8fb2b373fc470080ec0c59cf36ee238f4b2017ea79448a63b0171073e33ca861

Analysis

max time kernel
148s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
Size 1.4MB
Sample261027-jscykact9k
SHA256 8fb2b373fc470080ec0c59cf36ee238f4b2017ea79448a63b0171073e33ca861
MD5 be87471db4fbb8770fe7d5e1566594c5
SHA1 bdda7df1fee13a840c0fef30bedad222da3aba06
SHA512 cb1c5f8b29bab275026922b791c01bcb7186d71e42bef918d38bbcb90dd7f55d7c9c65237db01a3139f3f4249a97fbb2c33b62de3238990ed6e86ff9cb6cdc9b
SSDEEP 24576:0ZsqjnhMgeiCl7G0nehbGZpbD8l8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:0dDmg27RnWGjeJZHUmUYyH0UbETQK1
TLSH
T1426523F87108D176D42655B25798D1A69C027D7A06340D63FB53BBFBBF318A4C22E227
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
5436	elevation_service.exe
5696	elevation_service.exe
4392	OSE.EXE
2856	PerceptionSimulationService.exe
2748	perfhost.exe
5036	ReFsDedupSvc.exe
4824	SensorDataService.exe
5832	ssh-agent.exe
5016	AgentService.exe
5108	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2a3a6bb131e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/912-0-0x0000000000400000-0x00000000007FE000-memory.dmp	upx
behavioral2/memory/912-54-0x0000000000400000-0x00000000007FE000-memory.dmp	upx
behavioral2/files/0x0001000000009442-61.dat	upx
behavioral2/files/0x0001000000009952-62.dat	upx
behavioral2/memory/912-77-0x0000000000400000-0x00000000007FE000-memory.dmp	upx
behavioral2/files/0x00010000000093ac-60.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	912	WerFault.exe	89

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f771e6d8e865dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000329be0d8e865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007cf2f297e865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb884c96e865dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd459a97e865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5436	elevation_service.exe
5436	elevation_service.exe
5436	elevation_service.exe
5436	elevation_service.exe
5436	elevation_service.exe
5436	elevation_service.exe
5436	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe
5696	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	912	2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	5436	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5016	AgentService.exe
Token: SeBackupPrivilege	5036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5036	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5036	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5036	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5036	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5036	ReFsDedupSvc.exe
Token: 33	5108	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeDebugPrivilege	5436	elevation_service.exe
Token: SeDebugPrivilege	5696	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4420	5108	SearchIndexer.exe	103
PID 5108 wrote to memory of 4680	5108	SearchIndexer.exe	104
PID 5108 wrote to memory of 5408	5108	SearchIndexer.exe	105
PID 5108 wrote to memory of 5396	5108	SearchIndexer.exe	106
PID 5108 wrote to memory of 5996	5108	SearchIndexer.exe	108
PID 5108 wrote to memory of 2320	5108	SearchIndexer.exe	109
PID 5108 wrote to memory of 712	5108	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_be87471db4fbb8770fe7d5e1566594c5_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 716
  2⤵
  - Program crash
  PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 912 -ip 912
1⤵
PID:2980

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5696

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4392

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2856

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2748

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4824

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5832

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5016

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4420
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1b24f9fad71a15e97dbb364fa00537fec91ce44b0b341f095aefe88594b6aaae
MD5 e26994fa7094b04fd8f24faf602412b7
SHA1 07670fa8b0de824fca11c06add246664c8968097
SHA512 dd0c822047e696096f2105927d48f66b7685af3911aaf52e5609f702d16c159b2f1b4c80be268629c68d77c8cb4463231870362318b22f43d5097e9d7ebddc5a
SSDEEP 49152:ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxnEDmg27RnWGj:C3q6sjBvD527BWG
TLSH
T1F5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 12a2dbe2ad20e06c26310507821f7250a36fc6010cc72faf2cd920b8af80f7d9
MD5 e5b4615cb5bd2db4d610785799efbe3a
SHA1 33b53f41e1a97e9f2d6fc6edc14c749c6bb8c3cd
SHA512 24cf7784466f1554d67aa5a087ea364c7403a4b80ffc1b9cae0617c6f44bc941298b32b1c94f0f7bf8ed91bee8ea6b7c5c65c01392e0509bf0daad2fc662c18b
SSDEEP 24576:2XYfDtczA5sqjnhMgeiCl7G0nehbGZpbD:1tccDmg27RnWGj
TLSH
T1AD050128A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b5d88046fbf8322cb4fa1e0ae6b28126be09199a466ff06fd54606d6e3ca5779
MD5 2e7f3315418f0cc962e18781b3b2f8ae
SHA1 ef6a0d386e40152992de05cc2243af423e5f8b70
SHA512 48ff20d500639bc90dfb529fd5d2b82e894ff9c683a79dc279e894fd4b9e3bba7da499267cbc6faa7e6c134e7af85573fe55db918f4d71e475f93afc810b46a1
SSDEEP 24576:t0Le5ji0hmxxrMwsqjnhMgeiCl7G0nehbGZpbD:tPji0AjxDmg27RnWGj
TLSH
T1C8359E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7e43532c2bb8c1b906c48276ce3f02c2d7f4fa80119f8fd978168e0fa53547a0
MD5 ccfbf6f1ee322d63070d2f6fcde25161
SHA1 84e2ab95810e4028fd72cc03d02831181a342b4f
SHA512 e5e64b19fb775f02dd722fc67e17c6f3a2c3bc14dbd90742fe176ee78bb9dfeadff40c1a19c325c8ca331779f19e65c059886ae61e3b66c6479d1ccedcb934cd
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWn6q8wyumsqjnhMgeiCl7G0nehbGZpbD:3/ezSC6vUzPveHjyNDmg27RnWGj
TLSH
T159755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f2be266f8e93e5eac706b2f564fd7ba0efc4dce9b382a9af9f15fc0be9ba9e08
MD5 0724dc7a655a3cea4eeb6dbebbdd3f7e
SHA1 936aac5229c9f6202d565e5b87790eaf3ecbbbc0
SHA512 a85bd9bc425270d8f1769d090ad6945a33e681fff17ffeca9c104af7cb87ff915145eddc55d7bbf1e60dd56a45eaa405fb8917b9942468adaa26e69b2e0e589f
SSDEEP 24576:hVbqPb88hv/l+YHsqjnhMgeiCl7G0nehbGZpbD:hVO88hXl+CDmg27RnWGj
TLSH
T141559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f926c644be6744677995226c728924b8db909ef792cf2bf066e86ac49eaaf1e4
MD5 0b92161afbe6f9d06ed4d9a169e7a0d4
SHA1 2327d0665c7c3a3f13881513dccf6538d07f31c2
SHA512 c0f23d2b55152b7ad2ed72c81b9ea468d5fd0963b361297c5d00307c30649406e21a1c2029db971efa268b690cc23b83b8f91b4bbcf546a475042adf843f3409
SSDEEP 12288:vLEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vLEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CDC423BE824C11CAEA7608B5C3E9F55DAC137D5698200C43AA637DFDE6F5458CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 3157f6dfae44755900102c56bd62b8e36e091fb2a908a008036cf02fa3b9f165
MD5 3d10b9d7878b66e1e3bc650c87e9e917
SHA1 7b54498b2e8ed882df87472c76495b50df6d682a
SHA512 a8163f68231578f73e5957b8cf82534ae45930c0642576f01d6806c8add9fa3b82cb3520bb4a1a10299b02bf4b764914021494d2f48e4df9be63cf1242c327b2
SSDEEP 12288:ReBNUbTVO86U/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:RJIU/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17105CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 59d4cc417e39bb15f8153513856243d033db5345d3280e15742caf34887dae5f
MD5 f5de8eae24a08f3882cdf37b31dd64a3
SHA1 56b150f3b0655e0a1e96b766d7d17de94fac5cff
SHA512 b26ed1cd9bd07ac20dbcce164a8e5e7a4f13db18c4888ce38e14df4b11833cf39563217d9b293792ef02a91d2bbf19481b0b0fe0a8115082ceb5a575c39a63e0
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THi:QQvGAdlCEL8c/DRNw5C6D527BWG
TLSH
T1CE266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 dc01cc6eaa0b64e8e6bb03a45643274dc4b14ac9a8b46f916ad85db71548f46e
MD5 37ca3d179ddc82549d72dc715c8a4bbf
SHA1 5d60d98795633fd4f3dd22fdc421fc187e2be500
SHA512 0f18f032fa91d27bc5940fc4a810b9fb63bf37ce182a8ac7119e389474d004a0b23c59dfd9002ba61f90f976411b0b6e3a1e3e7746ed5de4944cc5e3bfe4cf70
SSDEEP 12288:qAwSfxL/2Dc3RDLLmt0LDQewsAjdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:/0ewsAjdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E15E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 009861273f3ad523cf2f92b04e416bd7322e9faf735e6c7325ef110cd19e43d8
MD5 195931fe775028416ff167097fde0033
SHA1 3651066fbf5d693e3c376d00aae4bb8cd8385d8b
SHA512 b1ce622510fcdcc70f673829b2cc05b8a018700aeae599ce1e90520b0f8bfc784b153837d5074746d065cdb78fbf3022e0a11ea661fb9a4b0442b5fbbf371303
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHZVQBWG:6UEtQevvqc2W1cpV2tI32kB
TLSH
T164474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b70afd8aef53be08b99d11919c92041e3cf923ecd651088190c0d4dc538834fc
MD5 c4badd229282b74feef896357ac224fb
SHA1 2627f919c4466d0e8f9d283a1a153ac51efa8be7
SHA512 2fd0172daef9e10faba830e01600e12e072a89476766f288ba6988279ff07a2743c3d3157cea49011d04154c71277c2ea51fe588c8b2a8cca0ca3d79f3e46e95
SSDEEP 49152:nCbRquA/m2yL5zQfFiV+XenmE3/zhDmg27RnWGj:woqtVjnmWD527BWG
TLSH
T176D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7ebbd0f230a6ad71ff5f64673c779b4a2395b7bbc4e807d2e75f0098cbac32ca
MD5 679b4843ff29d47a1f730c64e79df9d9
SHA1 9d3acd2483db4a197e60933cca436d1a8f056493
SHA512 6f9ec2e711d2cf03cd040d6036bd9378d9ccef73da7512bd6920e3795124ad343b3472fbe1cfc6a9a262ab6c3aa78942a39f807a830139d30beb3c3c9656d8bc
SSDEEP 24576:BAhGL3IFoiwtA5l7S53ysqjnhMgeiCl7G0nehbGZpbD:BAMUFoiq5mDmg27RnWGj
TLSH
T12C359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 6ed18be26b0a8bef0609b8a3ec80f5df180e7d6d493cbc5689d5d71b9ee3f101
MD5 548a7d82d36e21807b067c8db24eb9ec
SHA1 4d01a022ece2dfc9baa15909483055f6da9e6582
SHA512 8a1512624ba5a8682a20874d6f9f64c9b74e0dace1a24f1543e6868d72a0a654d866b039d8b9de8bc2b71cf91a82b1c1c07d977786b44a70e09a2b70fe41be7f
SSDEEP 12288:9mw5HEjsChNVBFgl0WDm+C6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:4wu4OWpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE05F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 0eb20f34eacaa8566c26434f24f062ab3cd36ff59e25e022837f39543ebb0c44
MD5 d1f9864347b33b81294a3b98f5a0f700
SHA1 138d36dc6c5d3b2bd83814f9c2cce952b78c9698
SHA512 28cb0fa0d572798b19c2cb8833a48b4ae755274c1db41348a39fd3be9f0c8fdd390873b88cc303d8c75a40643f8dad0ccba4b2e57358272fb5641c44fe5e9aff
SSDEEP 12288:deZ1IytXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YZuIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EBE412AE239820FAE5634178C6E5D609E7333C62673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fe9cb284dc77b54e75ce53590316c6cf593d7db321be8f41790ac75624bdbf77
MD5 74da5008848c195145562fbeb7a6d25f
SHA1 227fe0689c746d019f2ad81a3d7f1eace34d7b04
SHA512 411358f357be2e8fce70d5576d01c290e4e4210396d004b3e7caf9a3aed1eaf2cade133e1883e944a55e70b536210c53fc192e964034b49defe42acc507c671c
SSDEEP 98304:NQRQyi36YOcPbLvw2gAf+PN3/D527BWG:kQyiKa/X+PNvVQBWG
TLSH
T131667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4f941148177a4bbaf6b9e990c3b5f696b80190ca75ef22b75664212ec8ec1039
MD5 e760900e46fd47567c23f219af593688
SHA1 8bb55b79d5947d707c5665caf49ad6c69107d1f1
SHA512 597f30ec22429c6dab83f71a5141a0c38109aa8e94986000ad26cd2b36470eb1442495a2d6c72ad3c6ca6385c8d9bbcd70198d0e97d0c2753e52e302d254369e
SSDEEP 98304:iQRQyi36YOcPbLvw2gAf+PN3/D527BWG:5QyiKa/X+PNvVQBWG
TLSH
T17D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b5a9a20764aa0df8a4668bfbee8d994a54bf17ca91df9791db66dec104cf5764
MD5 ee03aa1cfe244fba6e8de1c80306fc8d
SHA1 be206d277d3e8a46312c4bd4e96ea9f4c208d925
SHA512 cd6354577fab4c44894f20ed6ec86e4b6730a6c5322da39afa3f029ff6ada4cfb770690f30cb5d4bbd97dd21b179f4b667242297dbe6a2dd3a3c0544206f4703
SSDEEP 24576:BwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL04sqjnhMgeiCl7Ge:N68Qg55nhceWu7PNU3/xDmg27RnWGj
TLSH
T14FB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b289e71a4ebc509f03a63f5fbf27a3db5aed5ffa8722477c9d2a0e8022eb25fa
MD5 80bb810eb8f3d66ac4364a791a862865
SHA1 3954a6df43af8c09c68ecb3ef868e0f9608cd2b9
SHA512 373c71ab35b625e0d898a410f76ebc99a72b1f4c9180666b84f1f51443ebeb8bededd46fefb47064a58d33308df79c22c0c2d9da348a8c353c025f0367963a0b
SSDEEP 98304:Qy5112gYy5azzVvt69nLKnhZgD527BWG:pLIHEWhuVQBWG
TLSH
T1A3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f3396b59a3856aa987c377a8748b307a8d164fa450a793cea985ea8cc298e1ba
MD5 46a438b47f41e6fce211a36d67f5e830
SHA1 ae38addd44049c1cf0ae1a8b7fce571a9a1a21a0
SHA512 3c8eb2bf3f766b5ebafd638b136018c501fd36adbb8d6a0c9ebcc685fa45727937b215502becfd7104fb793090cd7edf53f8966a4402a026be1aa7ae62755819
SSDEEP 49152:WB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glbDmg27RnWGj:ku6Jmdxd2dbD527BWG
TLSH
T13BD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1dfbeb2d2128840e83bd581e51a3d9fa9a7bbecf3c301f707a0c564a3ddb6579
MD5 6b129349e10fbf0a089d9a31d6351a4f
SHA1 86f95d57fff82b3b646dc6306ccaeb63c89d0fd1
SHA512 bf8305e2e0937f28b2e1586454f809efff72a0dbeff9f00cd92231a1d891e2476ca082590e726853d4edabf1834c4c891c4029e35c5f86d3e835763c45e0af4c
SSDEEP 49152:11hpsNoJpF1A63U44CwH7R4xDDmg27RnWGj:1mifPWRWD527BWG
TLSH
T1A8B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c81f8778581726f27212ba11feafb100d7c934adf27ee1c2561784179ac62170
MD5 778aebb07c06ad8d6798d0ce5c9f78c2
SHA1 efa524e9a8cd15942fbf2ab2ff4ad6bf826f563f
SHA512 1a15f2bed83ef1cd0705012ea7788937509f1ab6ad4dbdafb41f1240891d67cf4045db942d01a4f527269a829457b235b2a25b962896838c7a0d584659b5a0f0
SSDEEP 49152:oSuZQIY0Be2KcRVtOnks6NMHq0Dmg27RnWGj:y5dKii610D527BWG
TLSH
T1F1C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 62ac723ed1f116badfb3153372d19107e503c23827e65af58dbe49b4bd431e56
MD5 2cfbdd286eddecc4f66e4a984527a440
SHA1 be4da25f570f83adf5943a79bb26bde7bc663fc2
SHA512 06769b8d5d368c3e33b4241e07a72f0346c0375906e06361c594234020e7785bd6b9111876432d5b31dbe5f7252b774da3177229704cae559f72436e06f3b818
SSDEEP 49152:ehtSn8EApI0fig3giDn0AP5w3Dmg27RnWGj:/X2imphSD527BWG
TLSH
T1D095BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0dfe5dd74fad09e9179ba5810d7d10768ece74cd177e4055d1d614681bb52679
MD5 d809e8db8235452e703bb27afccdf6ac
SHA1 621abb6fbbd033e8d18bc6c50bc0a26127367e37
SHA512 8b29e65ae060193c15819e3228c9b2c5bf08086a0dc6138d4113af5cb6e8bdb7cbc994153e910b44a374d95e4ba62c086dd1a96054b25b0997fd5fab6ad921e3
SSDEEP 12288:pcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T118C423BE924C01CBE92644B5C3E5F15DAC073E5BE92004937A5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 c4eed27b41d4d1dfa0ba48e18573a4bdb574db873e3a19155ca79e91c1c7d741
MD5 57578ffa3b5a946443144249cf03f977
SHA1 519ace1f9cc2954988f57eb600e81d614cf8a642
SHA512 5ee51ac3b82bd684c63c4c8bdeabe633138ba0e15c7320723adb592e923c0e884009a7aae94d6b331f4da51fcaae22821e48f21d4e42e8818366ece9cc2793ea
SSDEEP 12288:JxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D9C423BE914C01CBE92644B5C3E5F15DAC173E57E92004837A9B78BAF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 830fd1421375abada4225c306e8d722f3d14bcf108e5d30fc2da9892a72abf6d
MD5 7bb25bb0f369aa43a706d7c0798cfbf8
SHA1 112f56601aca6258d9bdc28438f99d69907cb0a7
SHA512 08687976880f623963a801c10347f0fcc495ac80a751e0de799325c84e302453585689f26ee98a77c7113cd66b0283746c8384736ddcfc5ef52b98d241e875f2
SSDEEP 12288:B3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:B3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14DC423BE914C01CBE92644B5C3E5F15DAC173E57E9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 1eb9e50cf460aab1ffba387be0640326595a5204ac54556029dba82854550b04
MD5 1a0f283326116d58126ca89ad493d4ff
SHA1 5aa1710dee261b96eee2ad81d8ab14bc431c87e5
SHA512 9a51c37b44afd48a5f2ef13439baf6e6509c6980211e725a4d25be16a6b3946387f09dca938dcc49a923e64f0e60c09f30f29e82f71223738f16a50b26159aff
SSDEEP 12288:XVSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T179D4236E535C01C6D83285B5C3E5E11DE8237D57EB3005DB6B532CAE9FB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 821e91409c7c703123da8a268eba6d2a1eb122973c3008e4c272ae92bf9daf96
MD5 81b2063c3d43230c0701972c22b43ff6
SHA1 169a5f95e1c0119c993dde70debfc6ff7e68df21
SHA512 fa4dfaf7ca4f9f97a41e19b2d9f059f21db0e32d1ca4a253d985556dd500a7b68d4dd7c5822e0b5c0ab4a6df52c18f06bb7d9a31b564d547805190f9fca7aa43
SSDEEP 12288:P6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:P6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EBC423BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c4579d65fd313cb6f994d71f9d178f3ba9ae244a87fb149ca63faa86d7a12580
MD5 d08eadeae569d4e38f6e17c6587e3791
SHA1 9e5585a88b94720b08f8f8bb732fde8e6b12a672
SHA512 7a1daca03aac479daa10970dcb82d2a785373edc7da28d02d55117296804cc07614e4a9047965c43207a79b8f3323e88f01cf2712eb944a10bc8902f6ed55522
SSDEEP 12288:a1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:a1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E1C423BE914C01CBE92644B5C3E5F15DAC173E5BE92004837A9B78BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 af02f20614409aae39b5b4ef97d891bae7f6aa2a57919f4c4e6f2e7959c935f1
MD5 7d37c2454b22837aa7f43db13b13955a
SHA1 4cdc13b3a79caed267a76999b1a1cc9e23beec27
SHA512 1a5ea5fec6c5017e0dbbbd00cb198023b5e17684ad4c146b560bec9d0380f2b5afdd95b6ba53c9c224de452f64b6e942af5673d38f90f3ed4bbbd242d191aad6
SSDEEP 12288:BZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T140C423BE924C01CBE92644B5C3E5F15DAC173E5BE9200483BA5B78F9F7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1e85ae2b666155c6dff3e12f1e11000e11273fd5025c71f9b85abf50ef277bc9
MD5 f65e2562ed4372d8ff88c29db548c012
SHA1 ab4df190ee6e82655a60f45f760df8e58d059c9e
SHA512 8c2f4d9d1ecf3937a1df45e99c34369151e4bc9521f3a8a15987be4336b8494c3990a624546f4abde9bb74a37607ac0a5e7ac21b0c9b6be7808964a69aa73288
SSDEEP 24576:AZMRzFVSORsqjnhMgeiCl7G0nehbGZpbD:AZMRzf5Dmg27RnWGj
TLSH
T1030501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 9e0e1fafefe7de6e39c3cad559e16e7adf3f2b66c8218badad5e71d8bca8daef
MD5 b3203057d7bd36ae1be6d8131f4b7d95
SHA1 33c4c583d612a3fe51d68d1134a3f07893af5053
SHA512 e257651d271f5731068841a3a92585108a810d2e9a66360c28e4cc20ca09c271b4c2386df301d6731b2f077c6c0235a858cd761a0562efc85e788f6df2d6c085
SSDEEP 12288:qYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T138C423BE914C11CAE92604B5C3E5F15DAC173E5BF9200483BA5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 547b013b007122a12a828139ff985d11a10c5a3a6d16f0b9825cc3c9b098624d
MD5 da84b4db065583d234c74e1ad53ed38f
SHA1 4832dbd4349537452c652dda37a1e1cb8451f792
SHA512 c2514944bc659937a8aa1d5a74eb48f7415afa9deef003b4fe292369c1d80af4275f1cdf7f6c0dc8ee22e5fcfe81956c15814b104668ceb05b52c2c5ed4fb7ae
SSDEEP 12288:dUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T109C423BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 06a879c8de0cdf28f40edd12290ee99b83bb553bd586a4caa3aa3be2bb19dc4c
MD5 8530a801b2cf37ae1ed0c4690cb59dd3
SHA1 aac8d24ebfb982acea1c2fbd2b7d0b0c69d8dc4d
SHA512 073ab287c739e6ac7128ab62fddd5c6372c8acd8fb2f8ef82ba4f3cd8efde76c11cb7bf9df4458d741aa455033d572ea8b8ca5ccb257bdf948cfbaf39e4751b2
SSDEEP 12288:nyPz5L8tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KzytsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10FF4025B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4779c88c4e7a11c57238da409a5c99c55743ad117e5ccc723f171669ebbd8a8e
MD5 44b0a496d77f700836ccb90b12833a5e
SHA1 27e2f0fa1b71d3a56fd3da25eeae0e04aa1ea382
SHA512 b84606497c1f2e6c9fa94429545504e25e6c4f845681c165b64b53913f95644af8c98be8ed0d9cab3976c4b51ff4f04538b412c1976442a53cc13ffacf6d5cc9
SSDEEP 12288:CYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10DC423BE914C11CAE92604B5C3E5F15DAC173E5BF9200483BA5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 e164ee628c5474ba654307a8411b524d20eef8132e4501f916cbad63e5a05626
MD5 f9fc682623bf30be7c023f1ba16ccc66
SHA1 f63c91cff63de1a2e969c239bd37fb8e135a9c65
SHA512 2a504564e5d1955fb5ff733d41124d86f9f1b047daf0a513a1e86152647aa50315915014362a255f3b42f60517cd35868acfc42f782db33d9638db4ef6d5eba9
SSDEEP 12288:/YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T109C423BE914C11CAE92604B5C3E5F15DAC173E5BF9200483BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 86dfdd74a696485c5a6452fc273435f350b77c9884043f6d7f1749300b22f77e
MD5 aeb6930fd1bce587ce5ec338274c5019
SHA1 ba35fe0b3d8edef6e4a0e47c0f1d0c6f8cf99482
SHA512 f8bfda841713059b748f19294e32774f45ee0afcc544a50da8103de6a1b1e6511e1f2f67438acbfbe4b60e724d5bb6efb1ad80cc173b242d3c2d509491bce2b2
SSDEEP 12288:YyPz5L8tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5zytsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F1F4025B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 764bb687c4cfe7a4b2fdaaa2b92b17d1637fad8b9f0322895da6690a9ef97525
MD5 829bd645e7e01452264d1ddac87345d8
SHA1 d361100cba44a5f9d4d11e311b55fdba0a2b5fba
SHA512 154e2159e7ca980aae43ec814b678a56612766a778dffc338147cbbb66cce8fce1d758cbdd151aac1e1dcf119f02fbbb68f9f96b6696f6eb9c813a33eeb1f959
SSDEEP 24576:tTDaLl3z0zDnsqjnhMgeiCl7G0nehbGZpbD:tTuLljqDmg27RnWGj
TLSH
T18F0501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 55f3482c3f38971e78a0845a30f7098275d3a77197f3518f3fd4a3c469ba2332
MD5 9b59f59701ac353e54214c0f8f9efa61
SHA1 5b1a19889337b3a6a29d31ac35687dfa1e90c8d0
SHA512 96146e250ea5770d34284d88ad7db2c11e6d0815adccdbeeb6361fb931b50ccecd7e694536f83c63b8fae7da26d9e8b8f6537f94b1a9abc116564014f761c642
SSDEEP 24576:A3vd9CHKy7GZrsqjnhMgeiCl7G0nehbGZpbD:Kvd9CHKya5Dmg27RnWGj
TLSH
T1E925CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 6b209a81f182080989613a653ee17d30fcf9bc12e0097760816a4cbcf3553558
MD5 f606fea7a87c273b63b3229f1a40f88c
SHA1 1e72ea3ab1098bded4025a5bea2270783ea44041
SHA512 0cc6cae9d2b3e3f6d101730622f50e6059e8c71ae5dde97e5cd0f015cff7cf097070ea864aafea8d4d301b0940cc58024a1678d56908614e74c9217f753d5a08
SSDEEP 12288:vXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ACC423BE914C01CBE92604B5C3E5F15DAC173E5BE9200483BA5B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 93f4b48a28a3074e5d467688be801289c92750e8ad2871a16085ed45e2ba7fc5
MD5 bebfb10ad2ce102dc6e8495008470444
SHA1 e5ed3f064930485e3a22050b6f7ad19cabb10e31
SHA512 4f53ba86b350ad35d8a4912cbb5346ffbcb51c3df91c6f835e3d0221b96545900b15ddb588e25bcff7d17aafd7965bda9a9d760ad82bdfecfb9c09648a8364c1
SSDEEP 12288:cNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BCC423BE925C01CBE92644F5C3E5E15DAC073E57E9200483BA977CB9E7F28684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 bcf722fb00e4c0bf5cb422a9698a505895919e20489567e4222d78519f7fbf02
MD5 4f54d4e7bfa404e3c23c0111d9d8d18f
SHA1 7f728c6bf9e3b8223d8b6e80f407ed43ad81edc9
SHA512 0b885b461f651e11a3d6321c6f57d317ebc32d5ff0d1d9f35a24ab1f2597de91c458a3e909d79d25918e30ee97b300fe54d7d7e9663e4191f2bd273bdeb586fe
SSDEEP 12288:8OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16AC423BE914C01CAE92644B5C3E5F15DAC173E5BE9200483BA5B78BDF7F28684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 34ae51e6e43d2adcd5e12b3eb6b1c10ac986e8b408f9dfa786262d6ff5d511f8
MD5 8a751a4434394b3c63dc23a7e9136c2e
SHA1 5fe5f895f1b46616504bc68543717a381f3d1117
SHA512 354061fc864f96afbf1e67cfba0ed253c064b89b162eb694b31810c29b1af6903a04a819fa5e266e39e07db473f9a217b6ee8c5ce60f30645dd11d28d4950bb5
SSDEEP 12288:oYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T143C423BE914C11CAE92604B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 a73972aa8913e195613a93dab50406beed5e950a334f89eb613be3c2e79aca63
MD5 6c0876925a1b9101df2a9dc9e2f2ed7e
SHA1 2fb47a1837c4adbb57b5884deb793adfdf985a40
SHA512 a8d2cf3e7c1bcc18200b81844d3aee3dc33b94894937d14711bc288366ba7618a6da699c951f002067ebbc813271cf0cf4ef68ea5f882b5f7e2cb5a980c2a7dd
SSDEEP 12288:WXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11BC423BE914C01CBE92604B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 0c2510ffe2e69a010394ed7cec4d43363873a0c67447ee10c117703c2ec0cd64
MD5 c84c59813d8f0df785754509bbe48805
SHA1 2be39becbd87902c0d5743bd1585b44fbf2801b8
SHA512 cab056213ca1d5f31c1a59eb3438bddd98c3c166a4765d7de22b83a4717bf6170230a14595020a2071c3e114c1ee7b5e97ce04302b48ba8e09b1437a4ae98d5d
SSDEEP 12288:1gXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1gsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C8C423BE954C01CAE92644F5C3E5F11DAC073E5BE9200483BA5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 6c74bfbe0f70bdefdb27388a53f71f10eb5f7385079be992355dd45a905219b7
MD5 3d1e32205c58b2b3b0f35f7304d07034
SHA1 c493f8d1d54b82985158ea0070e091272812f401
SHA512 10fdf54306b091327d42341b07a9b50216e06f75d03db41b6e4e9461693726f3a68efda9400fe6996a7a22e028763f000e77f140632fcd24ec3fb4f87f22160c
SSDEEP 24576:dfwvUk9RX6wkyAIksqjnhMgeiCl7G0nehbGZpbD:PMnYIADmg27RnWGj
TLSH
T1FD35D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1d8a7f96eb3035f27f6695bb0130ad6147eeb3bf5812578b292c539a030ec4ba
MD5 c98c60cd7cc971709369cd844aa7fdf0
SHA1 0b0fb7b716993a78975eb1b8125f668b911ed086
SHA512 c97e209cf86e078e25044315b3d52a1f63f53cdd9bd39026cbfbd981b63f2f0e7eb073c1f8c0df223ce7dac577746c6f6abf2ce61063c03f010752b6e942085d
SSDEEP 49152:OYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0XDmg27RnWGj:9ySzPfD527BWG
TLSH
T11A066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 461a710c230970f82375440b4dbd57a36ad09bdb3a22459bb2893f80112198d2
MD5 7a3818dd43d6b76fbfb19ee1bc102947
SHA1 c6b0106536919c1ba4cb80d324c1b1d1a23b5566
SHA512 9fe03f7e24236e4f8c7d5568d255dab3dff21d6ff1b930b2f566e87a343f3de67d5eb8100dab419fc21a30f2abe83a847b4df175348bf91d84e7be069922cfbc
SSDEEP 24576:R47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYhsqjnhMgeiCl7G0nehbGZpbD:R47JUQjTirIhCnDHUPfF/nDmg27RnWGj
TLSH
T14365AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 98a6011d60800ebf060f19f4d7de4751e93aa99063f2d11746dd5b6dc72a3b4e
MD5 cb7f4aab0c3998ef67805c25a0b84477
SHA1 c9ebafa3f5cca5e6d42f0d7a91839bcaa58acac4
SHA512 56ab19e8488d1a03ba008eff015b6966da02edda5ae546b160f0958b735e458a8a5ed8e4b5e27b32556342b41423830f8c43d2fc833140b63353477bcb8657e5
SSDEEP 12288:6bsfIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T119E4015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EFA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 334613dbe2b881af8a3fad437c240ebe381d655998f1f335d0ba5bf746c8d80b
MD5 5ccd809ad1ee6278ea23f1bc3c427b48
SHA1 dfb54ecc3ad4987a332aa768cd861a97f45ffac7
SHA512 336fd35a749e600583fe0760814c171d28c6947c6462d465496ba3e9265a809768f44061524fec43e8969adaffed56a9d3c9b6826a2134c3c7bb943770d55fc1
SSDEEP 12288:3e6fFU3f5gE3+WwpB2YPrUxqI3qb51RqUZhU8Uj10v9p:3e6tUP5PC4YPrUaN1RqUvU8UO9p
TLSH
T18A452840B62ACB4FC66940321E37D5CCAB707D42EE446F0773C9973F9576658BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 66a3be1981381d2071be8a0e9bf87f0225e23406c3bc743dc0d7d0ea93bda46b
MD5 8fd64d0b0a26b67ce290d8080890654f
SHA1 d6d970574c0ce4d47e0fad623445ff6f92ecbaea
SHA512 040911102fbed30269ca8bd8719f72b2177ad9284ebb94c4723be338f6043ce4182c142b2733b1196e852281bdb752159a9e6eb1a8e5c0094ea1b1ef53e48ffd
SSDEEP 6144:hAllBGJhJkYwv1wJ1mQYPbYPP/PTWDuFDu/gggjvtMx4Dho5EOz/nYvNYryjvtM3:hAlvv1w7YPbYPP/PTWyFy/vFN
TLSH
T1BB45C7419137E78FD1F72032072A5F8C67A4DC4BB6496F26B3C9453AD86AB11A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d192cb264a63fa8bf76b51159bf664727a1939e7cc6f3dc2d3792dcc592aeece
MD5 e1d08e417969b11b4e5d4a80cee5f3fa
SHA1 87d21333fbcb13f6c0e0f3cc4f2575aada46d438
SHA512 5107e0feafebb66040df9d28a798b6c8659847d652c26ea06f58ed142f46aab24b8db8c680ee0a35b3750b3b47bd5a063d428b1f8915566cd2dec72c0fa9f3bd
SSDEEP 12288:yM7QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AFD423BA934C118AF83605B482E9E12D681B7E669F1044C3BA4779FDF6B28D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c0143edbf43e9f0547d4313e578f162ab3f8b61ebb7048853483b4fcc093f09c
MD5 3a46d3154f7c021e2664a4cdf496a6fa
SHA1 2f14970a1e11b98985d6c6dd8fdc1e613cc6bbd6
SHA512 5f3ec36bf631f852f9f8d5de4915fe031d5f5ca149aceb018d8302f6aa26b05523a627ba191a70079c6893abf1d5dd0459ca117f85ebac1ae7f805a08c6dfc4c
SSDEEP 24576:Egb6bmBIi49WNNFpg1rSvFv7bYmsqjnhMgeiCl7G0nehbGZpbD:Egb4mBIBhGF1Dmg27RnWGj
TLSH
T1D7659E1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 96ebbf70ab99e78ee8964cadedab5672398d73d97d71fbc2402d623cd6de6488
MD5 7587310996a46df77f05c5ca40ff77e3
SHA1 86951c791ddc998ca66ce9f1d3e04655a0d39491
SHA512 6c52ceadff1bde428b7864a4dadfb6883325e5b9fca92ed1d619d6e50f38992780d73f580b9afaef4824f0549fe625f46add7788ff6d1fecd76a06bf4bfb6f77
SSDEEP 24576:xGEl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:xGeJZHUmUYyH0UbETQK1
TLSH
T1C00523BC315A3998D13AD7B27A649083B8A0747907241AFF95A2E2713F01CF6E17DE25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 1f09bf2ab07940f463d66a114ccf85c67dbfbc761726b8b99d5ddfcd729d43d4
MD5 305ef9bdd2333c2038a2d076006d225e
SHA1 a2f4f6f0cdfef2c65d71ee22a0bca9443422e54f
SHA512 0af2c7919008a8d1f8efa76bc31f67f19f278d9371b73d0460a8d00b323843e339b428540ae40ebcce6d23d30f939e26f03f4717b2e62639262862db4b700bc6
SSDEEP 24576:lG88u8FpJqH1bzria7/mRsqjnhMgeiCl7G0nehbGZpbD:I7ZFPqVea7/CDmg27RnWGj
TLSH
T1DA35016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 d6a5d64ddb0ffa299fa0f88674fd7026dd701d744fc5b5ac10fa367078467232
MD5 bb3da68b962636943b817c6d73eda608
SHA1 a504e7c99c7ab5dc86aa8319c5607a4bcf4812de
SHA512 2b2031345336bb245e505548757c8bafafac20672e483da0aadf1fc6b23d08d9c350f586927cde914a1f7a10dd6205c44798b12366fe774146e929f29b64cfac
SSDEEP 12288:XHvUrBFrEjwaQFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:XPUr+NQFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A05F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cd948d2bead1ba1e494f6c366c33e9e024074ea75b669bfaa8376620dd519c00
MD5 44505e561700ed201f5f8ae1efa6f6e8
SHA1 0a0f2217066016bec888288587c1424cb91fa00e
SHA512 5904e73a00e71d19ad63968faf3cddc70dec40cf6e3e3cb7d8459402d0bfac4f651ef5c098aabbd2302ec91070e1b1b594d8bcd72a08862231dbd6bbc95d6531
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjpDmg27RnWGj:VG05lO43bYD527BWG
TLSH
T158D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4f506a6c93ca0a201a0fbee913b875c72e135a7e2b56a0ed6392657a9eb288c5
MD5 66b19bb14e32d9f3fd8a0b0aa5af05e2
SHA1 c97e90bee70576a9433ff0efc411ca44758d08a5
SHA512 3f6a1d1fc343df90e218f44246c155d2a61fa303982eae99d7a518f668d5adc5cb124218414ea413fdaa93c1f45cb2788e51bb0c99cbd52615df7f1f29439479
SSDEEP 24576:8fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnTsqjnhMgeiCl7G0nehbGZpbD:ka5POZ3BJt2pasx2+mxDmg27RnWGj
TLSH
T1EE65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 33d446da0495bd57d50e3dea16f5ad086c71113850a9142b9ec80e6799fdd2fa
MD5 deccbb469ef2643b5046ffdeaa694be3
SHA1 dffb4167ac861a98d61513a3d4ff3b3f83f55ad8
SHA512 615815fb5655ed20c5529e919680fcf730001d63e006a5f83754216ef7ed4e08d4ee8211905123ed1fdcb52817eb741e6be1a459cb643b1d829f163e69651720
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkJsqjnhMgeiCl7G0nehbGZpbD:gNc/zEOVHFiDmg27RnWGj
TLSH
T12D857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 cfa8971760d7a0c72997bd564f152526c44c57a82fdb50a3512749afce58ba05
MD5 cfb32a655dad1ada1d70b618cabee549
SHA1 377cb7d0458e543d8149e8d3acadbf92e4644a04
SHA512 60bf5962f239edd712c45bb0cfbd52858c7821b0627447bbdd740ace53b685cd86db6167949dd2b8f021b32bd7076a9bd227af3994269b2bc88a08afb223fee3
SSDEEP 24576:h6DI7l8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:h6DIhJZHUmUYyH0UbETQK1
TLSH
T1AC25126C336A10F9D03BD07A96820142D1B1B0B583221AEF57A0D6B96FA3DDDF53DE52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 6a0a96d698f04061b9a85579b74835d193f6c973f99b9a06b3e0066a57bb8fec
MD5 fcaa9e2a696e6fdc80e9843ae10736c9
SHA1 71376fb6f3c2f5440bf855036b0c8ec199fc3290
SHA512 5a26df1a6c2370dd188fc28d450f4e7f82f8aaa22b93d9d81c960d154823f0b032c800c44847e888cdd3d5152e386d7da3c88018b22f875f7bab499e80a79c8d
SSDEEP 24576:aTkNvNnaFeYhJNtmZBmOl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:aTMwBtOmcJZHUmUYyH0UbETQK1
TLSH
T1F875C06EB6B806E4D1FEC6B5DE238112E6727461073253CB9390C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 b480c005742831d5aea948858b6f2f41703f95e0fe3714681281a30b4cc3c0b4
MD5 0e3ee1b97ff41bd516300dc8dfa34007
SHA1 356d95e810e93d0f16bac191287c296f54bd55bf
SHA512 dee35c287cd010f3ff79bd541052113769989fa66ede28f5d3a25da6f102f68c6f43f8c7b7c851ce028743c8d11c682d2ee632a45e67957dd9aac2bd5b07ee88
SSDEEP 24576:lD3FHshBIYQgA8sqjnhMgeiCl7G0nehbGZpbD:lDVHeBIAAoDmg27RnWGj
TLSH
T1F125E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-7-0x0000000000E60000-0x0000000000EE5000-memory.dmp

Download

memory/912-1-0x0000000000B30000-0x0000000000CDA000-memory.dmp

Download

memory/912-54-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/912-13-0x00000000033E0000-0x0000000003447000-memory.dmp

Download

memory/912-18-0x00000000033E0000-0x0000000003447000-memory.dmp

Download

memory/912-0-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/912-2-0x0000000000E60000-0x0000000000EE5000-memory.dmp

Download

memory/912-77-0x0000000000400000-0x00000000007FE000-memory.dmp

Download

memory/2748-91-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2748-322-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2748-92-0x00000000005F0000-0x0000000000657000-memory.dmp

Download

memory/2748-97-0x00000000005F0000-0x0000000000657000-memory.dmp

Download

memory/2856-87-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2856-79-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2856-321-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2856-81-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4392-68-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4392-76-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4392-67-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4392-257-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4824-135-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4824-327-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4824-325-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4824-119-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5016-139-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5016-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5016-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5016-145-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5016-147-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5036-342-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5036-108-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5036-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5036-125-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5036-340-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5036-102-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5108-155-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5108-162-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5108-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5108-328-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5436-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5436-26-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5436-32-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5436-34-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5436-33-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5696-55-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5696-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5696-45-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5696-154-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5832-324-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5832-126-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5832-134-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5832-132-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download