46248f816022cbd7c07b042294033689e858cef00f62ad24dc57c451da39c5a1

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 1.3MB
Sample261030-bweybsvx2n
SHA256 46248f816022cbd7c07b042294033689e858cef00f62ad24dc57c451da39c5a1
MD5 7a691647e4c0c2993639ae24803f2dea
SHA1 34c98e168a147b43691a904059887ef3d2b07f7c
SHA512 4ded7b527883cf6b9674da65131118c1f58b0f1e8aa8863996569dcb5b87f0bf3e54f4e35f20f06f6304c43d984b9ff2592ff1910092c6b7fe3f8c9b57d41e06
SSDEEP 12288:7HBq4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:44nQ/tbw/2Mkjy6Fr7g0ov
TLSH
T17755121475D3E726D412C5B1485181B15B7ECD812FD1D28B7A882F2ABEBFB9C07EB284
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
764	elevation_service.exe
3452	elevation_service.exe
2832	maintenanceservice.exe
2264	OSE.EXE
5060	PerceptionSimulationService.exe
4628	perfhost.exe
4536	ReFsDedupSvc.exe
1848	SensorDataService.exe
4956	ssh-agent.exe
2736	AgentService.exe
4656	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a6bde62fb68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1316	4448	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b23155250e68dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093e3cc640e68dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aafb12650e68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb5162240e68dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041fff0640e68dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf5995230e68dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
764	elevation_service.exe
764	elevation_service.exe
764	elevation_service.exe
764	elevation_service.exe
764	elevation_service.exe
764	elevation_service.exe
764	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe
3452	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4448	2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	764	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2736	AgentService.exe
Token: 33	4656	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4656	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4656	SearchIndexer.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeDebugPrivilege	764	elevation_service.exe
Token: SeDebugPrivilege	3452	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4760	4656	SearchIndexer.exe	103
PID 4656 wrote to memory of 2300	4656	SearchIndexer.exe	104
PID 4656 wrote to memory of 5928	4656	SearchIndexer.exe	105
PID 4656 wrote to memory of 6036	4656	SearchIndexer.exe	106
PID 4656 wrote to memory of 3532	4656	SearchIndexer.exe	108
PID 4656 wrote to memory of 5924	4656	SearchIndexer.exe	109
PID 4656 wrote to memory of 5304	4656	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_7a691647e4c0c2993639ae24803f2dea_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 528
  2⤵
  - Program crash
  PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4448 -ip 4448
1⤵
PID:4716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2832

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2264

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4628

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1848

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4956

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4760
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2300
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2740 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6036
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2740 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9aaf4203cfcca8b27493824ee98ff28205f4d16454f052393b6fdf2cfd236578
MD5 3c8d4a8c21f56ee06babeefeac115aaf
SHA1 8b414e46e297525304df14757aae018b9bbbb7aa
SHA512 bc2829a87d0d20642f68a1889f48bdccbf9377642ee70de3eadf8586ed550ce2d3e1a8864d1386cad0958395eb41e9ea87c4b003e2a454c959d376af48660af1
SSDEEP 49152:7b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnyQ/lFTjN4:J3q6HjBGLm
TLSH
T126D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 72b42f03cf4aed2c0e3e46d141dc8dc2403da46d366e5ed2a417ed6356028bc1
MD5 f63df04ac5bdfbb9205508f75c454eb2
SHA1 f082b887d96717cc4107225d2929fc3687f31285
SHA512 cd3b24205873003d0a3e4db6f5bdddd6b4a19c8c403f94422ae53f6f7b5a8d41bf9a665f92b188f79be0a2641132aa8bd210d3b997244a5845035d478f66bca2
SSDEEP 12288:W1XLsswWkxy2lRq2czASGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:UXYfDtczASnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T10965F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 2b8bc74a8910fd17393c43aeed61096f2df7c3dd1e241f14927852e059010b12
MD5 27b9188a0200756bef0e9d7844d5cd7c
SHA1 321a254e85b430fb652d3ef641b7bab97c651949
SHA512 ca1e16ee144c75f987072d99f41991cf5fc9967fbd52b9d11b7e6f164a87e99e9dec442495bda38e43a7ae81bcc02ac69142efbd49aa771818e9dc6650f7d822
SSDEEP 24576:O0Le5ji0hmxLrMdnQ/tbw/2Mkjy6Fr7g0oM:OPji0AlQQ/lFTjN4
TLSH
T1C4859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 41283a39962ce6c23576ef11843e991bfd478d4a2b479142e506167e40a12f3d
MD5 3de1e767d27bc191d604f50719874d61
SHA1 5c35186e88c650bce5aa3ec5a6fbc3499f31aea8
SHA512 164bba23ad64739cb13021b077ee184fc38dc1c3e2741b2189d0f2c9bec7020d1b7e36b901ab4ce25d29f9e3af479d25eb3214800e081373e86b0c9f164c0a92
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWE6q8wyuHnQ/tbw/2Mkjy6Fr7g0oF://ezSC6vUzPvxHjyMQ/lFTjN4
TLSH
T151755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 36c1324fa2a9b9e71fc77f4fd39198144483ecdf50353ce12dfe45a3ebfb6d83
MD5 63165b96ee93cd2971627f1d7479b388
SHA1 433f9ad1465523f57f16000d5093cc0e31dd41a5
SHA512 2352669bcda99fc540615d8c18e2d2ab9a015134106f1e8e9fba154b7d63dfe4ddeaaf89931c5ab372432cc282e534b8c5ae1832782339aabcbc87a6e316d1e1
SSDEEP 24576:ZVbqPb88hv/l+6mnQ/tbw/2Mkjy6Fr7g0ou:ZVO88hXl+JQ/lFTjN4
TLSH
T10F559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3076294c60f533b3dab0540f47fe87e0d8c24a16665708e9e43bbfb585b718e7
MD5 4a6671229ff918aafb71e9590e737e98
SHA1 1e69cc03f7063c22c5b4a21c2f9cb28b325d0dac
SHA512 c11cdf6f3bcc196a4097397c2dcb5f46573b250f9c86dbfd5fdcc3d6b3c52b94b8b73bbb4c4d704c7f417bc4120df9977a9a29f3785b5fc30e7592b3da4d789d
SSDEEP 12288:HzhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:HzxnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1DB5523796A24F887FF2B06B15CD284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c02a96f70af5a23a13686c30097dedf4d39362e123cf360a8e35dadfc1223b4d
MD5 3f1b2947ab1b75a1aa4deff438f2690d
SHA1 4053919cddeab754d864d6ba9810037b969d3fdd
SHA512 15fb2b6012625342bacbd9546943e47280c687ac0629e135a89f174caabd17ea07950b0607033b9651edead2376252248367bf5f41cf6c260c83a15d0fde304f
SSDEEP 12288:DeBNUbTVO86U+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:DJIU+nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1A875CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d6d0b783ee44ccaa628b23aedb66ea972982e20b956b2696cdfcf3bce8b92f59
MD5 3328b8d13190c46b3f7b18446727fcae
SHA1 93334b00707e8d9a9354bdb736616476cb0bcecb
SHA512 3f3738d5df64594c14dc7ed31b1e76a327ac0a12301dce349c8736d6ca7464eda41140055529ea7887a420ee4983769756b31f64472c996d908f5286bf5ce4b1
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THE:oQvGAdlCEL8c/yRNw5C8Lm
TLSH
T15A267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b637339e33ebb7393a92b41b8a9adacb349abc77df7d90fb19da88411fdd62fd
MD5 4f7173708524bea4f73f7c0fc252464f
SHA1 f72c217d34bf99212761732011ed41f1ff012388
SHA512 8e16d2e27c1a9214531c62e1c38f443460f25470ab0d527d49ef2e6b92102a5fa2f606498f50551d2cd333bb84ede089fc39804044f608b3d7b033ce34b1335e
SSDEEP 12288:qAwSfxL/2Dc39DLLmt0LDQewsAjAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgH:/QewsAjgnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1F375E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 12c16c4a1dd66e47c93b41f44684aade22f95e93b966e38724c751644b562885
MD5 89fa623e0b1d6d388b2455f7f6c6152c
SHA1 4a3157a8c716d62d9f9c18f4133148989ab4cfd0
SHA512 89e8b7191952f61b6bcf502c7d1a4d0dfe7e619424bdced0760181c8251c5a6dcebdcabbefc4afca8c47d7317ed82539e95873ec124a7d73638872c3cd9f4068
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHrL:3UEtQevvqc2W1cpV2EI32
TLSH
T1BB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 06918f116bbde8c321c02d029ab8888e7aa09b19feab5fc5052d592b5f6e5e94
MD5 a5950d9cac3d613585ea9a8781d657ff
SHA1 21599abcbc7a8e29d1f914f74690d068269dfc8a
SHA512 1366c4c464f6701c88fc3adfb5d92d038288bb5d3ceb2cded69486fd7bad232deedb2f963b4911c5329c1450fb086910a3843c9e52e91f39d73ff77146fa2815
SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/zAQ/lFTjN4:7oqtVjnm4Lm
TLSH
T1CCD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4fd86c8f86e3b8375693cc0953e0acecbf90a395f7109a39d58a47e096ae22cf
MD5 0fa2f2893e898be660724762667be4ed
SHA1 2119bb0aad0f6d418fb2a4a16d88aa21f388d891
SHA512 e8be6b11b4f969e7be2b0fa0107bb7e20a933b4176481df37c8b54b698977b6c74085d0b784d0158b6c4bbca98e77afa3d0f382ecc1fe46627731663e9bdf02e
SSDEEP 24576:3AhGLJIFoiwtA5l7S53znQ/tbw/2Mkjy6Fr7g0oE:3AMyFoiq5jQ/lFTjN4
TLSH
T10B35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 08afe529096e63718e547db0dacefef71bfdc3808bdabb77d7aa2e15bbedec9d
MD5 c877335df51801e19878f9bd38726a97
SHA1 8e28277492a655d09112f426f804e2bc1d2e9c63
SHA512 d47bd92721457a619191038f26fc2197fa62c2a40491c7550fdda6e711b6862808532b2a9fe2bde5ff0489f51587c8525b02e396607cac957c654c42320fc318
SSDEEP 12288:7mw5HEjsChN2BFgl0WDm+CHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMl:awuHOWsnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T14F65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e3d97d9bc8d3699f9a634853c12ca7a5ac8e3b326d37b8e0cd0f3ab5738a67ae
MD5 d08c392c822047d3580f26aebb8eb694
SHA1 93173f4980502cbaaaaf8daf1d4f23ed787d5be5
SHA512 dacffc8ee08f23898d43d0f37d99784fa1b972e618de81391a5131b46305bb2840854cc4d27f66660b6e891af0ca6b734509b8e2b1ef6a4b0e237b2846ff778f
SSDEEP 12288:xXZ1IyQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:5Zu1nQ/tbw/2Mkjy6Fr7g0oN
TLSH
T13155126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e2d4cad1cf9d5062f1b4fdecd8634dff74aa4f2a16a505880a002255a0d9d23c
MD5 920f05423fd56e9581b54b652b902c37
SHA1 f1681bed422fd001a153129fd1ff1de31c22dc50
SHA512 59517ecb46bc4b05c3439d08b3fe7d5a5c76f8ef468ed61f27e804bebf17f53593ac1cb85d67a9a35a4e0eca8b0d2bc2bc45e847e1a09cba64dbad228db41c97
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:JQRQyi36YOcPQLvw2gAf+PN3FLm
TLSH
T1AD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a53330eb9ef6fd39328330d940a810c3261460b3c245038cf213734a13bc993e
MD5 8562154c974d044a88d06cc65fadb031
SHA1 64303abf52d4bc686c43a06463315704a18c899d
SHA512 56f71cfa78db4b3102fd610df531e769e922e20ce347081e3d5bddde2637754597c135aa94be9693aaaa1b265533dead6dfea35ce41955fcb63c5eb244d7560c
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:LQRQyi36YOcPQLvw2gAf+PN3FLm
TLSH
T1B7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 035e15099b6e124a9d1dfbbe48f93e86ff0e3e6e1a3cad7d41634dd14b91af8c
MD5 719a59cd2bdd63fd367caf89da59c298
SHA1 0913762b5a601ca2fc95d143e658a2a87a0dee16
SHA512 97bd9d5fd2b6915a225b938446cadd356000a62057dd0c68545d00694d77eb4ba00b24cdc71ddcb7759e18fdde95801ab7c250c487233c56a3b0e6c39213cb60
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0lnQ/tbw/2Mkjy60:368Qg55nhheWu7PNU3/QQ/lFTjN4
TLSH
T118B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4e17ac1f67fef93ae526a0ed919620e3f888bffd9c03982e07c1d196281b8273
MD5 8f9035370ff91696c4a77e9e8ef0b05e
SHA1 6d708f1d9d7f26b21e0d0e4b3bc807e777960a23
SHA512 8ed0ec9aa8b4fc04d00bff6cc69a0ab89b8bfd3f53b01b05748b96ba81b97d30e364aa70dbe60b6a92c22092c9e033991b29f591bcd37d90542a35504c9c746f
SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99m:fy5112gYy5azzVvL69nLKnhZWLm
TLSH
T167167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4c3951c4aeb9623334fa4df6fcfe62d0fc360da38c8749c8b274d2456b7bddc6
MD5 f9629a2207564e733b412d045c67bc55
SHA1 57ac9864d3da74e0e1a81927fbf750479887358c
SHA512 047435411e71fb6a7927cc6ffa0348d0acd2c02af8ffc61b15e90f8388d19cf0090e3f27bb9904b1152d2fc9424c003fcb25803af9b733155458e55cb5cccc5a
SSDEEP 49152:wB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glFQ/lFTjN4:qu6JmVxd2dqLm
TLSH
T139D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 138d9993b9e88c09ea5e1f48940875533dfbec8a7c09d39e955eacffb99ead2d
MD5 579217de5867b86cf796d3a8b70b6199
SHA1 208b48cf8920be771b674e8330d5020d88ce3814
SHA512 1d5cd24c16a7a5ac29342080da9c6af6c0c63f8076fecaa0dab0bcf3ed4378a1d5dee2672610cf0c124d1496e60f7b83eb536c6b7713afef9ca8cc071109126d
SSDEEP 49152:m1hpsNoJpF1A6UU44CwH7R4xeQ/lFTjN4:mmifPbR4Lm
TLSH
T1B6B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 98f78c36e4579d8faa8c615f5a85716795fd522388de93a07d17df2204b3a271
MD5 f1eb64917e0bafce8759a132ac963813
SHA1 3349c323cb3c5f57c349d96953c023762fcf6bc5
SHA512 e903ddb510b55eb6d9dd6ed6c2848fe179a035be5e702c5d1bfa9003526b06973486967eda7be28e8ef822878847ac7634d86d339de4822858d2f0ccbe766ed3
SSDEEP 49152:/SuZQIY0Be2KRRVtOnks6NMHq1Q/lFTjN4:F5dKTi61aLm
TLSH
T13CC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0520c4f6a9787410dc43450a6d1e2733ac28f699379e8d32b1e471b1c3d6de38
MD5 4ed9d6aa651f00f56c34999103c300ad
SHA1 a082cab453da1b258abbcf69eb7c930286e730dd
SHA512 629188ff2cbc6a782c8fe1b4357d421786614bfb59d9664c68aa5cdced103aed3a929f4b7ef5f2211a9b2e51747ca3d9e05ee098189e3d30635659caa5a7f752
SSDEEP 49152:IhtSn8EApI0figngiDn0AP5wSQ/lFTjN4:ZX2iyph0Lm
TLSH
T1DD95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 69a5131591c5b9e4f28e4b575a3d1528e27b62cd916fe56f36405b5d787f385e
MD5 8b5b2cccf1a6c7c242ebd286175c3d24
SHA1 48b93c38e72f0a175c3a05e6da8e6e8f941118f7
SHA512 92231d5cfcfdb4af0c149405a1bd554f89e9502325db8885fcb4c95acecf3ec65143cf31c3c88cbcdbe2d7fc584eb3bd5cedcd493549f0860f6db9841ad73806
SSDEEP 12288:q5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:qJnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T13F5523697964F98BFB1706F18C828182A73F0EC6BFD1938E77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 cf2dca82038d0e8d8dfbec37837fefd475e553c4ccfb00fe9420a37a8e9334a3
MD5 f3abdfc4447101762aebc33a6625c217
SHA1 59742a21668e40219df0f709d7826077e8404a89
SHA512 efd6302dad0cfe92edd1cc929049b2b829c6df71c239e25dec2e8188865c046a733c5a4720e8adec0e959622df5b9b16290f3379e5242b678edad5cd4db92afe
SSDEEP 12288:VUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:V0nQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1D05523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2c7f4fe347680cb062f50c8b7b2466cb589f4f3b9a0dadcf0ee7d0bc3a6cda6f
MD5 5185e28db4f4e19311069347614ca3af
SHA1 dfb6598b837f0eae5b53ac718d3116fb7bfe5998
SHA512 de263676c1adbe9466c21091730222e44ec2eae11746f9f365a2a39e25f64f8801247cfd522e072ea9e698b6000c1c99c0e1624e6b21257cce6397743b819e8f
SSDEEP 12288:O2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:OWnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1DD5523697965F98BFA1706F14C8281829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2de9ad1102fec7061de7572b7f99f9d4960a8ce94bbad51144f2d72edc08216c
MD5 3883d3783beb5ab2221a1d2becdb43a9
SHA1 133aff33a93ec34b0d70739b61de10b788c32b9d
SHA512 b1b5a8680599933b7d2d071b6d0f927957024e6f06b6f73fb9af39195af9434a81c45ab06f16a25c0467594ba6ef2db3eb221b7334c13485e2d6c0f50237c094
SSDEEP 12288:vVjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:BnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T11D5523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 46f661dde9525bc0a518acae1c58147b52ea87fe520b0d66747aab9429bca587
MD5 110eb113c0e20b638f0a6d5ade2836c7
SHA1 460fe84b9efca0ed52240836e630ff83303127c3
SHA512 2a56b6237d0065b1b6c76de8ae16ddc6d80de0dce04c4b1b9532f06e69207c3f5a2d22833cdd466fbbc20f22c8a389122e74b788be587349662c021be9c4af5e
SSDEEP 12288:+LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:+7nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T19B5523697965F98BFA1706F14C838182973B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 852cadb3a9e22e6e7c1db8e380b1c44792bd1e25666c36c886105dba8fc6b5b1
MD5 33e6271c0aa33bc8505dee9d406e3528
SHA1 f4e894a79e81b9ebeebaaef2c8ed4bf7aecbf572
SHA512 7ef11bda16938634b32bb00d315322f33a98b44b3aef24d80790a1f9b92377f7cf8f9eb478d29ecc1e26671b71c28a184923530aea4d81036bd5259a1f1e3409
SSDEEP 12288:fYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:fYnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1055523797965F98BFB2706F14C828182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 481478cd509bd4a58dfa6d09bdb07070e7afd1ff996a02256a34d57943860a8b
MD5 6985a8dc4cf2183984281296755d1f1f
SHA1 bc6cf261ff019787ebe6d3a026a1655f1ef47587
SHA512 774d3b3a2c58c6b8cb5342ba6ba8a9d480d8259b9795866bdcff56333b6ad7b86114bdf38bc08b3b328c2c8e99196f88e91cc343a38752c05f5083db13600506
SSDEEP 12288:OcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:OcnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1E95523797965F98BFB2B06F14C828182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 25ac74666d931b67100116a80da4a7df7c782215dca95be860b0124e133901db
MD5 effafa8a34b4d62dbd83507099487cff
SHA1 7d28255743de67be2a6483552b36920b3a8c78d9
SHA512 424d288f0b65e3053c6c1cde9ce43e2d01d493c45095d289203f1c76824dc2c5957f09ee3067ccd9d79ba1c977746ad7df33c5eba60d44f0e1ab6b77c63d0376
SSDEEP 12288:siZwbDzzFEoS2cPvy0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:PZM3zFVSOUnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1DD7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 245187fc703c0e821a8b2396619eb2d57e818f0f908e4bbb4c0b351abc514786
MD5 c04a430c65d0dbe3de0221958fe07b24
SHA1 c51c70c5b0dcffb59d01b1751dcda293575f883c
SHA512 aa89cea458726c606f75c3581ca49f6fe5bc3255bb83cd882803a76599ed53bd0885a0f297724618f82e1c70934300bd61b929d25cf672c30a0f1c35c4f321bd
SSDEEP 12288:ClGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:CFnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1EA5523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 79ba04bfaea2e4542c4d947e05e7be09849ba306ff3947c63e897e8ed63da5ba
MD5 3a08b385520b86c0d87c28607073ce3f
SHA1 3e0b12be4740511ca842fd401a1476805f118de5
SHA512 01c160cbaf005756eeecced1fc28a926e7e8579a8ac4482800524aca71055c84f2be13a639f17274575a22d9d46cc66e48b5ab2beebb9d6955035e8e37eb70e8
SSDEEP 12288:HxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:HBnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1BA5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 3ce608aa70b6323e5b31130a54c070b99339f9614da5863cfebed586a6faac80
MD5 6bc8167e265a0be7a4fae1b27f6fc912
SHA1 8b6b79a551f5469bfe198dc805f228a0ec91588e
SHA512 3b1961f1bcb21f8eafdf56964f5db9555f302046b3e240f208e1b1fb26812be4f02c3b572612c255f60beb06fcb763511b562398902cb751e8d886c895695df3
SSDEEP 12288:0yPz5L8QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:tzywnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T10565021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9bf986bfb47d37a0b07f90d8dc51f1ff582495ec7d809945402adc8b7fa92794
MD5 a569c2717acaa7371eb9afb90fa2dc6e
SHA1 c23454f35c7dad67a0949bdb97d3a37852772e20
SHA512 71d10dda1614ba8488fb1d9cd78c28711e0f024f1ddd795a45aad1de86142ba34e7ce74ab7846c6510fe255ec036b259bf62b8d7ab445552b83801e483f7b106
SSDEEP 12288:NlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:NFnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1555523697964F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 576fabd944558e50d11f8754b9f01f57153fd89a0f29a4380f226772154785a1
MD5 4ae4d656004d52af3d81bcfc3a073eff
SHA1 dfb2fb0614f095238ca907d8dfbd02a0cc44b18b
SHA512 a0e1f8d3d88ef3857ebdd980ad7c436ee5f2e15a3c8abfd67d222349425eaab542228a7b4f8e6929b975b732ded9efca8bec574cca6e82c9638504a76f119eac
SSDEEP 12288:SlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:SFnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1BA5523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 5dd7c050f1a9720acbca5c2258960f4ef8796c0857fac7abe4549688b0e79597
MD5 04da393f71e15e2b170dcd980fb1f0f9
SHA1 3dbd1c2e0aefaf2ab0dc2a3fdda2640d4c58b12d
SHA512 061f7a7895ad7bdc2e86c3821454c30b453c8d8250c035151d194444e0e7da5979fca6026e0b6e256dc283d2bc06faa6eb4fb80ba342ea801d9751924f342ecb
SSDEEP 12288:0yPz5L8QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:tzywnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1E465021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3d879820cb8cd46fc57841f6a462b6e6fee63526b45a745a0ee4b8c378f067e1
MD5 a6e83c5c4dbda307e30f505098b1760d
SHA1 6db5b03d326d3ddf394440c9106553b5a8d3e0b0
SHA512 a1f4b4f389db46072b851e11f14d830d668e8e34d133056c6b84744565389a5743d4bef1600793abadc1175c05c40ba73d09f39cc6af211c4f398cb5a696277f
SSDEEP 24576:XT0aLl3z0zDGnQ/tbw/2Mkjy6Fr7g0oK:XTDLljHQ/lFTjN4
TLSH
T18C7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 79b540cb58e0c70a469e87ebd7add9d64ec55c8c07864fcfe307bc47e8d32293
MD5 342cd932ee1ca6ae6d1a4524b3aa5142
SHA1 04cdbcdc09bf81adc1b102f0334952da643d70c8
SHA512 cc39744ed82d8f0fc2e3f4e91315a053832bb6636172d3d12f2715556716a2be697e997af431c9e3c1fa09db9c36f9e37df8b46c997b06ffc2d5e05bd69ab48c
SSDEEP 24576:G31d9CHKy7GZqnQ/tbw/2Mkjy6Fr7g0oe:o1d9CHKyaoQ/lFTjN4
TLSH
T1E585CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d6229b81d464540f3d77d024c92b122d2a4abb040106d3c17dad6d7049cdd0cb
MD5 ab0ce2e76651f4538e228c493e500215
SHA1 6e69995bc70b857852c7f47050a4435f60d8a34d
SHA512 9e0cadcec1a04dbdd5406ffabd44b2e065889dfe3e2e804080b067a7e9974a8139eb34cd58723e80a63925263c0b61e24204674e4b29192173a082deb3d44830
SSDEEP 12288:QWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:Q2nQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1435523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 26271b5664ac33ce600da5c0db46703923f26cb37696754853cdd3564fc37acb
MD5 3663c0e7b1ec6fee2d125bda9f2dfc7d
SHA1 13cfe478d4e32c29d51f98c30ac504dbc8a45aa3
SHA512 5c25f69a87d35f1da688b872a1c4c293fbaf33575b547e57448e4eb04f6c20207ea90c75e097ba737e8d971607019557c1e1b7634172bd3f7c67aac3a9dd7ab3
SSDEEP 12288:pwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:pQnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1925523797964F89BFA2B06F14C838182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 15af23c8ec656bb1f87ce330e01179bdd8f289a1868047d894a0a41b102013ea
MD5 82c49abde6056c2eb4a8a408de9df8d8
SHA1 27af4f4a88a9a97336647d8fea971da7ce110035
SHA512 2728456d1329ef7645a36ca4aef4b593eaa4db780fa628b9e4825ddd4c719e5704aa175f0ed8ea55caa757e65b29d36cdeb94418a294d4a687a2deb8e6266782
SSDEEP 12288:tvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:tPnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1B35523797964F98BFB1706F14C8281829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d24bb9c3f866e58bda0471c87d71dcd15befa64a9c07e285bf57cd765fe3d46f
MD5 672f699be607fdc697091da1a4059fef
SHA1 6f89f55fe2f5aab86c0605c3f6e0f1be21759ef1
SHA512 74438d60a07e22af38b3f8b5cba61cd3c1cd8169ccc38946661397aaf2b8f6a5ac33ebfff0fd63c28525eb1668c853ccfd6a300c9548e5ee3df4827178792dc2
SSDEEP 12288:tlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:tFnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1B95523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 0ee5e280a97468266d31692b33e69f56ef43928c7f9c605f65f6df2ab20f9d5d
MD5 a89a67036870532996c528d9d5d916c4
SHA1 5e40de629c0a28b0e61899689eab50a0b7fbb1aa
SHA512 5c98435e3819d184dae5205cb9c53903185db7d8621ca49b66400db6b89b051095381762a542f492170884d82389f66eef49239f2e800752f6a78b5ce18a10b6
SSDEEP 12288:VWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:V2nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1115523697965F88BFB1706F14C8281829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 1a77d7ac6c07063218eb7c2874fdd3d1696147d0171a5e6e4a8c783a1d369f05
MD5 ad07a1cf43ea9aaec96357763f8095f4
SHA1 3faecab0aa89d063287c0efa25647a1a3354b47c
SHA512 d6355cdd811d634e868d3990c30b6bc0f676d603f767fcb2b004bb75d046d0c56758b7e7780da6ff18a218ef97cf36a8d653164d9006f4ac30518518a4da2c7f
SSDEEP 12288:ktGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:kNnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1BF5523797964F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 2b2af2b39496d6bf27e379dfa203991124665b182a43581da58d8b785dae2dac
MD5 9cfa0551139e1f81b8601e55f984695f
SHA1 c169b651a4ae7dae3e7171c44e64af409731c707
SHA512 47ffd7cdd9af8d98abcd36e589b698006bdf5786df2a30d6eb50c4f076ab698018303a51862d09b065838d48d9f695c8198d58e3c4d0e74cf47eb46a78586b5c
SSDEEP 12288:TLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:T7nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T14A5523697964F98BFB1706F14C8281829B3B0EC7BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 3956e69c6dd0601c6321634552e6ba53d99d29ef9d544e74d86e3b39f61fe436
MD5 d02edd827dc80bd24b81471481b2b00a
SHA1 0964c022b653c2281a7de9ee8cbbecb70df54e5b
SHA512 24d815f3aaab23626453b307ef6cfadeec6a622aaa0abc696011966ad7f7ca5e0d1a9f5d79030900f17b51721980fe8155e37baedd68586601dc9d8f66e45ba7
SSDEEP 24576:Pfwv/k9RX6wkyAIRnQ/tbw/2Mkjy6Fr7g0o7:+MnYIRQ/lFTjN4
TLSH
T12185DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 22205c1639f0b85c862f9c07ad478dff509204e4a06134b8c8ea568dcf5a68e7
MD5 fa9fa85cb6579064ee769dc51d912678
SHA1 c944acb123e8959ae78bcd1d515e70ec9c39afe9
SHA512 1228337296e8be625c9668d8dcce385e5e938b4b12dffe62e5690e9a87733feecb925114417c79c25a782ca090e883c1243b9408ff6d836ca101497f4440c0db
SSDEEP 49152:sYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yQ/lFTjN4:SySzPlLm
TLSH
T1C8066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 1654c4b6234e468b0b0784f958f3844b25a6e19d2c7cea9667fecff2fc77eb69
MD5 d3b8860ebbf32b594a3592f066d6eee0
SHA1 9a7f5fc881a01a23318d985ca0b5cc8d5f00d163
SHA512 362b7662308796a581554a8f35bf762a5f2567b523beee567cdcdc2924b05a3e3fe0aa1a283cd3f5bc1c28a280c48027a947e6953d763b0dffbaa51bce85eb7c
SSDEEP 24576:i47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYknQ/tbw/2Mkjy6Fr7g0oi:i47JUQj1irIhCnDHUPfF/CQ/lFTjN4
TLSH
T13065AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 1d39706942a4162398d3082b7b62aa455807ff38901345b258997dcffd4e6894
MD5 da073e015aa6eef16f3aefd1d169d410
SHA1 a9a0ae3bd295eeab203cfcd9f5d44e77410dc94c
SHA512 e31ae5e215d785a17c64c5e2b9b4ef0080554f1944c7f3111cb22c0e9d70f71018025d2fa0ee1daa9ef183c157bb7e041d5828fec09e748094ba7792e00e3653
SSDEEP 12288:assfVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:c1nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1E765F119E29852E9D02E1275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 de98d608106cbe4bd0171c4d41f56b523d08fa55b8fa1d5db674e8690e1c1d54
MD5 7ec0d70711ee6ff81cdae64499a16028
SHA1 86c98edeaf3d81a7110d6ee3ba2b4657c6119c41
SHA512 8563ee9ad2420db85906aff87dca99ec02b3bb118cd04ebf764f08ad8847b0c0f734527123688f3be646d6e0d7ba09eda0eca12a64b1c42cfbafcb12bf75aeef
SSDEEP 12288:Hd+aNW0qF/8kVGcsM10q4gUWoILaGa+u:HRTqF/8uGcj10qPUWow
TLSH
T1D33518007666DB4FC66940321E33C5CCAB707D52EE05AB0772C9873FD576A58BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 966a9d928a3d39ecdc6de14efe3bae7a650f12e093e6f3128de0cf564cb07510
MD5 1df0b5efc45c9b01dd608101824c4419
SHA1 83090cace7b6b38be4005def9f3d402ddbe3b7bb
SHA512 49ae3d76acf2c77cf9baf3739edaf31fc9e8cd4de00e725ac99d1eadd1b4247dadba38f00bed8a50bfcaddffbf7b81f6dd8e04d7327a5b6bb07bf2195be7f36c
SSDEEP 24576:ICPV9oXXiwF5Ufthz8zeSUCx7g8+N9eVxma1T:ICoExI
TLSH
T1FB35C7816037A78FD5BB6032072A5B4C7B64EC06B7495F66B3C9053AD82AB51B0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 053385c4e875f07bc7f6d2bfb43205f91241551a87cc9bba2767b5415edf7cf5
MD5 ed477f334713a8444fd12182186747f1
SHA1 9752682151d8570ab4aa3296e73b8d67b111093f
SHA512 e7e6b8dbddec0f3af3bcab342a7a2d722f390b1511b13396b9618108f726f908272761ba150b64f15e077c8dfbf371cba1e1768951cd9ae888c1ade4392ae157
SSDEEP 12288:X67dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:+9nQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1CA5523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c4144c1517dd7e875df0c5c5895af19ca1f895a07407943357dadd4109612a62
MD5 9931278d66df79089353a0656a27f653
SHA1 c53720555a77a77bd1e679cb12971012f1dbaf85
SHA512 80acc3368be7db04fe3bd3989c308d85aad11bf99a92c9492111f316d7bf6d3a41c7e6e7bce96a1851a80c97d2d426aaacb385012a767062feb423157ac07f27
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYHnQ/tbw/2Mkjy6Fr7g0oB:Cgb4mBIBhGFkQ/lFTjN4
TLSH
T19665AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 09d55d6d431e8f723a1b061d91f716368bf4ff31fac1584e7bbe3fd8476ef830
MD5 6d741b4626408a7d91faf93c701b4d71
SHA1 bcf7cca298d8393dc9bfb610a14003649037e7e1
SHA512 0eb17c8b18217e461768f7fe6133432ba2247e5f362367b8440ccfac417c0cbfd09bd6d033ba4319514f105c90391664d866693a45b40eb23acc69d894408bfa
SSDEEP 24576:OG88u8FpJqH1Qzria7/mUnQ/tbw/2Mkjy6Fr7g0oq:F7ZFPqVva7/vQ/lFTjN4
TLSH
T11885F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e7408830f5e500d989ea22349df5bb23c15f112046597022873044008bb11c5c
MD5 47e50bce2ad36d030d4bd4740bd6d3fa
SHA1 602f241866ff9e222133b86d9f2ab57bd791cbf2
SHA512 fbd68481b276e6f73c6efe87f77341c073304c087e841171b60daf8e5fd732a84f95d251ccc93a97d63ddee18a817a9d0aa48cbf2aa3070b97aaa44aae0a8a69
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYQ/lFTjN4:yG05lO43bOLm
TLSH
T1D8D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6799293e8d46466ff6da53da39d1f3efe40ec720fd89ea1aba3afd9533a30b17
MD5 68315a3a764be7b853408a807714db21
SHA1 36e7a68eebc74ecb2d1fb6b968cc4f37f6561d19
SHA512 b442ca50143fb44980e20b702e77eca1c4fb8fda63a9f98d582fd99432f642e91a7c3f0d9e8f65fe799be91b22054cef55b42cfc43f0cd0412c67635e76952e3
SSDEEP 24576:ufa5POZ3dpFWVM50JicR2hG0lasx2+47eidnynQ/tbw/2Mkjy6Fr7g0oP:2a5POZ3+Jt2pasx2+mQQ/lFTjN4
TLSH
T1DA65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 20e2d4a42794ea03e59cd2a719af3294138ac772038893954220f5d7174f891c
MD5 7a145d7f03599883a10eec089a2e5e6a
SHA1 4993cf0c04da0862559268d92cc39a361878a682
SHA512 2e1678c74bf57fc4a545cc0ec44c5b1668ab66bea129b1f8e8392a7e774153c8b68689d9fe881845883a6613e55813840486d9965883bbc195b11c60921b0fa6
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkMnQ/tbw/2Mkjy6Fr7g0oy:VNc/zEOVHFPQ/lFTjN4
TLSH
T165858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 edd835bb156538c7b08d43449a49b5848f53fda094f1d00e164f2dca34e42b3d
MD5 e922f009f4d33b7e9663b9f2fd5fd7d1
SHA1 a0615cb02cfc8892ef46a60131432bef85ae551c
SHA512 aff748d727f52807ca448eeaa89a00849ee2362445c0ae44b515c8480c0aed841ba84bd8007d224a7e67bb26a49c097a13446d99746fbbe4bcb32825fb03a304
SSDEEP 24576:O8kNvNnaFeYhJNtmZBm5nQ/tbw/2Mkjy6Fr7g0o1:O8MwBtOm5Q/lFTjN4
TLSH
T15155AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 679b65d011eecbecb2ff665fe8508118fd6131fc0f43079007fae47131d1f183
MD5 372395448a5ff9b78e19994cbd9d680a
SHA1 38f23c487b2962b8921f69f6dfc4f085edb0a34f
SHA512 8b3560d7dcd92e6a40e8f2921785f4147f7c8ad732660181004b421d75b40b7565040ffd5a9f437e3ab64e6227497fa6531abf7bb5eb64cbbecbc4d7a759ed67
SSDEEP 12288:aHvUrBFrEjwaQoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:aPUr+NQonQ/tbw/2Mkjy6Fr7g0o2
TLSH
T12E65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a97b6bea875b38a33b8dc740fee09fbc0050b5daaedec3e09abdff491deeb495
MD5 202689097ce9178da935dcef5dfd9720
SHA1 dd7590bcbcd8adc5964631f3cddb9493ed7cb7bb
SHA512 7eb700260b1b22e61ddeda03d1e3278fef96c6fbab6ff099f13330538489b8e560119a5e4d3158823c51d5c5a52c63d41742fc77082efd65a07f16f06b94ba64
SSDEEP 24576:jD3FHshBIYQgApnQ/tbw/2Mkjy6Fr7g0oV:jDVHeBIAApQ/lFTjN4
TLSH
T1B475E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/764-14-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/764-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/764-22-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1848-104-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1848-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1848-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1848-316-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1848-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1848-110-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2264-296-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2264-58-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2264-64-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2264-57-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2736-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2736-178-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2736-131-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2736-176-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2736-137-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2832-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2832-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2832-122-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2832-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2832-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2832-42-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3452-115-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3452-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3452-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3452-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3452-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4448-0-0x0000000000400000-0x000000000054B000-memory.dmp

Download

memory/4448-7-0x0000000002280000-0x00000000022E6000-memory.dmp

Download

memory/4448-6-0x0000000002280000-0x00000000022E6000-memory.dmp

Download

memory/4448-1-0x0000000002280000-0x00000000022E6000-memory.dmp

Download

memory/4448-39-0x0000000000400000-0x000000000054B000-memory.dmp

Download

memory/4536-332-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4536-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4536-91-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4536-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4536-97-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4536-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4628-312-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4628-80-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4628-86-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/4628-81-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/4656-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4656-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4656-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4656-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4956-116-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4956-315-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4956-125-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4956-118-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5060-311-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5060-70-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/5060-76-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/5060-68-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/6036-330-0x00000286B3A60000-0x00000286B3BE3000-memory.dmp

Download

memory/6036-399-0x00000286B3A60000-0x00000286B3BE3000-memory.dmp

Download