728bd47971bb954e853648ba0ec9389d6247266acddf7f93d03a89ec5ee075f2

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
Size 665KB
Sample261104-x3bedaee56
SHA256 728bd47971bb954e853648ba0ec9389d6247266acddf7f93d03a89ec5ee075f2
MD5 5e58b98a1cf3eb1655f9fbf7a539da01
SHA1 4e9a04457099a0ec1612e8cad6ce11956435c712
SHA512 0a8e118f848841595b5773a0582431f0dd169880b8057d791fa1bab8c6ce6b787169f2d96dcc2dbb2bf9a9a034b3a020f8de57de76c6d81944fb0d4a3aa32eab
SSDEEP 12288:sWkCC5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:sGC5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T149E4124C3960D477C50907B346B6D9A88A0EAC626E24549BFBDC374ABF33DFE4636016
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
5116	elevation_service.exe
4560	elevation_service.exe
5324	BLuPro.exe
3344	maintenanceservice.exe
2176	OSE.EXE
3352	PerceptionSimulationService.exe
3608	perfhost.exe
2784	ReFsDedupSvc.exe
5616	SensorDataService.exe
2616	ssh-agent.exe
4912	AgentService.exe
1628	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BLuPro = "C:\\Program Files (x86)\\BLuPro\\BLuPro.exe"	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BLuPro = "C:\\Program Files (x86)\\BLuPro\\BLuPro.exe"	BLuPro.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ebaf0ebf4b315ee3.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BLuPro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048f8af1a926cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed0867d9916cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8cb05da916cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000acc2561a926cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eac6dfda916cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009def25da916cdd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe
4560	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1396	2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
Token: SeAssignPrimaryTokenPrivilege	4912	AgentService.exe
Token: 33	1628	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1628	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1628	SearchIndexer.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5116	elevation_service.exe
Token: SeDebugPrivilege	4560	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1788	1628	SearchIndexer.exe	104
PID 1628 wrote to memory of 2840	1628	SearchIndexer.exe	106
PID 1628 wrote to memory of 3492	1628	SearchIndexer.exe	107
PID 1628 wrote to memory of 2884	1628	SearchIndexer.exe	108
PID 1628 wrote to memory of 1692	1628	SearchIndexer.exe	112
PID 1628 wrote to memory of 4936	1628	SearchIndexer.exe	113
PID 1628 wrote to memory of 3876	1628	SearchIndexer.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_5e58b98a1cf3eb1655f9fbf7a539da01_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Program Files (x86)\BLuPro\BLuPro.exe
"C:\Program Files (x86)\BLuPro\BLuPro.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5324

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3344

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2176

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3352

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3608

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5616

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2616

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1788
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1262770251-41185387-1005173349-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BLuPro.exe

Path C:\Program Files (x86)\BLuPro\BLuPro.exe
Size 665KB
SHA256 728bd47971bb954e853648ba0ec9389d6247266acddf7f93d03a89ec5ee075f2
MD5 5e58b98a1cf3eb1655f9fbf7a539da01
SHA1 4e9a04457099a0ec1612e8cad6ce11956435c712
SHA512 0a8e118f848841595b5773a0582431f0dd169880b8057d791fa1bab8c6ce6b787169f2d96dcc2dbb2bf9a9a034b3a020f8de57de76c6d81944fb0d4a3aa32eab
SSDEEP 12288:sWkCC5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:sGC5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T149E4124C3960D477C50907B346B6D9A88A0EAC626E24549BFBDC374ABF33DFE4636016
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cb15831315e85352d9829100fa24f3f12f419aa97adba312241f8f67e2530bd4
MD5 07f7e02ab0ef085e404f287d954b3b13
SHA1 6bdb6109f07a89a44cb9b6faa150f65bd468a352
SHA512 fd24d2ce468f67a5caed4a8fec3a0d827e1a4f979b8d9c87d811014edbe8b6f896c2db013efed70031f7d5ad02243d28ff072c89f6274ab651eb53e27882efad
SSDEEP 49152:Lb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnG5SW6H8DS52tdDpbRZy:Z3q6sjBr5SSDntdDpbRZy
TLSH
T11DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 0aa80d57eac4491f9f68690ff16fbd24bad8fe506170e258047e302339b200b3
MD5 305985a492e831506e610684ce96fc70
SHA1 2b082414428e7f7941ac0e45d00ad1bc49e5259c
SHA512 a1ce0883c73d486b4f4649e8d30399056b9569c2eff671f14d52047f267733303386a813f298526c3abf8ac6603aa64294fd143cfbf61655737bad2b729ce43c
SSDEEP 24576:VXYfDtczAP5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:AtcI5SW6H8DS52tdDpbRZy
TLSH
T19405022873D008FAED6B8279C8B28511E633B8954360E79B03F499664F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 410cc5a27b2775dbbde25d409a1f72f82408dff1beb193765f6eefc31110c30c
MD5 23aa7fd443248e9371d7dd120ac17d5c
SHA1 0570598dcda8e2ec46efe6a492fbb4a2b7dbf2c7
SHA512 57ef7a12ca7afe40dccba973eb3aa31dac9eb6ebf5fbb9c16665671b8a62d38852533d4a11d6be50903b9a576de4604380d1898dabcfa1f33bf44cec28bf9c06
SSDEEP 24576:r0Le5ji0hmxxrMe5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:rPji0Aj15SW6H8DS52tdDpbRZy
TLSH
T1A835AE55F6748332D073C0BAC5D2A68EE971308657308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 381d64c70905cd09da217f004a598a459d7e827faefa03f7abcb247b1891faab
MD5 b26157b4d0e37d485d99db7c5769af81
SHA1 13e398c03a7eeb8105eb31cd8d9a41cdf3df309b
SHA512 b9badf5edf463232b59ccab3dc1ef109e94c38d311f08d7f2dc131c6be6efb172e1868bb28cbb860a993649476df5a7656078334c10d65c26619d6ad7dabf0db
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWn6q8wyu45SSiVw6uAX8DS52tpz9ZRzbPmSZyo:U/ezSC6vUzPveHjy55SW6H8DS52tdDpO
TLSH
T1D2755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3970c4a21d6c6be921f2b2a0b5a58b73afd2f55e08edb8e4dff74378334a7595
MD5 c190097812d5b39fad9bc17db8d05509
SHA1 24355d395ac4e0f08cd7e6ebf4dbda256fb37b32
SHA512 c13a449d62480e57952fa985d43c1fbd7fc7dd0964f06da12869a554ee2cfb55e4324169140d8cf5afc15ba904aa54e53878f223cacbd7cd8a8ff0a5ad899b05
SSDEEP 24576:bVbqPb88hv/l+Yb5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:bVO88hXl+A5SW6H8DS52tdDpbRZy
TLSH
T137559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 1d0ea6ad34f8504811b8e59ca89e7721c0d0a7e7fa86c12c2f689d18898f9454
MD5 2ceb0910430dc4b7c2bff3af6d4f5623
SHA1 a8f18aed44eda2d5226877824ee996527c741246
SHA512 d7e14194bb6cc1f724ebe0e20be38922872031f83576e222f1887405eac7a50b28f0c065010c0974cacc92dbbc7ad5b9a900873b82bb6203a2cca5f929550bce
SSDEEP 12288:xL65OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:xL65SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1F0C423C0479070E7E71F0AF3B1FA96D4CA19DDED8408563B4E717A8B8A3994FC672426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9fc5b7399d1cb06b2bcdfde5dfa8d78c093e95f34a61eebfda710ebd849b4384
MD5 4e7e0887c0462644f1c59d9a0e3fa96a
SHA1 0318f1567759be04fcfeda22fc328745783a2df9
SHA512 8b57935a25d864e62c79a6c2e83fe1b2ec4f53e21898767443aa548a34a42923c44a3d13d53670a7b8248385acf2cfa96333fec62eccf967cf474ed6dde4b15a
SSDEEP 24576:zJIUT5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:zJIUT5SW6H8DS52tdDpbRZy
TLSH
T17B05DF7BEE28FCE2C27E8DB956918640D77278704B11A3CBD174820EDE235E54E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5bb5a34b2b90ae6550a70068baad314124d16109adbeff35a7158111107c9574
MD5 a7a4cf64074aa175373ff292d8cdc9d1
SHA1 b974be7758c9529e11a3db585aaa973b4cb206b6
SHA512 dad3d6a44eb0bccb6b7c79d49b4596551c449b8343e48aaa5c968647fccb54543b4caef7b9feaf13f66843ed61f35a9da1a35163ac11f1f33529953ee8d6d522
SSDEEP 98304:+QvGAdlCEL8c/DRNw5Co5SSDntdDpbRZy:PvyEYc/D3w8+SintdDFRo
TLSH
T153267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 f87befd649098518e17f2f75ecc54f007acd75a2bef94c12a108df14b51c4b7a
MD5 6dc4597abc5929e7ecc4d1ca263822f7
SHA1 424ffa505fedaa1bcb50003e9625e26ccef2024a
SHA512 a6f892dc1ce61571169387ba824cea7e9ec5ca9112dd10dcde8ef0a01836df94eba7ab304701f74c0b1ee9fb8887c2691f4350ebd462d89006426e7441766272
SSDEEP 24576:E0ewsAjl5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Zljl5SW6H8DS52tdDpbRZy
TLSH
T11815E031FB74E036C37F0DB22B76C716582DB9604B511AC3E3A89E8E59342D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ade877af2b475a528ad3521b42e9cadf8fd0bd0f38e456f13ad6a4e51934f1d4
MD5 2ff6af084d0dccafce4d48cf888a7a76
SHA1 1c9d8e765cab8ef18c3980caad0038b6ab039fb0
SHA512 ee5a0b0105ff36f2138614db9d7128f455dc2a3a0ac8e0ce3dd6cc38b9cffc96f47bad374d0aeca11213d639826701cee824297728519181ae59d53487371ca3
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH/SintdDFRo:0UEtQevvqc2W1cpV2tI326edDFRo
TLSH
T1AF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3225baf7b80c9a195a9d2e102c9bcb15296a2ee26e5ceb30af3adc9abc86b6cf
MD5 141eb0d198a742cc71a8a5a2a49724cc
SHA1 bc0486b4bed7b465f553da5ef13e92733f4cd7c2
SHA512 c6dc0bfb09ff3b91c845dab6146346cce84f8170eed8f32203d79d476082162bfd96851a54b20000e50f4eb2826f1f3b1dc1fd018fae9f2a9d9d1e12713e8eca
SSDEEP 49152:nCbRquA/m2yL5zLfFiV+XenmE3/zF5SW6H8DS52tdDpbRZy:woq2Vjnm85SSDntdDpbRZy
TLSH
T183D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a9c199a56a0e5364999d4fc5e96f558ed6d94090f2fc59c567e288bce2beccc2
MD5 843f25ee8a7015a1cdfd597472f2809b
SHA1 a56389a7b317085e6145cb878e958423239b78f0
SHA512 4ca3f08b8e15bd44104a2cbd8d8479db4c8c897bafcead57653d1a2d6b05e3b98b82a7bff057b3b8cfc38731b2dd735a2da0f1676113ac9e76b60f886864f9ce
SSDEEP 24576:TAhGL3IFoiwtA5l7S53c5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:TAMUFoiq5s5SW6H8DS52tdDpbRZy
TLSH
T1BC35AE80E7F955D4F5B7AAB899B68171EA76BCAA5E30C21F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 81a532729c8929a0c9c4df1c60cad6d664cab58cc87078d4c9cb67d88cdb3fb5
MD5 549c95fcb8b1675e1f5a2e708db60ab7
SHA1 d4d4ffbe9eccdf4ed65ab13b5d7614a02ce586c0
SHA512 804010f61b9c39c1090eb2900f20e44925ce6dea2ba07bfe2b74d1df5796c03df245eff8506d5153dce8f053faf1861274d252adad9b8403b0bb1f886a4cb28f
SSDEEP 24576:pwu4OWZ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:pwvOQ5SW6H8DS52tdDpbRZy
TLSH
T15105F14533A41CFAE96B4239C597C136E7B2B8162A24D72F0770C65B5F37252AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 fb0f5fb5b1a132b1c541e1328387dd23a51d282ca092e6cd4879e04bc6c5bfd8
MD5 f279b6f2dcad71cd56818898307d9357
SHA1 f4dd5e9b1ca622a8697cd74bc97e6e0d8ff1244a
SHA512 2b1d85401f27507af5b04fcc820ac47a5a769ec521e827251d3dbbb5462e2548567b0eb71e206af9cacdeb912ba7ae87606e642b8bb696bd6b9fe63396960edd
SSDEEP 12288:aeZ1IyV5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:3Zu25SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1BDE4128923E030FBE25B427AD9F54685D772B4A6533443DF0A60469B5F33AC74E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 257288f70c6390fff7f79b21ebb181b8889badea27bed82068c083f187b52e8b
MD5 889ce53dd9dcceb4c49f8c79478342e2
SHA1 fbf8a38c187b57abf276b2ad28150d9dd316a8af
SHA512 ffbf39dcf67f527c962c5e2b88a09ffd0ef081823a885de443b0875fee376220235beb20b2418114e5a20128b9536a2c8491adea73227d3fbd88003afe95d42c
SSDEEP 98304:UQRQyi36YOcPbLvw2gAf+PN3H5SSDntdDpbRZy:7QyiKa/X+PNpSintdDFRo
TLSH
T144667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0fa4ccc92070b010e03b78b361080f3d024ab64b1894bda3b7d3c4fba9deb3a8
MD5 e09d1fed246e97656b58f4023026024a
SHA1 584bccd3ae2ddc5b92e83d2f1b65281044b6f5b5
SHA512 7eb774d9e28b27034de239e9a93129a11cbfb276732dbd190e7b470caef2227434c0623c0299be195bac339a7efa52af6c5586d6fb4d84eeb2de081a7b305bfd
SSDEEP 98304:hQRQyi36YOcPbLvw2gAf+PN3H5SSDntdDpbRZy:4QyiKa/X+PNpSintdDFRo
TLSH
T1BB667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 49939873df4c8ce3c582d57fc0daf6ca6a9cc198803625a2f4adcd7d6d92acc0
MD5 ec5255a9fb2c4d8cebd5795618fa1746
SHA1 1a8fcfcb7764fe016aee7b1fd5a0efa60cf45af3
SHA512 60ffe981c4d738d713b8a9f90532b5577d6b34673617090120ddbd6039c6ad125d775a0d207baaf8afe60b0c67a4d7a0b5705910bf70cea552419499ac5694dc
SSDEEP 49152:k68Qg55nhceWu7PNU3/15SW6H8DS52tdDpbRZy:OthLRc/15SSDntdDpbRZy
TLSH
T1FBB54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f8b637ee8bf2ebf232d837d05ec259bec49064db7eaa81c5a28f822327d4c877
MD5 69ac3ad3f3a15ccaf6c61297706259fb
SHA1 0ce6457e7941b147a347074bdf7ef4abde540851
SHA512 581ecd827c15a36c441c9953f6061ab6d5cb672bb83b849e9777cd608a3aa8be9fdfaac113b73b5727a936e267228fbcaaee152c76a4ef989e1ecc9e45140714
SSDEEP 98304:vy5112gYy5azzVvt69nLKnhZ65SSDntdDpbRZy:iLIHEWhqSintdDFRo
TLSH
T101167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 78287e99666f3cfa82fd65d800096f0056052200358f8e4603890cc8fda863eb
MD5 e26da4b53ac1e5b28cd45753c3285436
SHA1 d2d3a90f7693e8cf73e5cae6e3651adc356cf5f6
SHA512 9d763967ac9fc8ec3b6c744820e64302a4807e48c2a0e99887597af76ce709f339a4ae08f065057fcc26b682256d52e1a00c5b9ea0c43f2e3d23ca275435251c
SSDEEP 49152:fB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glf5SW6H8DS52tdDpbRZy:hu6Jmdxd2df5SSDntdDpbRZy
TLSH
T168D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 37dbc0b1d1756d9e38224a8564739862be81348bc41760e827e8fa447d1173c3
MD5 38282eefdbb9646d2bb3cb1eceb653a6
SHA1 bcff973de20df806d1b44060575a9b89151355ac
SHA512 900269077c43ecbc58eaabde422110a650161619e637785eb41d950e0f2857f98afd0bd9ab476939e78217c6e5f5c04c71b768983b2fafcc475b7899ae3cd47c
SSDEEP 49152:i1hpsNoJpF1A63U44CwH7R4xz5SW6H8DS52tdDpbRZy:imifPWR85SSDntdDpbRZy
TLSH
T152B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 60aba36c1f6a1102506ba7d8af31d92fd24cfc46614180b8f956e3c42119fa39
MD5 40ea30dfff83f537d1558df230bfb421
SHA1 e66a402d8ca881ad8f840ac81c3077c9137a884a
SHA512 2599efa4f7099fe6a9e0d95b16a3fbe7e3c925b37416bf8057a8edde7fabafc86969e79a1b9fa8d36055e629d9d6427c49141292f3c8055e23e3e2b79dcbfe7a
SSDEEP 49152:jSuZQIY0Be2KcRVtOnks6NMHq25SW6H8DS52tdDpbRZy:B5dKii6125SSDntdDpbRZy
TLSH
T18DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 54af1e221e2ef3add2e9eb5e5aab598453de41a52a058eac044014a764594758
MD5 7de9530a60c75b4b65397050cd7b2fd2
SHA1 caa8b34e5962eca9bf2b13f2029c48f1dbae9cb8
SHA512 ca2b182dae2c39f645fdd54c7a2fb9d0e252fae9e2573e61defea27a7c46135789e934a073e16f983f9dda3a89a1faef2adaa7ee95c2ddd2c981532cf934a3dd
SSDEEP 49152:PhtSn8EApI0fig3giDn0AP5wP5SW6H8DS52tdDpbRZy:eX2imphw5SSDntdDpbRZy
TLSH
T17B95BE13F2D900E8D05ED175C7568632EA62BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 68173c8a08bc61e1a620fb10864841897c89a2bd0c1343d2e560a747486375f8
MD5 f9221d3a80261afd715955bc14fdf2df
SHA1 0d6af1a8bd9ec1fe1e09a1e21b19af5db09a0801
SHA512 839e9343a5c5901c396a1a228bc6cad76950c9586ab0f26878121ff9f0dde2cf32d94cb350df8b2041c0bc28bc82277d6ade07a7dc757d8613f09ac11fc1ef28
SSDEEP 12288:oS5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:oS5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1DDC423C457A161A7E30E0AF3E1F682D8CA0CA6EFE408523B5E71A547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 ff1f8b9beacc2e6da5644ee9a565ab3baab55efd1e97a1c0c1773b64cfd147df
MD5 facd03af9ac2031ff4141e178132e673
SHA1 09a53df8d254cd7b9dba6992f6d38755d26c6dce
SHA512 697476dfd5bf6fd23b02bcfb97ec9017fba6c3598d57242925719e81aac47ca22e4d3942ca7d1cfa36616760d8d707876969d67a15730984272f37b66e3c35ac
SSDEEP 12288:CB5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:CB5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T12EC423C457A161A7E30E0AF3E1F682D8CA0CE6EFE408523B5E71A547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 7d6f84d096a32cb7743ef58306b7b1d1dbddfb5e7cd1a5c2b8fffa9315df530e
MD5 c9be6bfd47aeda94750fc8156853655b
SHA1 7e5d701e81a40565da032f9ad222a9c8519c8fe4
SHA512 79607bf60b7a1ad0e357d56a1ef0049cda78f614c958af54ef9352d09999f722a971aa5509b9a9281da93fd26901317b28116bfdfbf15095015fa55300ea8ed6
SSDEEP 12288:Gr5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Gr5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1A5C423C457A161A7E30E0AF3E1F682D8CA0CE6EFE408523B5E71A547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 3982023f5abbda68057b7515bf67a6b4924d79ecdf37c3d8bbfa53ff0c9d129e
MD5 4d4c389004666808b4a8b92e61655e60
SHA1 9bd7112537e620b4413d9efbe2bb1cb4465d8607
SHA512 ee0062b38646037f0c2e21f6a0df5edf55d54d92ed8559d5dc6eb11e95437df3487e2a4f25823b66f46c219cd92f6a25df262a4dfc39aa2ab889e89808d1a86d
SSDEEP 12288:qV85OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:R5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T149D4238027A121E7E61F86F3D1F682D4D729F9EED124637F4F20494B4F31A8B8935A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 5863b671069bd7705c07c929828daa758707452bd19f1a3ba7ae1ca05790b713
MD5 15e645cf4c7c9bcd27941ccc30635b79
SHA1 b8cb8499857d2e301db9eab1a7a2745789c11dd0
SHA512 62140ee21a15f95545f644dea9d969477770698c59194a4f98d218e5d9b6631654a986d7f89d53565acf269a5f79c28bfd6bdcdb93a25bca49080aa135bf8cf9
SSDEEP 12288:kE5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:kE5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T104C423C057A161A7E30E0AF3E1F682D8CA0CA6EFE408523B5E71A547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 dd449d6afc613e206da9da40311c880ed7c417b7a5a9e93a85cf95d9818fa592
MD5 35cf9cffe4d66cca310294ecc15c889d
SHA1 1652c72a4d665e7659a7f91c73648b261d4dc02f
SHA512 b1c6e59b25bbe820d2161e8e24a1f11250569984965b01371638f696e9afffea45aed3fd6d0407abdf4e8209bcde744f091a3a1dceb96040e131464c9adeb275
SSDEEP 12288:Sd5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Sd5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T11BC423C457A161ABE30E06F3E1F682D8CA0CE6EFE408523B5E71A547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 7af7872f547b879708fa13e28e95f49c002855a4162d2c57134f81643cee649a
MD5 2865f8ab552044090ce686809165aaa8
SHA1 a80a269deb596f4e79b6234c71833192975696b4
SHA512 4d0d1138b42a9b65220d6d9bff5a4b9470b6f16413a2343ba5e9708c93af452dd0ee709e42060ab2cfee7a4e0e790af8df00f8fa5eb41f60dbb38fccc342daa0
SSDEEP 12288:np5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:np5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T141C423C057A161A7E30E06F3E2F686E8CA0CE6EFE408523B5E719547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 727d40af9fa1b0f7018a7d5cbe5f074b54ab59fade13c9df1683d3eae97c8868
MD5 9864e415c4a6846502437433eecbaa9e
SHA1 d410248ac58881413da2a68112caef0df4b273d3
SHA512 925fe1d0dc41559b4faa65d04500eeadc13cc02b52ed762349d04ae40a8b62faf2ad4d4d1032d41d03e4c38989d22b308f1b1e6dbc505cfec8448cdb2e493e11
SSDEEP 24576:xZMRzFVSOh5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:xZMRzfN5SW6H8DS52tdDpbRZy
TLSH
T1B0050294B39018F9EC67823FC9658945D6B2BC5A0760C62F07B436675F333920D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 67b79d79e3cf036b13bf1536e4dc37e806876b1c673bdb5bbc3ce5a3923d8541
MD5 8fc765d30309e697254fdc08e0f48e3c
SHA1 64c964924088462bbb2d3547ae6827dcaf16c678
SHA512 87e5cb16e956108c3bb5a6a7881aea3bccf7c2359c6e8d484d2d0d08a07ccadb7f0a148214a733974df09ae161b830c97fb3ccf40a99ee7cc1d0c682400f5746
SSDEEP 12288:um5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:um5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T112C423C457A161A7E30E06F3E1F686D8CA0CE6EFE008623B5E71A547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a90aad3b22d888e822ed3f9e71e00e14687734d0a8d8d0e144b68b5f92414a7e
MD5 ddaa11f9b5dc1d7b71faaf089c5e4938
SHA1 3a763e7790641228626f219f68d63ab7f209f611
SHA512 a4486ddcb3a01bbe4270dba0833783bd910dfdfdda890c97956b7735527ef78367d0a6008bb75c5ea7d539b49623e246809974de2d0e3f1701aec379330397d4
SSDEEP 12288:Fq5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Fq5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1F8C423C457A161A7E30E06F3E2F686D8CA0CE6EFE008623B5E719547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 d055fa29aa1c2142b4ffdd148bbd76068eda3dbdbf3fccd9306e5a393b71b6cf
MD5 c0f8252d574889d384dd8647a5b1e1f7
SHA1 1ad6b88023068fffa969c5f5ef62a2d69da2b2c9
SHA512 ef42f8c946b52f1acc711407177b9a9487c609107eb6992247cfd835a76041c3d7fe39e85ac446cca8f1a7479be20f31f36a2c7cd2c72520fabe8864ffbcd369
SSDEEP 12288:ByPz5L8V5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:QzyV5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T160F4124773A130FAD12B4276C8A20A41F775B87647248ABF1BA047771F376D59E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 888ed6ea0c84477e82bbe9ad1f9753a31ba121e870aae83be67840aa6c6084dd
MD5 b81100b57d0c7b6a8d9dacb60ad399d6
SHA1 1a6370a26d201806a4dc77dcccb9e5c3e57f225c
SHA512 fc01ebf928f96bac80c4af03944bff1bc0b89dc101a89abb03cb498dcdde7540d9865528b4da13a6eda8cab9fcb07888b218d08eefacd32b397906ad8c50a45f
SSDEEP 12288:pm5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:pm5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1BFC423C457A161A7E30E06F3E1F686D8CA0CE6EFE008623B5E719547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 0dce73cfa4223a0b8daac7cacc62cc378ab529256ae54f65615797e557b744a3
MD5 22468ed5f4054230b48f67cd0ae42a4e
SHA1 f52a92aa36a0c6d7d61abc272941e427873bdae5
SHA512 cd18ea0f0ca16002749c3b38f13e6c0af55118de4831a39dd418617a4e70747da6bc6a61d321a840c9b94113bf04e79f945d0d4ff09561a4357699b71f82df13
SSDEEP 12288:qm5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:qm5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1FAC423C457A161A7E30E0AF3E1F686D8CA0CE6EFE008623B5E719547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 80dbb00236700324ff9097cd1d90f25e1b2f550e6b68ae93e25b0c59a60c5740
MD5 6e52a7d328c929440e703d50c291d7ca
SHA1 f013e57219771e7355b6a06389ee8f5aa731a953
SHA512 b8d8ab7253bb0709d487f9915a7a59cde72b52e3c66ce58f6bcac8ae52e248bec0cd748c61825feb61bb0b243e8aad77617e7607cbdac3d7072ecc10a0e697d6
SSDEEP 12288:yyPz5L8V5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:vzyV5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T119F4124773A130FAD12B4276C8A20A41F775B87647248ABF1BA047771F376D59E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a8666954f0ec5e243b7fbe9a66017ececc6d82c937f6c78f7a3edfa0c358e121
MD5 152b8a911d79465a06dc6cb8ad3f963f
SHA1 36d4965920c3b33baa6f1f7ceb5b0d4531f084d5
SHA512 69113e21143ea538942afc36a573c741266e0b8d7c1b15fc10606ddac3d66a0de657581655e607971028409fe1fff8db65692c0e98a35b8ddbea5f9b3ac55817
SSDEEP 24576:TTDaLl3z0zD75SSiVw6uAX8DS52tpz9ZRzbPmSZyo:TTuLlj45SW6H8DS52tdDpbRZy
TLSH
T181050294B39018F9EC6B817FC9658946D2B2BC5A0760C62F07B436575F333A10D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 21ac074e79259eafb10fa7bc432b9e08be6c044e36cba400694e156b3ae11bb8
MD5 9a2df7168d63aba742560e81867e994f
SHA1 c5775587ec8ffe06691f64212ac65dacbbba2794
SHA512 e15f95a3b2575412db06cc9139a171a127a2a0baaaacc4cbafa15cb593e71cc3a1e5b8aa2c76f0c1b946ea5d5195c0e68dc1edfd8f90306f359b9c6c741fbaff
SSDEEP 24576:A3vd9CHKy7GZn5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Kvd9CHKyaN5SW6H8DS52tdDpbRZy
TLSH
T1F725CF90F3E410E9F1B78A35C9768511DA767C9A5B30DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 9cb54bf75bb1b44147a7a4e049d12abb5c687435b3ad248418091345ddda38aa
MD5 c01c1fa6e42c539758658ea7f5ed2d0e
SHA1 b393eb2634852b02f984d2e745486567cd3454e7
SHA512 08a5329b0a9da07fd78df0becf8836fa4b30aa074abb64e965afafd2a4aebbc426ae4c6597528f24b4c7536a6f3cff949d7d94f2f7199491a3c6a7fdcc297cac
SSDEEP 12288:5L5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:5L5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1A3C423C457A161A7E30E0AF3E1F682D8CA0CA6EFE408523B5E71A547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 7697a6af5da253c2aef3eaf44f884f166670a524c2ec9dc1244dfab1278058bf
MD5 60d2d4766bbc5ce5e1b1fe9baf3bc81f
SHA1 161c36bc9c5a2ffa376e56f82e955d5f6689eb04
SHA512 9d8483437f96299324f13361687d74740c44b008fb3d5eed17a5f81a36021c039ec3cca00346250785f678af1bb0d6cf3fef9ae6c1b811c22771122d4a436c1d
SSDEEP 12288:115OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:115SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1D6C423C457A161FBE30E06F3E1F686D4CA0CA6EFE408523B5E71A5478B39D8F4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 91d7e3262b81d9abb67afd01a5756684ac3c5bb1216fab5f6ce293e606467fa1
MD5 23540da6540bfbdd94f4d6f71c6c85cc
SHA1 d4d265af31bb09108759368eb41b6ad48213679e
SHA512 1186c25aae502f040255dab1326da4b07234949c079544eca61f23b4f6c4c0dda531703be67356a871a48b0f2476db2e1ac8c3f5116bc37b06e2f57997443ec4
SSDEEP 12288:Sg5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Sg5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T19FC423C057A161A7E30E06F3E2F686D8CA0CE6EFE008623B5E719547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 83a813b15da3376e15f4b4e49930cb5993672efae6fe84a4100604d7953ca698
MD5 cfe6e92895a4216339a2ba1901756c02
SHA1 ab18f557af5b448c5299074716f554573d87d937
SHA512 dabdd2a10bfadebca82657e696ced9a831b99a56fa95ff873b39885167c2cb1b770fd16bc6fd551aad7fe9fba3f8105647e13dfc128231106c7a5f524a92b34d
SSDEEP 12288:om5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:om5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1D3C423C457A161A7E30E06F3E1F686D8CA0CE6EFE408523B5E719547CB35C8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 f6f90da7d1abbad8ac8aac25388ef5ed6258e4927b77fa060f8a28a08535b022
MD5 02c6f240b812c6818f4af617b0cedee4
SHA1 6ff9234b2dd91d52973221137042cc065a743998
SHA512 dafefcab1766e613f45998be62aea80c8844b66295fcc7556ecc2ce5e815401fd014e08ab7de3488b83dbb0c6deafa23a8a99f804ba0bb1d70f4919be7ac54d1
SSDEEP 12288:rL5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:rL5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T12FC423C057A161A7E30E0AF3E1F686D8CA0CA6EFE408523B5E71A547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 9f524b911c1400924211e0b55eaa69429846e40ebd26ecf938a6c04b6e78e1bd
MD5 d5bb53a326d304f5ac0e413b096b4097
SHA1 d022b9b87c19562ad3a683af832959795344714b
SHA512 78e1f77cfcaa490b417de4d130c871bc61b99a58bce9a7663121e67979b748cb35cef5e00ee38e8fd029ed9f12ba5f94b0f4ae647033ae1081ffb183cbe097ba
SSDEEP 12288:cu5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:cu5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T14BC423C457A161EBE30E06F3E2F686D4CA0CA6EFE008523B5E71A547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 75971b6d11c815a5fc30dce75c0b0bf31d29c2a32709c4bc21655298c2f5bc94
MD5 e21726185b7d64d7e9133765e0f6c725
SHA1 476b23dd7f36f544961a4e128ff742d7034bf14d
SHA512 bb34b692b276827224336f16f4eb210d690f0f5942ba9ef1fd14fbfe2c73113a46ced7412afe725bd23aac9164aa17bcc43301eb97bed4aaf675671f4f983d5b
SSDEEP 12288:7E5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:7E5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1E8C423C057A161A7E30E0AF3E1F686D8CA0CA6EFE408523B5E71A547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 f97cec511bcb57c5c7baf6b59de9e99ae805840ec1393a198237844ebb668997
MD5 67aa6ceee070f4f4bdd6279e1e34f80c
SHA1 af558b025295e4b71637f45e76f71bf03c667ec0
SHA512 af7726351c9ae1bd88b5c9dfc67d035a3261913234250f58079a07f9b96a0e7c99d6072cad098001be9bed27e3b4afdb0000717a138fc76342b3463d77938944
SSDEEP 12288:RD5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:RD5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15EC423C457A161EBE30E06F3E2F686D4CA0CA6EFE008523B5E719547CB35D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 265780c7321745a1000b0017fc7513c8c33e43597d9406d7be31ac3f59edc788
MD5 023bd9889ee57b8438abad4953d99407
SHA1 5dbd37bf6ea872d65688c2f639456cef0f97455e
SHA512 553023321e0d8b3b800a74f68ffcb214dfce53e1f9371df287e22e573857a6fe4f067c73eba4c3ca7d0787ab813291028201b61fd263fd28a7778c08d3ab2ccb
SSDEEP 24576:pfwvUk9RX6wkyAIa5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:jMnYIa5SW6H8DS52tdDpbRZy
TLSH
T1E835D029EBD804E6E177923D99F7460AF6B178691B31C2CF025A536E0E33ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 79ad9aefd78d8a522af111946482a151d58182a7dc3de49a5fae4eebce1b71e3
MD5 579042eae44f667ec54fde30553d5f50
SHA1 9c78cfaaf52e28d61bf1dadf9a4a4b93ce142b61
SHA512 8ab9a926ace3c4bb69deb0ecdc9410710e72b40b6f4239fe3b88bff2edd12929182cf34b3a20aa3b0b64f4cc0fd4ac0e403786a5cd6475b78535f5ac2e7d4f4a
SSDEEP 49152:nYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0v5SW6H8DS52tK:CySzPn5SSDntdDpbRZy
TLSH
T18F066C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4104231f29a27c081fcc9c606d5aa37fd2625946eca74fe34ab8c472e14a5e0f
MD5 a6d1356430489d1ca370d54da1a7e3c1
SHA1 08122ff62efd06da67a4b7ea2a7ebb92475431c7
SHA512 46df74713156fef47a3541bf23609ef5d7a6644535174acb2b174c3b1ebe7a37cc038ac9d9b6f54d542b6ef88962ac965b293bf05af7363035b52d2cf4f25d2a
SSDEEP 24576:747Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYR5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:747JUQjTirIhCnDHUPfF/f5SW6H8DS5X
TLSH
T12F65AE1DA3EC01E6E1BA927885554A5AEA71742E1F31CACF1270837D6F23ED44F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 b2409952ad98100ab8a5139472f3722bbadb4651ad517ff97028109a88866cbf
MD5 4197659373ac3ca58b1fde5c649d3cda
SHA1 2bc2595b9d2ef4af45ac02ac229ccdb5f8d7fd04
SHA512 ce4b8a3533918a6f6fd70116de55d0b450ed83601689e6f631843005aa0aab8cd308d4b28eb3aa88c1a2d7eb534245ca98f1b8156a5491c507f1e271d951c212
SSDEEP 12288:cbsf25OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:T25SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1CDE4F149D39412EAD02E5276C7A64680F3277C6983E0D3DB5AD0F53E0F366858DFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 9be8d592008a9a8361006888d535afa07e2e9122d3b3291ac91a97b8842d6e2a
MD5 b35ddf534414e1986329cdfb6fbc51a3
SHA1 cb836794c3361ff3ea5d836dbc85940032ff3159
SHA512 c6e9b2dd8c3aac84e470462a0cb4dcb00fb79038f497a8ea122fac577a3aa50fb0b5dbb4d3218d1ade06aad2540fa591a2112b720120c0ab615fa9d1fd2d1280
SSDEEP 12288:E+qiyK6U3fu87ct6IIV1cVj7r2OCUOf0sqO2zDMhkY:E+BydUPD7cD618r2vUOf0sqvDMhk
TLSH
T17445F701762ACB4FC6A940365E76D6CCAB707D05FE046F0373C9873F9476A59B6E2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 6dfc005e5560f4cd2eeba10d44b72aa1663767309c0c9046d3ee9f69ebfb7559
MD5 e98e2ecbb26900810333a30f6331d0ac
SHA1 e1a8fd1827c10dfcca1dd5e19a177d447fe254c4
SHA512 bedab9c1e9aac515b8a76f0082c5f70d39fa4802d5d71495ca8d7d700821d27b70dceb36284cff4c311e273470976da1268ae36a32fbdb307542e70f6633af66
SSDEEP 3:OlH/lXTkqwqlglKT84Dyllll5l3yjIl/lllo3mCllltGlslslslslslsl62//:KTwegu8U2l/7OIXymCtEEEEEEEj/
TLSH
T14281924057400AB0DAF76238207903689353E219E899A7DB620810518C1529C8C19628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 533d8173e087a5d8f101c18aefeaf531f63dc1846e86c8f4432534662d0ac4b8
MD5 2df6cc8ecaa463c435edde6fc203cee1
SHA1 8c2aa3a646f54f2f1be2fea1b13b9258319d335a
SHA512 5efebfcfaeb0c35e5a514749cde2173e76da97a6a706ab306d7cf3454f3ebd85c7a8e4823baf69e36f5d603960ffdd22b90e9e5d625bb884ca94bb03d44bf560
SSDEEP 24576:/mcsnJwo9B/Tc8U+iOhsHa6Q6vcsL6zyaHin7g+X6Anl01:kHU+iOua6HZaCn7g+XLnla
TLSH
T1AB55190165B7EB0FC97E903B423285CDAB786C07BB453F0573858938986795EB6E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 0794e28911fc7ac4131e2099e9059c6a27bb8306cd039790bc64133b7bd4218d
MD5 e94f3ff31d63193972d69754d565bc6d
SHA1 237d6c1314768f6c462d32fe1be7e8ce5f3d4162
SHA512 29ddb95a6af12993d8b84134a5c66aa936f403cb956e95eeab58a39bc30096212e81bcac65492557aa68c571398f88ed4f691539574077bd48d6ea55f7486a5e
SSDEEP 12288:7F7+5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:R+5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T138D423C053946497F22E06F3A1FAC2A4D60DF6FD8B0491FBAD2051879735DCB8E7251A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e1753596618339d096acda8537cbd9a278a5b19c98547bd72004029be4a17c2b
MD5 67e0bbee5edae986eebef809733eead2
SHA1 459ae2ae82be0fb15f8afacac2c2a101e5050987
SHA512 cf2f01aaa7d2f7e0dacbf5cf8dc29829c01cbfd9cdcffa53a95941767932bfe8cb7e91e01faff7284712fd5a73455bee3618520a29c68c3d5ae03eed12627215
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bY45SSiVw6uAX8DS52tpz9ZRzbPmSZyo:dgb4mBIBhGFR5SW6H8DS52tdDpbRZy
TLSH
T10065AF1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 2ddfd853ab0b956f1043ffa0b176d313c2e78476aa33c2f9becb3efb8a031a20
MD5 82f6328c0ac3b97941a6141224d875e1
SHA1 ff88d93006242157388c98d930d894a6f3cdb8d3
SHA512 0749fee000f8c820f7164d303cb59ceb9890fa0044c21be0a4cc58539fc2ee4e7d12beb372883bcb030d7f100820efec04d03f98a25b9d85f7bc8f0a772927f3
SSDEEP 24576:WG88u8FpJqH1bzria7/mh5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:97ZFPqVea7/A5SW6H8DS52tdDpbRZy
TLSH
T13B35016577E101F1D47BD138899246A3F6B1B4250324EBEF0BA88B521F23AD54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 08b715d164d2e26035981302f7ad4d005cba91e136656f2360ba381258415c4c
MD5 626b73da76fe38fa7985e997c79067a6
SHA1 5034933d658b3c653588b91a4061e5c81a4e2886
SHA512 94e612c3d9e9496aea0e8bcc0bfaa99c1962938f9e6325fc049e514daefb87a593c23e462bb79974bf80f859009a12623e709646ca0aa0c3d467e4817bc6c2fb
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjd5SW6H8DS52tdDpbK:hG05lO43bC5SSDntdDpbRZy
TLSH
T14DD5CF6A62EC11F9D1BBD17CDAC64A0BEBB23415033456CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 12b4e2cd8a388bb93877baee66a3b1751a52d4752afb19a5892b75cea9dcfb13
MD5 b13e7578aad1e90866d23daf89d480a5
SHA1 3abf05deeda31562d7f7217b934f550ab40e025e
SHA512 ace87ace15ff27b66b50583edd6ae6f001237dfc8c2c488b4746b801a9ba20c7245f045065d85713f428cbb69c53cca4af8bbab30d626e546c6d66bb7143ea2d
SSDEEP 24576:afa5POZ3dpuWVM50JicR2hG0lasx2+47eidnv5SSiVw6uAX8DS52tpz9ZRzbPmS1:ya5POZ3BJt2pasx2+m15SW6H8DS52td
TLSH
T12465BF5EA7F801D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5adc759ce9400d816ddaa3e972e7ffd0b870aa5e57612de4cc395cd4e0c39b5d
MD5 89c488f258e7159e0683238c96718c66
SHA1 7fd56e52258d6bb64641714bb0017afc4f23c400
SHA512 5e736bfe8bf377762cdf4e53ca45242737b6d30c81c6edea3942f2bd0cd9c9a170b508592b0b9bcbf5ace336632d3fed23ed9ca8cb7da2a1242eb5bdc32514d1
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7Fk55SSiVw6uAX8DS52tpz9ZRzbPmSZyo:gNc/zEOVHFg5SW6H8DS52tdDpbRZy
TLSH
T1B5858B5623E901E4F1BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e216577771043c66e3338e1033e61b62ce3a482cf940c4570d519d9061e3e586
MD5 f4140cf15f62c7a7ad024561d53adfe4
SHA1 6ee2a6d4bbeae265f4bcecba28bf8b06f20e933b
SHA512 6a51028bf772f4a7d1cff9bd1be7cb04bafeed0dda011a7e23f55d2e768cde9c3ed2ed8d4d9f2fdaca56a3f195304c3ec2dd47118d83860a3bd3001f871b729a
SSDEEP 24576:7TkNvNnaFeYhJNtmZBmD5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:7TMwBtOmD5SW6H8DS52tdDpbRZy
TLSH
T14455AF6EB6B806E4D1FEC6B5CD238512E6727461073293CB5290C13F4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 caafaf0bb72c280b8d5ff81f22f8e111e96f9cf71bdc2b1e1b55f57a35a88ed2
MD5 feb279a76cd80925808fb483ca262aae
SHA1 44b97dd5c41cf940f12bc9b69e06432bcb63000e
SHA512 8988f022f66f4eda9db6c3ed748d2ae8bccb2209370d509d421b3a03edfb19d71cdb78a7914db56ae75b50a007fd38ec737481906f38749baad6a3bc6b885043
SSDEEP 24576:SPUr+NQN5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:SJQN5SW6H8DS52tdDpbRZy
TLSH
T16705F15E22E818E6E67AA17DC5928719E771B4620311D2DF06E0817F4F37ED8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 9374046290e0952311905a52f3549d62f944b44e9caf53b44850d382025f6440
MD5 0719abd4a6d3ece5879d39cd3d82abe6
SHA1 1d46868b00e38c3116cd8cd6772c581f0ce9e15f
SHA512 80e3b842f1a1f513f2595835350dfbde7e89d7c57e1e6d4ef71ff199b60420d3973dfcc2a133dd559d516ee768ff18d4bce672bc6c502ada8b3ea60588460b47
SSDEEP 24576:AD3FHshBIYQgAy5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:ADVHeBIAAy5SW6H8DS52tdDpbRZy
TLSH
T15325E17DE79800E5E57BC1BCD6638A06E77138AD032166DB06D081B65F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1396-74-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/1396-8-0x00000000020E0000-0x0000000002147000-memory.dmp

Download

memory/1396-6-0x00000000020E0000-0x0000000002147000-memory.dmp

Download

memory/1396-2-0x00000000020E0000-0x0000000002147000-memory.dmp

Download

memory/1396-0-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/1396-329-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/1628-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1628-383-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1628-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1628-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2176-63-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2176-64-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/2176-292-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2176-70-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/2616-124-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2616-131-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2616-125-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2616-331-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2784-105-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2784-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2784-397-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2784-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2784-99-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2784-396-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2884-412-0x000001ED547E0000-0x000001ED54A28000-memory.dmp

Download

memory/2884-384-0x000001ED547E0000-0x000001ED54A28000-memory.dmp

Download

memory/3344-55-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/3344-48-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3344-49-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/3344-59-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/3344-61-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3352-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3352-77-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3352-75-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3352-83-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3608-323-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3608-89-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/3608-88-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3608-94-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/4560-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4560-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4560-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4560-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4912-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4912-144-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4912-146-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4912-138-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4912-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5116-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5116-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5116-13-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5116-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5116-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5324-43-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/5324-28-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/5324-136-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/5324-193-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/5324-38-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/5324-44-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/5616-380-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5616-382-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5616-118-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5616-111-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5616-112-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5616-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download