4f529cf663900e15d2cd4afd5fb946e1f11379cc9927ae53347b1a5ab70f6239

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.3MB
Sample261017-e48r6ahv7j
SHA256 4f529cf663900e15d2cd4afd5fb946e1f11379cc9927ae53347b1a5ab70f6239
MD5 e43c287c30de6e1786311d447f2d7f6e
SHA1 c40fefeb43b9921d4717f836f7d8d6f68a19001c
SHA512 6c818d442046331c9f629f9aa4eb7b3666241769433ed8f8a5663206adff82f96f20e3b68d9ea0cdc158a3ea6790f7b4568ae52e8cf8193e68c78cc147d43ad1
SSDEEP 12288:WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:2nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T16B5523A87C88F877DD0B61F19845E1A0333B08605B92869377CB229DCF7939E455B2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5924	elevation_service.exe
2724	elevation_service.exe
4648	maintenanceservice.exe
3704	OSE.EXE
4596	PerceptionSimulationService.exe
2800	perfhost.exe
2092	ReFsDedupSvc.exe
2812	SensorDataService.exe
2396	ssh-agent.exe
5920	AgentService.exe
4116	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a6f4d47fc17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaws.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 48 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096068057f05ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b78a896f05ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000663afc58f05ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049dc6656f05ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
5924	elevation_service.exe
5924	elevation_service.exe
5924	elevation_service.exe
5924	elevation_service.exe
5924	elevation_service.exe
5924	elevation_service.exe
5924	elevation_service.exe
2724	elevation_service.exe
2724	elevation_service.exe
2724	elevation_service.exe
2724	elevation_service.exe
2724	elevation_service.exe
2724	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeAssignPrimaryTokenPrivilege	5920	AgentService.exe
Token: 33	4116	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4116	SearchIndexer.exe
Token: SeBackupPrivilege	2092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2092	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4740	2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeDebugPrivilege	5924	elevation_service.exe
Token: SeDebugPrivilege	2724	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 2428	4116	SearchIndexer.exe	101
PID 4116 wrote to memory of 4928	4116	SearchIndexer.exe	102
PID 4116 wrote to memory of 4372	4116	SearchIndexer.exe	103
PID 4116 wrote to memory of 4144	4116	SearchIndexer.exe	104
PID 4116 wrote to memory of 1112	4116	SearchIndexer.exe	106
PID 4116 wrote to memory of 1924	4116	SearchIndexer.exe	107
PID 4116 wrote to memory of 4944	4116	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_e43c287c30de6e1786311d447f2d7f6e_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4648

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3704

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4596

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2800

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2812

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2396

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2428
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4144
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1112
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 173c2656787229669edd6fb69f7814c29eed62206d881ea4e88ef6033b1d793e
MD5 1fa0f081309397e55f794e76b7ade91e
SHA1 526afa17379c7f1ab67871cf10e318a1c92f65b5
SHA512 8736406cf06c9408703386e54154db162438c97bc90c17a2e2e86725bdea3653aa216e09241da50a56c4462372c1a6d201cbc79bc8263609f264a42bf8ee332f
SSDEEP 49152:3b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnrQ/lFTjN4:l3q6HjB7Lm
TLSH
T126D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 89744da182a11c215b05840f630efb0154179b73253337dc15998c61ff4f989b
MD5 0219ff92cc677f2fb37e8643bd43da93
SHA1 015a915f1afc5d2f9c17c520df47738b93c6c113
SHA512 3683d9a2017cb8499912475ad3a31985879238ae1560bafb3b6c3cf3c51946344a9028c20da8eb9ea7efaf3bf51a733834671cdd5125ee17049948626f347ed6
SSDEEP 12288:h1XLsswWkxy2lRq2czAMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:PXYfDtczAMnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T15F65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c811e6ad00e1fcea8c229effefa4099f72fb562590efba1bea8783d8abc4205d
MD5 3b9a07c70f0a81de9c4f15263a0fc1a8
SHA1 c0d3a67cee9740fc313e6b4feb426046526fb669
SHA512 ca72ef913fe2646cd8dd0ad1c8b175c51691c981112b4a3825d901b79bb622c155361647441dc33552acb1aa7f410f0c9261f5a52a25582ca47ef29352428364
SSDEEP 24576:N0Le5ji0hmxLrMDnQ/tbw/2Mkjy6Fr7g0oq:NPji0AlSQ/lFTjN4
TLSH
T1C1859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bd3caf30c93ab9ca642c19716f9925ff55600bb3d5c32bb6665bfd39d55f9a14
MD5 64be4068de8fe84c6c6d8a1fea5c4214
SHA1 3e16f40577399406e5f2e65aacd750ccd44e5267
SHA512 e7582a4ca42a11e971aad5c4535c741a23af7f85243eb68c8053281db24f5385ca688ba1cca6437b5b76891c8b7f6fde0ffdf57c5803b0907594065980f9da59
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyudnQ/tbw/2Mkjy6Fr7g0oz:W/ezSC6vUzPvxHjy2Q/lFTjN4
TLSH
T1E4755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d1b88cedc090102020163ce0d080ffe73bc7e3718c81defc74ae3a4c6a960635
MD5 ad2150aa193ebaa6b059cbba6cf299a4
SHA1 80e0c7b6d74d1e7da79cfbc744fb03d67758a564
SHA512 7ac5955e5848b921cd7809cc21b0dafcd6221fe48f45226ab0b3e00da10363c07f6971e16fc727066cd039916f39264a8c0789ef4871bf296b61f2c6b4208834
SSDEEP 24576:xVbqPb88hv/l+6InQ/tbw/2Mkjy6Fr7g0o8:xVO88hXl+HQ/lFTjN4
TLSH
T102559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1de27a88a5f2d9191f0321097dfe46d8e9ec1e1a2593428f862b4af03d6173a0
MD5 c6dd9e3808514c418842213c838b15dd
SHA1 aba5729e9553c8af7be5e3d88afa6ac648f9245b
SHA512 84ddabfb6c319b65943e00f56be7402e86665e6c0a1f31cdb589993681739696f839433f2e2bf94d9ca192882f47c5d1f04f17ad410fa6eca8545e761d390f5c
SSDEEP 12288:TzPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:TzvnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1965523796A24F887FF2B06B15CC284826B3B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 79475c189fe6a064d7eb9b38dee248b41ee5edf54322d9c27b12124ef19db06f
MD5 1234318364b5cf383f3e574d3ef9f571
SHA1 756732839462e847773fe9422cbcad68ab54ba51
SHA512 5baddcfe348c4356a15da7109a26892a57e71adb96b8cc27b38d14374b38134a3fdc34288c8d904dcffe159a4125be678338166458f4a9bcf6670360224f1dd9
SSDEEP 12288:teBNUbTVO86UgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:tJIUAnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T12575CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 660a990d9df98f29a033ea616fce776fe7faae04ef75f609f2bdee64709a6ce3
MD5 2294c002913233f4e6b9ce478ec34064
SHA1 9261f97e3f3a35b3d2c1742a561bdd9974f19b6f
SHA512 ef4b6da6e481b23d050c4028440b7031636bdfbceb61c19dfcff1890d0eeaccccbe717b769f9b0655eaab0d7b46ddae76c2b3cc7dc0ab1040b570570b80e93ce
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THu:aQvGAdlCEL8c/yRNw5CCLm
TLSH
T169267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 085423b1efbcc3eda5e61bba8a667df6290219b33cdf3a9c7969c913f0b90f26
MD5 cabe176934690bc6d5507efffe30eaa4
SHA1 3ab1c4b7db6a1e345ed005e8c32d6cb98db2d007
SHA512 637dbf35033c41805898980b5f6c86068c4fa2672868a43b8f393ec993bdfafe7938e7bd7adc39c1b339810ea1d432cf1a7f3c7005ae17a3513a891359cc47c0
SSDEEP 12288:2AwSfxL/2Dc39DLLmt0LDQewsAjCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgH:LQewsAjCnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T13075E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A88A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 30688b26f517176eabb67be42a5986eb1991b36313c6028cad3ab422b8f932af
MD5 9850d4d425d8483c1c729407b0f960af
SHA1 6f9b88377e0f770f8db2d424cbe07aa1d3ca77b2
SHA512 aca5455375706bacd4609b0076d6fa0afa83425746db87b022f5409abbd664d06b84047c714a6730e45fd1b67928e5f9d3db4e4a3e4ff2d7f45331107d2867f5
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHlL:4UEtQevvqc2W1cpV2EI32
TLSH
T13C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 13c8716846f9202f4e3b50c1ac8aabee284c3f9bbbe1ae1fc327e4c829a7278a
MD5 e848586984411f7ca3eb46c1daa10382
SHA1 3179f4bda562299ca95f8c64cde917ed7adb584a
SHA512 bb13f0fde1f646458656ceffed419c9d2cc2e6a61cc50d9be6af9a370b5d79c885dd9ee67959a1d4813f5b0817ba938a717f127d677166aa76b410ab720e86e7
SSDEEP 49152:FCbRquA/m2yL5zQfFiV+XenmE3/ziQ/lFTjN4:SoqtVjnmWLm
TLSH
T1E3D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 49bf824b013739bc3ed393d46714d12ba9fc8e24062d78954b3e3f459b4b6be8
MD5 379a2183cb127e42f31c7c6a5250ff96
SHA1 49aa6b2b0ad520a01dd899a3decbe279c6fb29c1
SHA512 e7d8c20c5ce34c4a6ac9ef00886eb23a518155d20792c397e595b024a370d3e0db44d4e846d79f2a885a048408a4112d686e49d4e0ee913d27e720759377ed7b
SSDEEP 24576:gAhGLJIFoiwtA5l7S53RnQ/tbw/2Mkjy6Fr7g0od:gAMyFoiq5hQ/lFTjN4
TLSH
T16E35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2f08e944259b3f9dc82542083df959380f0f836e403cc06c5b9cef6c242e35db
MD5 0bc9f1f9c515162129e95f47e86e55c0
SHA1 e43264e54ecbbe1ef3933d67634ab0f69fa9ba98
SHA512 13f8a5c24764a6394ac6a1a1745ec52ea19aacdd15853d7c49fd138f510c05d6392cf3d179a876a8c64ef194dde5d68914d2bb68ca8bc9e003fbb5a5e758600e
SSDEEP 12288:Lmw5HEjsChN2BFgl0WDm+CdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMn:KwuHOWWnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1EC65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e2450d92bdd091afa443b90dbac202e1171210bcd7aa84cb7defaa0cca8c79e8
MD5 8e4619f3648820053b52816d59784f7d
SHA1 e4a84f6e9f24281b67b18af28390d4586cb461b8
SHA512 c4efe1da2f91247c17f1c79472eca544e8eedd28c325c1d2234b8307aee47e6d87b12b313dc9884c740f12d3dd1c9dd0c0778db5435bdf3163614821c8a9c1af
SSDEEP 12288:DXZ1IyyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:bZubnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T11A55126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b13a085812bcad5fe02651c679efc026f94f656774b06d9e29f96d2ee60176ed
MD5 c006ac7c4c7c9ad78431a403a908ef97
SHA1 0f65e2546567f6e14ef2c7c834bd9a05408ada9d
SHA512 eed2ec552ef8860b55b08d3826b7e394e94301cdcac111be5404468a4b57e50dd4b567348fee0b935724955504b4b84786d71a9e4b1043aa121cffdb967a3d80
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:oQRQyi36YOcPQLvw2gAf+PN3XLm
TLSH
T1D6666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3d1018d61c60be5e0d94cba34758e0a67eb42aa75558f6a4082538a52e4f6494
MD5 af8fa74b8da280ef04db21c3b49ecfdc
SHA1 2a79bda93220539aeada8441473fa8448a74badf
SHA512 e7f0b267f95eccd474bf7b13303d4359bf81b512bd7dc37abd9a544e30f8045b08e5a92cb29901033e875296f57822f378b174feb5881a6871b375fc87a9c5f0
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:ZQRQyi36YOcPQLvw2gAf+PN3XLm
TLSH
T145666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fe32aab3a7608a59cbee1accdc5f8449c4ba3dffc58f1de3744794e4fae3650a
MD5 22e2f7fe104c257dd2629d360640bc39
SHA1 28342917529079200fcdafd486f8ef0b439a0add
SHA512 2db514a288133eaa78465c4f67818ae69f77c660d59f79cd6f19a65a2b7efdb7c2ccd91ad240c45e38a98643e4d1a75c9963e474b7340b8218f12e6b30e30736
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0rnQ/tbw/2Mkjy6G:m68Qg55nhheWu7PNU3/SQ/lFTjN4
TLSH
T11AB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4bbfa3e00c5478776adfb3b4780924bf5ea640a3b7d28653ac1f1872e76f2169
MD5 4bf638a44ba70c2ec0ddc1ce8cc30152
SHA1 cc93fecff8caf1f2bf6c3016da29ce01d925cd83
SHA512 46db37e9cd2ef75d15a23a9486a64b52e26fbc254d01e1d11d135a748a4cf697bf5205ebafaf578fb522c7cb0b18fac46e065b1b2ac33277cf09beb18f64fba1
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Q:gy5112gYy5azzVvL69nLKnhZkLm
TLSH
T105167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c30f9fa1fec9145d6fbd900f6093c2bb84db8b4cfaed89f73f8463117cee873a
MD5 661c72d1646594f39403b9ea5e86e19d
SHA1 9416a325330c605df51d73a325291615cf42b4d3
SHA512 1a7dc1ea64cd3273b57d31542a234e4122c9d91222ba8928f077e9fd2f56657fde63a9dec3a429371bdef1a3fc9c7dacf58663ab58a340218691167656e1d199
SSDEEP 49152:EB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glcQ/lFTjN4:eu6JmVxd2d/Lm
TLSH
T15CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bcc7498dfa93b2e149bd0f9c0bf5eae42ab95f26c1d1b42009fa4b9a53168592
MD5 662f672279204f54c0cefb3a6319edf4
SHA1 d59a314404bf799119f2de43d01d52f6e048c184
SHA512 b44603197625439e9df344d6f880036c5f07c90379b0b8585327c4f8cb709b58ac50ffcaa98587db358d595cdf19f28a0248d2990ea9b167ca311be086dded16
SSDEEP 49152:F1hpsNoJpF1A6UU44CwH7R4xgQ/lFTjN4:FmifPbRWLm
TLSH
T19AB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5a869d3c83c6c1349445f35fbf02740efe86c198752c5a33275864ac4125f279
MD5 386ffdcf11623b0b156340f649e987b4
SHA1 49c730d9eb182d792fd1afe5ed4847301f34cb66
SHA512 a4b87bda16e8506e160a00f2fc0f2d0b95f23c059c51a011a811b518dcc1e20a3569f9862dcc3b254e588b6d18576316baea09581be369838dfa63fba4517924
SSDEEP 49152:CSuZQIY0Be2KRRVtOnks6NMHqbQ/lFTjN4:c5dKTi61QLm
TLSH
T12BC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8225064b78265817974506865fbe0af480eb98614207ae3c9bfaf63ebbd2c1b2
MD5 449ae0447f5aab53c9c0ec5af523845a
SHA1 9988a7f160f958f9c9517730e5f1aad806a4f9e6
SHA512 d98dc70554ce56688e49c0424de539954fa650917c2ee412d8efa8ff6946e94c6f66bfdf0f014a754b985cabece45125d473803a3ad55f0818cd4c8d3d9e956d
SSDEEP 49152:JhtSn8EApI0figngiDn0AP5wMQ/lFTjN4:4X2iyphaLm
TLSH
T1B095BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fa7baa5c92b29c80653f5aca21e90a09ede212397ac18c5452a5ec8ec22bceed
MD5 3aafd314843eb7e3dca96b7d65a752c8
SHA1 6e995e4526b05f8220d7451afbac26360d802c70
SHA512 c4bbb777560ea15b432fc0ceb87c7110835508beb3138486ed3ccb59119efcfe1307bbe0798540561707405d41b9dc2555bef396f4b619842d48428c71768d66
SSDEEP 12288:2nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:2HnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1C45523697964F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ca87ff0f195d0bc4c837a95846e967dd02c490b6979cef10c4df3f685dd268ec
MD5 e650dbaec1e1500798f756f03660c2cc
SHA1 b3932ab5d93dc58c452b596ed3b2f5cd6d0fedf1
SHA512 9c673bd6d09d47e6bc72d45b9a5c25336c4b29130e23c9dcf88d605040f12645de6ea9a362110a63894b26975fedc89c939238e2cb25c0416e0961efd55d750f
SSDEEP 12288:A+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:A+nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1C15523797965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 61e72a6c05539a4ef696f9496334ce7d70fe2c9eb7af1f9a73e3da14ca8f027c
MD5 1dc8f243a3781ef029619a2649d80678
SHA1 f13c80f17fabee7160629a3873a2e41296b2d901
SHA512 269785e954bbb77ca4c1b9fdaeeaec51bb6eadba6ae9d94bc2e4409d37278e1204a2c7581b32e8799b973ddebf57155538459324e707dc72a72564517c155047
SSDEEP 12288:oYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:oYnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1005523797965F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 84506be174c29390ccd23a9774cb8485b79610cfe2ff3a31f57d935f9f8d6119
MD5 a023a92ba30eddfd0477894d8ab4dd53
SHA1 cece427faa602c757907c0fd4326067a036eb05b
SHA512 d40292f7f87700ad4f961eacdb447e14a3450cb998bd59b312dbd37692855f63f764218aaff0ea56e0e4cedee28b3203d60f244df8c1393692d0497b4b986015
SSDEEP 12288:jVhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:DnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1BD5523693A69F4C7F92742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c92b0b4b174a6704a0cba3b6523f9fdf8858908e1cadf8557b6a991c1dbbe3d5
MD5 69ff9aaba0e643f9f3f827c22842b31f
SHA1 9e93a7cb741ca478917f889838d6c4c75408e884
SHA512 361ad3f6e3e560244ebf409a53976d980412a0a5fbec3a213c438f2d30ca8eec06d1f0beb9e51c8dc8bd56549b06417654a62cb30a8534ff2ac9867895e4eed4
SSDEEP 12288:+JGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:+ZnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T10D5523697965F98BFA1706F14C8381829B3F0EC6BFD1A38F77482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a1cc9efd54dd4fbe5831b63e452981eb9285b2c2fba47fe2ae539e82600644f8
MD5 f979ad9efe2f50e853adfa48b5f2466c
SHA1 980ae4db1e2be874292e88da5570b1bd467f0bd2
SHA512 515c62ca0dd02f4c17263b7a5933e0eef08074c6b67a6b022147673e5017305604088cf6750c10d92c540a667075faeb50a63a055f6660fe680deec5076f41b2
SSDEEP 12288:RaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:RanQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1ED5523797964F98BFB1706F14C828186973B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ea3459090e891894323516b4ce16eb84af3e3bfc4925c2eb7211552662850bd4
MD5 b5cfe6ca11c68eba40eb91d107054a70
SHA1 9f6c4d4b6adf25de5fa1a13b4a5d043ff6376755
SHA512 af8dde4fc5fdc58752797bef22d2c834a6c729744293062169e4cb6ac09dd706824f330fb30833385e50695c6100afed5d003d33413a6f84a997f06c4da13d3c
SSDEEP 12288:HGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:HmnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1405523797964F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 4eb5c073f68cbd404ad8321d99dfd10b88ed2dae9f7c199c3cb0a2eed30057d3
MD5 01784bc5cf6a682d069231bdb7446d13
SHA1 2a8954236f880ed2bbd7896430d0a6b071e2aadc
SHA512 1a117579a36ec4bf7b2049581306cef2eb25722f322f4d07a689dd805086729a805020764e72020c8bdeeabc6abda05a3601de18cf62c2ac9f9e41e84123a944
SSDEEP 12288:ciZwbDzzFEoS2cPvyeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:/ZM3zFVSOenQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T18D7501A5B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1a2a8b6b9733c2c950e57bf8cbd119bba8a254d574a6b4d712e4a38997078ab4
MD5 b146cd4cfb225abf4221d70e5ae43098
SHA1 0a4b7219977a043845b719c6b4c6c66d2699a357
SHA512 e3db843d2b26d977f6ff4786a71bfaad1bb0f1b1a77fd2dcef32359b15cb8fed38e8114467e6905495c4aea4882b20a883c2e3562637bb46e96d0773116fe77a
SSDEEP 12288:+bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:+LnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1D35523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b93380aa3f62ef2da3ebf1a9b1c57341ab861522399fb3951adf1e66d9a3a331
MD5 ee824389337aab853516e2698a8efc92
SHA1 d091f1b54f9ec157713c91e65d8f4d9fe82b5ee1
SHA512 c01524ca99fde88b7b55cb1277a639acbcd140b748e6f334d989471d9d2f7cdd86aedc593cc1125da5ecb367ac72b7d576a418a903174c8fe53e108692ea62c7
SSDEEP 12288:R/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:RfnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1495523697964F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 91faa51d695daef2102394d96c3429d9aef50df43ba30a4727503a680c8b3fc6
MD5 d74200ac9f5d7faf6802c8e13209365a
SHA1 84c8cb9dc78abe7695c0654c2e6811ff5d34b814
SHA512 e4e82e16103d0066b804e8d008a7645acb786e0ca45bfbc15983f42963ec01021b2c31897d8a33767f87ad561c231cbab294c22f7669182a74e5e5e2851c021c
SSDEEP 12288:dyPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:UzyynQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1EB65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 27fa79445702bc30fd7914de73a3ae0f603c08d702b1437d85e324cee8b231a2
MD5 f18f1389b20c6276286aaccd8ce8de05
SHA1 a6f79019b3f27d129887f2d862a860c68c118627
SHA512 da57c9dcbe0c65fecea901e1418f329a94035eb84f8c0a120b634461ff80485aa71da3a172c0d39b9af3ed2693bbaf98cb1c6efac877153bedb542fd912bee93
SSDEEP 12288:4bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:4LnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T19B5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fcbd26583cf4fd453e27a5839075d7db20c0607f6d66509757b8eff9f8b75994
MD5 f0fff5d9fefa12d927ce6882850434f3
SHA1 4c884a2fcc588d7d1737271fe21b1e6d41da53bd
SHA512 84483a155f6249c2ca8ad216aa65de8d27b7562f86b3aaeec20a3809b2d7ad3f24bc03dbc985f4ad175d0cde4c9e5065fdb6ac271854bbe175ab9b0e4991165d
SSDEEP 12288:MbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:MLnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1BB5523697964F98BFA1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 e4e50f00c42b4568e959b99cf3df655944150cdc29e78def7471f6bdf7f9e6f0
MD5 b024723c67c0ce4a5eca07a47f970582
SHA1 768431c926c62edfaeffd92051121d1a8b1f5fee
SHA512 59c86fd009139db3ba5a4b960589960aa5e8cc6f055aa35afffe310068f0c1487293e27e10f181fef6cc674fe2778f436af41bd380bb9ca8e0cb21adfbbfd78b
SSDEEP 12288:LyPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:mzyynQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1FC65021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 9a7abaeddf6215767d096d7188bbcf84186de784e95b5989785b931692e6ac25
MD5 a392731cc54bdc642d33104f734f31f5
SHA1 bbce189112620232e051214f3d5f7beca4ac47c9
SHA512 e76be2fe2361c8a998ae151d965a661ae43c08aa22d16663f7c5c6b8255f27565b91e65e812b958b922835c41d5a2b03accd8f1b6ea89d3a95906798a72679ff
SSDEEP 24576:tT0aLl3z0zDonQ/tbw/2Mkjy6Fr7g0ol:tTDLljdQ/lFTjN4
TLSH
T1EB7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 3f0b04cf6125950007dfc401db08d6f985a4f0aa345b51773301106aa8cbf9b9
MD5 a95eb7074b50366f9739977f91fc4ed7
SHA1 0ef22e472d1e5285b5715936b0e4701032cbf7c5
SHA512 7ccf91f353daa10d8232ae6546c9faa82c0cfe46d9e39c288e5c49cfcd54fb0ad4e9ef2d05d51206d9c50e7fd78b874df7e707d2e137d0420e0f87a656a5d2c4
SSDEEP 24576:Y31d9CHKy7GZEnQ/tbw/2Mkjy6Fr7g0o+:i1d9CHKyaKQ/lFTjN4
TLSH
T16485CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d0adc7ce3335da5c93c1f3ab9adef75a51cda09eebeb6203d0e8219b6c2f5200
MD5 4540cc3fd14448783ee9aecc042acec3
SHA1 0d1ac2298537f51ade3c946515eabab088de78bc
SHA512 fb3bd86354e840eacc55c6e0d9cd19c3f1584e085ca25e981c72ce1535c2f3ba5d2e2ba1e02e38ecb47b2166de5b3530550ec6a1652e2d84922d0afcb3a8da08
SSDEEP 12288:b4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:b4nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1EA5523797965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c33268032fa1ae252a874e6621ca31bbb8aca47852197eb3bcad99f43f31cb78
MD5 70b3b06d99ec26bb731a74978aa8a648
SHA1 a88a87afd58a183424ae6ff3255afdc86482c1fa
SHA512 f586b25f061e8a132f6aa41d50cbf922a9b2bc68b30df874936fbdfa2b90bb01022b066fb55858ec36a57c988f1749f05254de5136023e1b7811ec53b20c9869
SSDEEP 12288:BSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:BSnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1A15523787964F99BFA2B06F54C8381829B3F0EC6BFD1938F77481129967D39406C6784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0ce64298662663a902e6cc97e015d23d8faecf39d5598b7fd163eb7d4342a9bb
MD5 4220317595e23afbd3a69799f74661fc
SHA1 38ad807626b65beaece349ff02b32450a6750fb8
SHA512 b482f4698da3eee72a5ca70850c8d7badc9eab285a032be3fd4c21627d7d713801a6a34fdc779844a1eefe870ef76b112953c75dd61d2684ff243976d0273e0b
SSDEEP 12288:UFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:UlnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1975523797964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 434a337c9623499a5df9628f80598f6832d9ab47380a3883c7227b6f89d34650
MD5 ef7ef292b562be2fd960020b063c9810
SHA1 4a57487033a178769e0890e17f9a6b3f70d0d07e
SHA512 87e791fc17868247b701050760e6a7ad811f974ad49958b5533680e518dbbb3468c549cfb03cba57561f06c3bdf4ec404555b7e4fae6d5e68959a9184ea84f6f
SSDEEP 12288:TbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:TLnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1FA5523697964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7ac09caf0b2b32d87277e1a240f6231c703596c359045bc93e42189819892730
MD5 aa608b4a3a2135d97f9f034dcf343551
SHA1 6c225563627f68dbe2580d7481826f79a4be59ed
SHA512 0fd466236ec12e7510f4572104fd8f8334a3e28034ec5ceb705b20ec0faa8b0916c45a7b2b969155440db50eccb4bfab0cdd56744bdae89e723ad78efd56c13b
SSDEEP 12288:s4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:s4nQ/tbw/2Mkjy6Fr7g0og
TLSH
T14C5523797925F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 de43d7e7c91305d29ad9251597d16bdc06de7fd61669af4d4c8ed0d189fcc85a
MD5 dd76bcd55460fe2ebfc155b571ef675a
SHA1 88a1c6486bc6373f6219273e750d9d6c33481ab1
SHA512 f3be3041006393943ea9a154148274428dfedb910fd54c2227d152d1da744434eb8e873eb4e287993a3db9f21f988c68d511e5677c5bba54b0df15fc2988f29f
SSDEEP 12288:DjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:DTnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T10D5523797964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 b0286cd6205d16eccf9b254bec3fd81a0770b66374fc961ab300ed79972a1c3b
MD5 0544e04705733d6b5322dcb8855af703
SHA1 bdd29521e9e7b11ab05e3d8c870c1ac795a4af6c
SHA512 a69b0e975a90577b4029b95b0d3283daa9c9bf7f11f55325666704d550133e40a8c639cf433d352859a17a3e86c1b285d4704c7589d08fcf59ca1568d2538fa3
SSDEEP 12288:nJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:nZnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1765523697965F98BFA1706F14C8381829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 ea4e0432d7397a6fb2665b2f150243b9b83176ac9a8b2771ee356cce7843b53a
MD5 055a883f132abaa0d72d71063dfb2cc5
SHA1 ead34d5344a567657a70490856ce49715309ecab
SHA512 32c46816d1908f15bcfad1f2503c80ac3e7dddbf92915da6b6ea7877a3a4c04d30191529ff3dd115e579162f2dcc576fa0d81fd816bd60e7dcb31bd48534eb29
SSDEEP 12288:yQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:ywnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1845523797964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 ce8a447139b755bca6697870316f8544c97f311564325050a761412319ecf7b0
MD5 fa841ce56f740676e978e03b5a207d5c
SHA1 cc481d8ef60460b5f196bcc31c75dbfdc5b3f883
SHA512 d2fcb6c065911f82ac1476798571b4bc2c1f4329d51cf6bd87048f7d030c2686a34a220acddc5a43872e395578bfeacca1fea7875f18266ed8bedc5cffba58d0
SSDEEP 24576:qfwv/k9RX6wkyAIPnQ/tbw/2Mkjy6Fr7g0oe:BMnYIPQ/lFTjN4
TLSH
T16385DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a449b9f0a5f64961668c77f252c890742d32065700af26a2e4e97f76105a9922
MD5 b7eeba5c3d8e5e25ee7124b5b5c4b091
SHA1 bd277396f5935130ec447de5ca06424f26696348
SHA512 d6c521805376631025d6d703c207fffd542aa6e872c529f69c1a5ee40764630c89d20514976fbc606f77efddabdf346c23a0a784047636978a6a3fea8d5b7233
SSDEEP 49152:+YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0sQ/lFTjN4:wySzP3Lm
TLSH
T148066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ecd9e64fa97c1bcc4e675590833d36081f231d12a22a017822c4ec664ed1970d
MD5 c410919ac9f31b874044170fc1db9591
SHA1 f60bed6952e275b194c906e710a774fdfd694906
SHA512 b064b949908db872b42247c8c92003b7fc554b4aa3a267df43aca8364cbd72eb846aab5de886e687966906546448f0ef6c6c940b293cf2da6148bfcbf1572baa
SSDEEP 24576:l47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYOnQ/tbw/2Mkjy6Fr7g0oa:l47JUQj1irIhCnDHUPfF/cQ/lFTjN4
TLSH
T1E965AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c15e346606cc5ed0ef3803d14b887ba341d2134ecc677e7db03ca042b73ba64a
MD5 91f8721ba4f1ba3a15223ab8086b6d67
SHA1 c0f217f491422de056b17f21421be30e114eff14
SHA512 431a13e0a88e5efbcb003f1ac4b86e1c5368ad12ee2adb5e8281aeb7df73f20581fb11f57fb0c737bf7a7b4b64912cc4d6b2894911bb3606ba9ecd6422d2e06a
SSDEEP 12288:kssfrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:KbnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1C965F119E29852E9D02E5275CB824641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 ed44cdc0e9ceeba949f236206d81b8611d194070322c56a2d2a6fbee4ce6ac28
MD5 fb1b445d9cb5aa0886c8330ca23b24f5
SHA1 111d6e2a6000095e47aa802ca9314901e907ec89
SHA512 479056b34fdb71ccbde6f13bc4753f1db22b3d19b02ebafb40721cb4a63d50af4be9a370871ef8d533669c3af73d11d581734e499890935474bd99b89dc11e0f
SSDEEP 12288:HI3CiU3fDCIRakAxrYmXtMkS7sWVZHd0e7c1h6AwSCsz3X3nFBzuzB0:o3JUPWka0kPkj3ovSSCsLXVByzB0
TLSH
T1E6451800766ACB4FC66D80321E33D5CCAB707D51EE046F0773C98B3F9576659BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 e325d1ae3c2790a369055f547dd8c5095d0fea454973cf5036129aaedb695391
MD5 cff25581afcc2c7887e5ec6bb7b0f54a
SHA1 cd76919dbbfed08afaf8d90962de19f2429f5447
SHA512 2ea5eee8c9065b0c13884a6ff0da08091ad531a87fed4db68b370eb0f4d49da38d7093008c34e9e32d0a07f7eae4b6fad75b493e08d9764f5464deec4bfc61de
SSDEEP 24576:fcgGx6cJsZqVf+W1Yjcrs3rjcSQzOQs3LjczQzCCofTW0:SYjcrs3rjcSQzOQs3LjczQzCpq0
TLSH
T10475FA40653AE78FC1B65032073A5B8CBB64AC17B7056F2673C9457AD86BB05B0FA3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a242c5556aca702544c19e02c1b4725161fbaa5a285610a51c394b5e4bb0d65e
MD5 7e849c8f0bad0a4982db0a7b31cbb233
SHA1 0b9767389ee0bafeaa4c2f647f5193cdd4544d95
SHA512 470638fd7890078ee4a18165b559ccac6acba5ae24a3364d22a24c5ce9f699e078c16db4c3fd0e95333c5cde4bb75ef0e3bf82335cad15278c4fbb3a34d0f1d1
SSDEEP 12288:w67zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:bjnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1015523796668F94BFA3B06B058928111673F0EC5AF90D3CFBB082229957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 96255c472a33d6ea4651e173a48c9c4e8edfa757f7747ebdfe82927b8d5cf4ee
MD5 75149beedb24c1b8633cc64140859cc2
SHA1 0753326d5f60332b16a88fc1302966e1c7be1526
SHA512 f1e426df48cf318d681eded08ec64f90825b3a84b9b2be18931df94e01a97ef0d49d76c9bbe1506a45da142d7e9e289a085f6177c0fae11d6e18ca5501aeef8d
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYdnQ/tbw/2Mkjy6Fr7g0o4:Igb4mBIBhGFOQ/lFTjN4
TLSH
T14E65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 fc47e81c2c88384092d0c06d2a24d3ff9ace73101114cf93e1986d35f1dd483b
MD5 453fb69992fd6610897c459b0cb3c706
SHA1 b270fe04076e0d4305f1081c463aead22e079741
SHA512 ef1847aa3813b7ddc299d7d7dfc858bbfa36a6b68c1ae47c2265f5fcba20e16139414075c8226d198a31942f58cadf4472351a47bd3996c922bb6903cde9f992
SSDEEP 24576:7G88u8FpJqH1Qzria7/menQ/tbw/2Mkjy6Fr7g0oq:a7ZFPqVva7/FQ/lFTjN4
TLSH
T19585F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 e3572c9ea0e60346b3fc55068051a7fe2062d011a6d8b9bb8d6215eb0b00507a
MD5 4ca1ee2577615043dea8926d7f5731e6
SHA1 d73f9a3d37d989761b93e126c2b3778804bd165f
SHA512 d746bbc47db3e164835822ca0bd47b976bbac9075b75f77aa1bebf6ca2280d2ae53241e6241f7575ef5f971992ac10294dbd6b78ec91716ba6937027c6d15a1c
SSDEEP 12288:8HvUrBFrEjwaQKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:8PUr+NQKnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T12D65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f483172f59d8e8035e6d7811e74776d5d1a68fbe37740d3a3c3853d061322e5a
MD5 8bb330e6cb65556d79d7f2ce1043266b
SHA1 483416ede9eb90575e4545507a4a5c2028a8e1d3
SHA512 3ba36446aa9b299613c739ba303b00f6b070c356d0594365ab492f03e1cc304d2bab697a6bb13e9b38b572ad1631e2f9d9a6b5e77d60d6035dab4121992b83d6
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaQ/lFTjN4:XG05lO43bcLm
TLSH
T109D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 06bb45d9f4f8500c01b0762b47487a5ff2aa21b86f3f195eb7a055c62f408771
MD5 8a29d75156392ac6174e5a47144bce07
SHA1 1cbfb6df7724109a6a8b3a87fe84c25aaf4c2135
SHA512 32c5767733a2b3c7538ced03dc0e90ddf7382a54d8a97b97de57be815f062c77de93fd706372cf4edf064933520ed729889a5d92c0607754428a65f1de128989
SSDEEP 24576:wfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnsnQ/tbw/2Mkjy6Fr7g0o3:Ia5POZ3+Jt2pasx2+mSQ/lFTjN4
TLSH
T19F65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cb255eff447a9ee0367e72082dfceab23c622da456bb556a89221fedf4df5e72
MD5 cacbe73727c71a197c043539caab0cfe
SHA1 fff148e3ed5533f84ce735e46165e7d22f42f689
SHA512 ff435922c1e810c13308b39430c3e0178fd8f8a641fb8c5710142bf5cdae7f485e92f108f2c126cc8ca34deb88fe41b8a7a834a0f11b146a9ad04b9f6d11d9dc
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7Fk2nQ/tbw/2Mkjy6Fr7g0oX:GNc/zEOVHFlQ/lFTjN4
TLSH
T167858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9e81ae8ddb8d14298be65dbf7e75b310f9037617d203680cb17267d14dbca8b1
MD5 44effcb0fd1a99c255e732c05c3286ef
SHA1 aedadd61e54726cace3b9903b535abca7a24197a
SHA512 7c8f91b753030458ee59d32a900690dc162f6731da68297d11ecc30569b3ba1b60bd62379cf48e35b1ff27c5569da0b6fcc0e0a5a5d65c96480e839b0a723045
SSDEEP 24576:s8kNvNnaFeYhJNtmZBmwnQ/tbw/2Mkjy6Fr7g0oo:s8MwBtOmwQ/lFTjN4
TLSH
T14B55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 848f0eaf77c940de26962f66f951326e8b06bb5519acb7a3138dde883f3c3cb9
MD5 1fc9083d4f7eb118e46e31af5212a186
SHA1 d98c6df5641eff9ad53dc5572af4e4969d0472e0
SHA512 b6c38b26bbe9dd1f9568f00d1098e3c61a6e6f88c49a8880621d34324644087b84429cb49147a053559ab39a807b20a19147c14a67cf537bc3c15a037fde3a50
SSDEEP 24576:LD3FHshBIYQgAnnQ/tbw/2Mkjy6Fr7g0o5:LDVHeBIAAnQ/lFTjN4
TLSH
T1B875E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2092-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2092-90-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2092-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2092-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2092-96-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2092-383-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2396-122-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2396-115-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2396-116-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2396-312-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2724-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2724-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2724-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2724-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2724-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2800-79-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/2800-295-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2800-78-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2800-84-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/2812-108-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2812-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2812-313-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2812-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2812-103-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2812-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3704-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3704-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3704-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3704-240-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4116-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4116-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4116-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4116-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4596-73-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4596-280-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4596-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4596-67-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4648-50-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/4648-47-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/4648-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4648-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4648-39-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/4740-77-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/4740-2-0x0000000000D90000-0x0000000000DF6000-memory.dmp

Download

memory/4740-6-0x0000000000D90000-0x0000000000DF6000-memory.dmp

Download

memory/4740-0-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/4740-7-0x0000000000D90000-0x0000000000DF6000-memory.dmp

Download

memory/4740-330-0x0000000000400000-0x000000000054E000-memory.dmp

Download

memory/5920-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5920-133-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5920-135-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5920-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5924-22-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5924-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5924-13-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5924-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download