58e753a25055756a9828db0
SHA512 14a646892a81c462b470acc9cfa3c368e390305c21603092bd56f4bd5674ea67a4ce4cc8bad5c314810817937699a7cadb604441f5b1b7c39efdcd63c2a5052b
SSDEEP 24576:337d9CHKy7GZV8TO5U1JDOSk05bgv06X/09GYwE:H7d9CHKyaIO5sraR/0e
TLSH
T1F475CF90F3E410E8F0B79A35C9768511DAB67C9A1B71DE8F03A4651A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 204d7e3361f4abb28a10b01cb95771b2d040a1e79faef79f3319150290ab9727
MD5 1723bdc1cb03a1020d9e034776b384f7
SHA1 cff41248248ec063a4f16bbf3183eb5206ee2660
SHA512 595fa5b399bd1a3189c85dfab3924c95c46a2d6f0e5c41795ef19e7d3f8152a526780ab8634649cbd0ac142ee73bf320bc823c8a56a06dc3fc239b883a03da7a
SSDEEP 12288:BHGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWP:Bh8TO5U1JDOSk05bgv06X/09GYwU
TLSH
T1C745231C7EC32155E6902E79F2E781827074CCAB6F99276BCBFBF0170B79952240E991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 32f796844062d67cf81d4c3a293b2c99d87b7d6da26c6f67d98f5b80f92da7ac
MD5 b4556a0f82285caa90ba2fa8aac00c7d
SHA1 cebb35b452c6910b06eb0e0a163571fee96e8a73
SHA512 063fd028dd71fa13c05957bdd8b30b53a24ecca4e5f7c3a3f2eb1ca8a49a01363ad9de5df1e0dce0c630de03222bfb6ba29d9cfbe5dc9cfca2cb6cf3030dca4a
SSDEEP 12288:29GxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWi:238TO5U1JDOSk05bgv06X/09GYwF
TLSH
T18445231C7EC32155E2902EBAF2E781827074DCAB6F99276BCBF7F0170B79952240A951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6890a89852642fae44731c8dfbd481d41ed98afb50daf74130106137de3a7c83
MD5 ea74afb1f6866629b2071280fc2684cc
SHA1 2d2e7cbd2bf88a2d654467f7f4b6ee704a45249d
SHA512 cb9ae9da6eacded54e048b8f09161e0ecb38c88acf787bcfbce9852fc1f37c0a6417ad0cc2c9b161e8d822b5273f24edcfb198514954695f177794534329d367
SSDEEP 12288:FYGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWx:F08TO5U1JDOSk05bgv06X/09GYwO
TLSH
T15345231C7EC32155E2902E7AF2E781827074DCAB6F99276BCBFBF0170E79952240E951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1a84272f2db5b26f547bd87cc8e9339367016ee4e3ab218108ed78eb1c78e88c
MD5 e72688b7859ea82822b52b8666106397
SHA1 a003a5b67be6fe01811d4ad1bfe126a9a2fe5de1
SHA512 eabbdb4881c6d8b74f0adeca291f38f6e7343575652c8d8074168bd9f1a826932ab6085a80e4b57ac9f6b3b8327d667e8fdb326189f13d1e937ab94ceeb66ae5
SSDEEP 12288:+aGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWx:+m8TO5U1JDOSk05bgv06X/09GYwO
TLSH
T1E445231C7EC32155E6902E7AF2E781827078CCAB6F99276BCBFBF0170A79552240E951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6af77b578db4f19d4df8c44fcf82de43f3044c830bf7335a5ca15161f15cb47d
MD5 01718cbebe716f9d2bfd17c6405bad02
SHA1 2b2b1bce47bf8f669da40b7de5535fb1d60f8f55
SHA512 f927d82cd34df3fae3c8380047bde931731474a366a0970a5d720f0855de99ef31ab401beb6d3f05f82f0d7233c6c8f71cdd9ca65b00295b27c64488271e05ea
SSDEEP 12288:MHGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwW7:Mh8TO5U1JDOSk05bgv06X/09GYwI
TLSH
T19445231C7EC32155E2902E7AF2E781827074CCAB6F99276BCBFBF0170B79552240E995
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0c4cbab4c406278f69b757d27fce0c7909b0dabaccf256347603a21793608907
MD5 e8e938633452e077db8571e6953584a8
SHA1 f21f9263e60c58e4b2680d40c68226219ad2f9f4
SHA512 09102bb2e123ca8b042b842833f72c48d599045b9f8acddc218133afadb4a9f300e653d58e298cffed30064dc3ab9e625e518eae776187855c1f828a1b0a2c66
SSDEEP 12288:0yGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWf:0+8TO5U1JDOSk05bgv06X/09GYws
TLSH
T1F345231C7EC32159E2902E7AF2E781927078CCEA6F99276BCBF7F0170B79552240E951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 debbf113358515173238ca5fb545e704f0ef2f19c8d2517ffc957fa03f1a2d19
MD5 d6576b890a9b74157f248b8bddd7a5e7
SHA1 8e09b145194a2517ec7b011262bb4753b6a9520f
SHA512 bb9f1eb82a31886873166dbef4132ff539f500c8e1320250ededd4bb08898a429c179bdf1b22d24c77020762fc8c1fb96722126c17251d09fbfb96612c9abc9d
SSDEEP 12288:1EGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWO:1g8TO5U1JDOSk05bgv06X/09GYwt
TLSH
T1A645231C7EC32155E2902E79F2E781927074CCAB6F99276BCBFBF0170B79552240E991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 e9c5ab73097083d5f3aadbe2f02d5db0effab4f2f55404280e044a764029600c
MD5 1f091ac645c269105c5900237d2bdba3
SHA1 24b5a9af5ee8b9c2f2af2b666bb1048489205002
SHA512 843b2aa8156bd17cf457108bae731eff486893e856ca37d0acf1016bb1d02881c89bef10174ca8765293e1900347178f1894465cc0a7bc7fc4583dfd22e7d1a8
SSDEEP 24576:cfwvok9RX6wkyAIi8TO5U1JDOSk05bgv06X/09GYw2:8MnYIhO5sraR/0e
TLSH
T1E685C029EBD804E5E1B7923C99F7460AF2B178691B31C6CF029A536E0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 92e473b1346956ab7044fb9b2cff80cc147a12fb579a6b67066f6bd0dba25167
MD5 3057e6e15701ecada5ddef9f0a73aaa1
SHA1 4f273f5a75637981e7742f3fdeed5d3b561d8b8f
SHA512 30003b5c7a0e11e509bc1179b1ec454265ecb323777558c570d55ba665d8c3e40a3f2c04e20aeb97c1d3996eeb0509cb7b9df8845ab346153faf3fc4a178e77a
SSDEEP 49152:OYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02O5sraR/0e:AySzPvq01
TLSH
T110067C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 652de781281d611b1265e07a8909026400390299dcbdbf16b97a19dc7e8efa6e
MD5 463c584ae5f077683b156ac6794569bb
SHA1 905d3c3f6fc3a607b4e848688f6defc7b7118b0c
SHA512 37f79560d82ddd66c331ecdc33d7e3d9b0691ae68993120657ebe97a20cb20c36a1faa2fcf3fc7334165a0838fcf5cce72404a13c8a414b7c097f8540756b130
SSDEEP 24576:u47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYL8TO5U1JDOSk05bgv06X/09GYwR:u47JUQj1irIhCnDHUPfF/GO5sraR/0e
TLSH
T10F65AE1DA3EC01E5E1BA927885554A1AEA71782E1F31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 cfeeae5af2834aa57b77006323f3ec22f77ae4fa11df41b1eb584123567ae868
MD5 4c9176f736b0bc4cd6af3cd49c7aa9f5
SHA1 54399d3f2fa8d9200708373fc82a367b35b554e7
SHA512 3285cc1b29fe1712eaa49b78031b40a86576d6099d7fb6d1cadf9d9863fb2c6c6cd83a3fedc494d17110348003a7739e072e53ac7d389226b501dbf9ecd4c63c
SSDEEP 12288:1NsfKGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWF:K28TO5U1JDOSk05bgv06X/09GYwa
TLSH
T11C550119D28412E8D0AE6679C7968641B333BC6597E1D3CB87E0F43E0F766905DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 026b972ecd8be39e94124d4c0e73b344f2939a7edfd04d29a02df84e00751ff7
MD5 8627c31d8be2c830ccdf807064d385a6
SHA1 eaaf4531445ee2c6d3a4f30c7232ab242f966484
SHA512 100ec592144fee3e56bada0ad77c9dced9b939807fe910610cab25c3e396115857d2a84a562df59975dbed0f310ef06f087e16d1d57a96edd1bc8325a54c3ebc
SSDEEP 12288:RwtLIzKMU3f8DVP5VNYzCdo5R3ChNrYsXMIYkNOJ+AOOjRM04xOOHj5+A:RwpgTUPcx5FXVrNOIAfjRMvxLHj5+A
TLSH
T1805528007266CB4FC6A940365E36D6CCAB707D05EE08AF0773C9973F9476659B6E22C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 84e9129218fa89512de761ceed295e25e1342e28e60cbf683df1db891b69bd79
MD5 13dc3006d596b1f6397b94ec874efb4d
SHA1 b6082b33d7306f222f897f4ce3fdbd685be0e3a8
SHA512 573176cb8cb51ef81b56d63f8696180f67e87e9b488eb6ff15c81e0083a96a4881cab7a60a54fd5dd9c13e9b343925e5f6e5f4f32447d929af55b2116b070aab
SSDEEP 24576:RCo6tOwsS3ax2PY9Kqd/bFW+5+a4ebKbTOR25YH:FD2PY9N5KebiSqYH
TLSH
T10465190165B7E74FC87A9037473286CEAB786C07BB453F0573458C38986696EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 b52fc05ec9bb3094ede809c5c75867a25381e5aaa57f4937cb5263e0699a3c52
MD5 9e68d9d7dc114904233703e064767a42
SHA1 ca60242318eecf32b1cdb9c9a2a7d4057220333b
SHA512 9a3ae2d22f49725f0ff2ae4868ff35ba90ac033c0e5d1ad41b6f787f0ff261d5018ffe10fbfe7315edf57d3158fe22e912d1d1f36790b2619ff34f10c9e38903
SSDEEP 3:OlH/lCIABdRIJOgtfHl7HS7Qlt/Bl3yjIl/lllo3mCllltGlslslslslslsl6jR1:KQF7+JXtfRy7QrOIXymCtEEEEEEEURt
TLSH
T1A2812445C3710F10CC375535507553300313F1447440FFDF010405700C4014C0C1030C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 bd2c4011fb7dfbec3d0d5573d36e50d74711464c04046f48e2f9b6f0c8e33d67
MD5 a9fbbdc8bf30c704cf9b994d0709f71a
SHA1 6c3a2c9b5db6fd5f0c29ba4c28f14d82413355f1
SHA512 32ab17f7023604a1b2564bd271f12e07e8d5f302c4808beadeb9ce7c48c7264e790cca0167e3ae9e6c81a0c734012396d2fc9d4d72672136b196e01fcfa2b8b9
SSDEEP 12288:c07iGxAAHBZ5c66U1HpDjENSk05M63wv06X/TQ9WzYwWw:hO8TO5U1JDOSk05bgv06X/09GYwT
TLSH
T15B452329AFC32105F5B43E74F2EBC1213129ECB95F8467E7CBA6B0570A359D12C39A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c80824780ab26b7ff92ccdd7d335001824bcbda6490ccddb699092aa1376888b
MD5 4f411f06ca6aa839338bf0e8ad01321e
SHA1 bc7008c726492993b1a46136cbf7c747afa86101
SHA512 29a60767eae705dc2b42bf733390d1bd44b4ae307e7aaff2426498acab56aa0997076eb1228bae519b2ad4bd93af490f8b93ac4bc5b581b11d3d23a1f67cf78d
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYc8TO5U1JDOSk05bgv06X/09GYwy:bgb4mBIBhGFkO5sraR/0e
TLSH
T1A065AF1E22E802F5E0F5E2B8DDAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 aba99faa6fee2639fb432954eb4b9eab025809686158ef1b26ab86a455b00c14
MD5 b8331a2a5a6c1207fb70fb40fca995f1
SHA1 09cd6b3135907cd07afee1b1f125b56e102a6801
SHA512 bd4e100513495d0f6eb617abddced4c61c93d1e7047a1d7139167bf0d419d0c0768d09cef022c71a73a40b1dec44b725d445c058945a2f046d30a1c75a91ff4c
SSDEEP 24576:kG88u8FpJqH1bzria7/mb8TO5U1JDOSk05bgv06X/09GYwZ:X7ZFPqVea7/bO5sraR/0e
TLSH
T12B85F16577E101F0D477D138CA864663F6B2B8250364EBDF47A88A561F23AE50B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 27d26e6e92aaf7a357982a0d7da667e9e4c1439becbdc7dee1aff606411b7447
MD5 e8b1637e0237f61770319dadc188cf11
SHA1 337d98166909efdeaa72e7a8cd8fa0594ce0b77e
SHA512 62da1f72089a349a8049a7b1ed2d17e1a52e32ad11af301d821f4f0676d0b0151f13c2f8a19d89284b838f02307068db56ea008684137e0067b395a7405a983f
SSDEEP 24576:2PUr+NQf8TO5U1JDOSk05bgv06X/09GYwh:2JQIO5sraR/0e
TLSH
T18465E12F66D918E5E676A17DC5828609F371B862171292DF03E1817E0F67EE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7907d98bc1c1c04818ff2dc7dd8c05fc10ce049e86d7d03faf9895fb82d09fa5
MD5 2f59afd40398fbb12227f796b07524c9
SHA1 cb591e373c2575fcc14e7d7b92a8c6a3f99b5daa
SHA512 4bc93297ebb9c5ad7995545ecd99095999f1f524189ed014c7798bbdbb41c5423147d48be82264219ea448a90d53c6b9a754e560b94976f114c5a2602894e649
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4O5sraR/0e:mG05lO43bcq01
TLSH
T16CD5CF6E62EC11F9D0BBD17CDAC6860BEBB23815032556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9c3e11031ba937ee1abad5148b5fc1896d44cf5616e06eea714e46a9fda73e04
MD5 643725526f408f6a08efe3bf982054d3
SHA1 8c269630810ca7692c6331d5da7edced87077d96
SHA512 dcf6cc493d5f7cce53fda6eb682a81176530458a890f14f7b22aa17b4c4843d9deb9103e9264f53e8efa7c31129b78669efe857717facb940564d450cf4059db
SSDEEP 24576:vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnN8TO5U1JDOSk05bgv06X/09GYw4:Xa5POZ3+Jt2pasx2+mQO5sraR/0e
TLSH
T16D65BF5EA7E801D5D1B9D17DC583861AF5B1342653329BCF022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3aa061dac13ace6f800c108ce913192497626f2fa35bbe08c29588a31bafbe61
MD5 e70ec418da6b280f7b98be6db5ae942b
SHA1 95e58213d2d502c5ee2b9a9fcfe8cb5ad863505a
SHA512 eb8a7d759e26e3c2a16ff28c06c5eb7f7b021fbfc272273377097a0b64cf488e8d06237a12533e36cf948ea17b11e9b0e78127b49d8f992d8c9a4c0f9eb61700
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkD8TO5U1JDOSk05bgv06X/09GYwV:gNc/zEOVHF7O5sraR/0e
TLSH
T19E857B2623E901E4F1BBE1BE89779546FA71786517348ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cd6717b1db5f9f47f54c6741c50d31eb61e2edd8e15d3bcb3dc6afeeb010663b
MD5 e86a8f12965f494b23544735f82d12b7
SHA1 7e151c393f6f7ecaf8b98a7a88075c2b3a4d018d
SHA512 039cfb636e93a6f792d4f6d4262a5963adc9c409002243dd8d555463a6f49a64f4ca612b3c0b4cfbb3b58f738ed5259b557d839057330554072ac6d37e4a85d7
SSDEEP 24576:88kNvNnaFeYhJNtmZBm+8TO5U1JDOSk05bgv06X/09GYw7:88MwBtOmNO5sraR/0e
TLSH
T1CD55AF2EBAE406E4D1FAC6B5DD238512E6727461173293CB9390C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f28f8b74372cf088a7aa40def9783daf57e5933233bd1956d3d73796953161ad
MD5 374ede55f93fc86dfd003fa8aaf69455
SHA1 1d468259a759b7c6d7a99c7c2254fd4d792fae16
SHA512 0e4dc2933c5f134d1a4a06b50b252473ada88375e1ccd265d385026c67562f8051fad12caa718bf224e8a2988e61b89735afc76f12a75b3fd9d2328cc7c281dd
SSDEEP 24576:CD3FHshBIYQgAq8TO5U1JDOSk05bgv06X/09GYwF:CDVHeBIAAZO5sraR/0e
TLSH
T18875E13DEA9900E4E57AD1BCD6A38606E37178A9032166DB06D4C1B61F6BEE43D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/984-80-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/984-305-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1184-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1184-49-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/1184-43-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/1184-53-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/1184-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2400-57-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2400-273-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2400-58-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2400-64-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2748-70-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2748-76-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2748-290-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2748-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3180-308-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3180-117-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3180-111-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3180-110-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3312-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3312-130-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3312-128-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3312-122-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3312-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3484-91-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3484-85-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3484-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3484-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3484-324-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3484-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3512-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3512-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3512-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3512-138-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3900-104-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3900-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3900-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3900-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3900-309-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4892-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4892-96-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4892-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4892-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4892-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5080-39-0x0000000000400000-0x00000000005E0000-memory.dmp

Download

memory/5080-0-0x0000000000400000-0x00000000005E0000-memory.dmp

Download

memory/5080-8-0x0000000000A50000-0x0000000000AB7000-memory.dmp

Download

memory/5080-1-0x0000000000A50000-0x0000000000AB7000-memory.dmp

Download

memory/5288-83-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5288-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5288-20-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5288-22-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5288-13-0x0000000000810000-0x0000000000870000-memory.dmp

Download