dc58c75b0a7448ccab567c0ed5ef47496ccde30e65f6802264b458743861cf9d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 1.6MB
Sample261107-q4t5jsfa96
SHA256 dc58c75b0a7448ccab567c0ed5ef47496ccde30e65f6802264b458743861cf9d
MD5 5d5cc29fbafd8ad0e7ba444662d2eda5
SHA1 fd8661f359accceb0d46d875704635a4ed15bd58
SHA512 504ae4809981229e483ea5b1a34e4b61c6392258b4a6a4edcc1f24d871672e540ad0a159e9368038cc20dda1fd1015f46bd032832379264d89413ece12ad0d8c
SSDEEP 24576:hu6I339SSgT7yQCBq/McxvN2T/u1mWXMHM9:hWNSFTPCM/XxvYT/u1XMHM9
TLSH
T162751225B1C0D0B2D627057285A8CEB10E7A7D7E6DB0805F77E83A791F726E1412DB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5328	elevation_service.exe
1328	elevation_service.exe
5476	maintenanceservice.exe
4840	OSE.EXE
2824	PerceptionSimulationService.exe
360	perfhost.exe
5396	ReFsDedupSvc.exe
2716	SensorDataService.exe
992	ssh-agent.exe
1964	AgentService.exe
1184	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2f9b59e2c17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094a5891bbf6edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a11a18dabe6edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c6b96e0be6edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d72103dabe6edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5328	elevation_service.exe
5328	elevation_service.exe
5328	elevation_service.exe
5328	elevation_service.exe
5328	elevation_service.exe
5328	elevation_service.exe
5328	elevation_service.exe
1328	elevation_service.exe
1328	elevation_service.exe
1328	elevation_service.exe
1328	elevation_service.exe
1328	elevation_service.exe
1328	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3428	2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeBackupPrivilege	5396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5396	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1964	AgentService.exe
Token: 33	1184	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1184	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1184	SearchIndexer.exe
Token: SeDebugPrivilege	5328	elevation_service.exe
Token: SeDebugPrivilege	1328	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2848	1184	SearchIndexer.exe	100
PID 1184 wrote to memory of 5928	1184	SearchIndexer.exe	101
PID 1184 wrote to memory of 5376	1184	SearchIndexer.exe	102
PID 1184 wrote to memory of 5724	1184	SearchIndexer.exe	103
PID 1184 wrote to memory of 4952	1184	SearchIndexer.exe	105
PID 1184 wrote to memory of 4508	1184	SearchIndexer.exe	106
PID 1184 wrote to memory of 5344	1184	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_5d5cc29fbafd8ad0e7ba444662d2eda5_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5476

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4840

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2824

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:360

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5396

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2716

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:992

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2856 2832 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2852 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5724
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2856 2832 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2852 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 182c801efdfb46b3ef93afa9f8003b24c029c2c16a657e64cf1ae1dccbce65ef
MD5 2e69e8c7dc28faaff8d527782faa6ea7
SHA1 c6e67dbfbf50b212352e9d15dec03012c87311cf
SHA512 f66b70f44b136ef425e10a327665865d2ffd1d1ec3f5f6cb1c692617087752e35a24c6973524103fce4ba14dad8adc074e2bf8f8906022f0cb952935beb20cbe
SSDEEP 49152:Jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxngCM/XxvYT/u1XMHM9:f3q6HjBIM/XxN1cHM9
TLSH
T1F7D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 ee3afc4468b2cefb3c2d14d5218bdde99199d8669f22308b414e9abdce391cf3
MD5 fa2091c006bc871f4e53a53c66e4c6c6
SHA1 0254ee4bc4ab505e480cb7d60f1047eb054c0b27
SHA512 3f56cd9a70ac74b3af90247943332ec5891fd0a1e573c8909eaafc1843e2b4010abe67f40cc970cb129970ca092efd05cb4e97a262c8c866e0d4fdc6406a8155
SSDEEP 24576:4XYfDtczAEQCBq/McxvN2T/u1mWXMHM9:vtcaCM/XxvYT/u1XMHM9
TLSH
T1FF85012CB7D408F9ED678279CCA28512EA33786447A0E7DB03A499751F336D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 2e4189fd3087a585046ba9f6dbe221dd77a823152fd23ebffea956367c99f32c
MD5 5a0d4c5dd6551cc3b7dc3108945f8ca8
SHA1 8a405cbed6ac2c7baecc20da07fe9a2f50bb028e
SHA512 a61142aa3eb7ecfa85a960c8795c1c3e95ea5e57346369da06f8fa3f2de5739e57f618f3e76f32cbb7540c15206a613ae03a80914cd06819fd41cb5ee71c1404
SSDEEP 24576:k0Le5ji0hmxYrMfQCBq/McxvN2T/u1mWXMHM9:kPji0A2fCM/XxvYT/u1XMHM9
TLSH
T1B7959E16F5788335D073C0B9C5D2A69AED7130865B308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d3ff41e88e0b2538770997b323822c805f9d3be40f65e3ae9fd661242b093def
MD5 9b3303bb2159fb64bb23c8a0daccbf93
SHA1 180174c776fb5f55e2a707514dbb58f1c2154b15
SHA512 5a61e6104d2c4c50481adc5e7f5156acb112b6df5a30dbc306cf4f67ca8b40f5b90107aa9ab625fbefd6bb630acbe9ec6d0d5fabbfb2f10a6bee68a7eff993c0
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyuFQCBq/McxvN2T/u1mWXMHM9:D/ezSC6vUzPvxHjyTCM/XxvYT/u1XMHK
TLSH
T167756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 455f21efa72faa24063972916622c0e2bb0b4d35bddc8181938dd0c65eafaa21
MD5 ea7b48e049d55edb0e80ff873b488fe0
SHA1 8cc345736e0f9584446c511f215d71fb9e058158
SHA512 b1416912c06426fba61aab438a90dfc1ee7c425bbc76893ab3287cdb4c653f66f2b8ecc436fa470e4e5d1b2aab831d937996e992e176fc78c6c3fe5b363f7441
SSDEEP 24576:MVbqPb88hv/l+64QCBq/McxvN2T/u1mWXMHM9:MVO88hXl+MCM/XxvYT/u1XMHM9
TLSH
T151559E66F5B48331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 4446d23e6ba7bdd61b0bb5d9aab90c25c50541484f44aa4135c1bfe5d520909c
MD5 08766c67e4ec583bdf7a386ad82a053e
SHA1 5b2c03b54a14b8672bf336e0471334ac8fd1756c
SHA512 2ab13578340af201f901951c42ed5bf41288534629ea2e9d37c28017f9bcf2864616cf461c65d29bd1317aca19cdcda36db028edd1ab7898d768000e7eda80d2
SSDEEP 12288:6HTVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:6HTQCBq/McxvN2T/u1mWXMHM9
TLSH
T18C65231E9CCCD6D6E7478BB348AD1A7B0E66BF78FCD484B1A5103AB42770CB2D429905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 9018c806b93f7752e71814f0c90e71854e80d174870a9298bf92ad4063bc80f7
MD5 82031e6beb13f25e705e840a2a744694
SHA1 90882959a823d0da0f59615b7945b6193ca22792
SHA512 38499705dfb4474b33daee8361518cf7b46b1b0e4c32265e4087b3c5932cc39c7b2b371f68b73eceefbdfa8c7fef881f3c7e411dbf51a5a54c5ca078acf3caf1
SSDEEP 12288:3eBNUbTVO86UAVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:3JIUAQCBq/McxvN2T/u1mWXMHM9
TLSH
T10285CF3BEE68FCE2C27A8DB95A918740D77278304F6193CBD164820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f76c88cf549057dd75cf2adebb49e524676c35e81de6141e78c59295f3801cc7
MD5 53505dbe734bff55441e2dcd644497a1
SHA1 7e18808a6d549995907ea70ea6b2d85e324bd58e
SHA512 6b96707332aebc98ce1e754c65f291cc4fa9d5fbe4a6cb4998233040402084b237a737730cb03d619eb2267ee006c7775319dfe706fb2dc712ac385367662efb
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THd:zQvGAdlCEL8c/yRNw5CFM/XxN1cHM9
TLSH
T1A6267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 6e5e2beed9f2ffe9ba41212ddcb25443a60dff9a6ad6a347606d6e4876333314
MD5 c11d38302f7308b3c6e7ba4468d7d86a
SHA1 3f756b3d8b8c3e88069faa6d5f544b500f0fb2f5
SHA512 130790f4ef7ed648bf8959e9e0a862359823412575b4eeadb2229e614c881a7798c3106de8dfccec9422391ae44d68eeb9a7ed952dadb03e7c4afa416e1f1f23
SSDEEP 12288:AAwSfxL/2Dc3SDLLmt0LDQewsAjuVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wx/:V7ewsAjuQCBq/McxvN2T/u1mWXMHM9
TLSH
T1F185E031FEB4E436C77B0DB21B26C716186DBA204FA119C3E3A85E9D5A301D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c82aedb5503150dedead6e03d7931cf14b84ccc9ea824b33ecaee15322fd3bf6
MD5 1024cc64af3d6d70a182c85f66052af7
SHA1 94a23a1a66bd10e87f51eb625b1a177e8119fc92
SHA512 de106b8c963ba3b16dd884df445ca3c490ce9d9d1c65f5c7549abbca9f798272bd695e9b7de45700df8aeecc0fe810a106c4f4e1fcd16ac51714a5c1df3f83db
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHpfyHK:hUEtQevvqc2W1cpV2EI32pyHK
TLSH
T170474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5808798d58cae6957942eee64aac117cd03259ed9b5f2df896b6690266d5f9e2
MD5 34d1fa8fa7e893094b9e7091642f8070
SHA1 3e2c65aebf54c6f4a006dc9e82aea1138ad6afaa
SHA512 216013f5d5c017d5967d5434927cabfe6f7442716711ca0d5763845c15543dae855b3a12027f8f736636fc18670844f4aecc4bca3f2058e37e79f7432f7a409e
SSDEEP 49152:HCbRquA/m2yL5zLfFiV+XenmE3/zPCM/XxvYT/u1XMHM9:Qoq2VjnmhM/XxN1cHM9
TLSH
T137D58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b2a00bdbc2359b3cadebe7faa3011bbf45c05055905db760fdfbc2726b72947f
MD5 e8d857b1586a8497579b81562d39fea6
SHA1 7b34566744bbeb3cfd7361130656933ee2dbe71a
SHA512 0eb4078cae38e07e02fa7c11e2f4fcf94a166c2bbd04ad8ec175f91dff268e67b663be857950773c924dcb9db1f45319d0683c1771af69b96adfe89f1ec3e678
SSDEEP 24576:TAhGLJIFoiwtA5l7S53hQCBq/McxvN2T/u1mWXMHM9:TAMyFoiq5uCM/XxvYT/u1XMHM9
TLSH
T175359D81EBF955D4F5B3AAB899B68171EA76BCA95E30C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 1fbad25949deb0ddea60c77d06a43ac99851343e7360f9c32f9e36a8670107f4
MD5 d17938c01fe92c0179926aa2aaf94020
SHA1 f866bffd6997bb2c6d9c5e6775b1215f6f7ccd54
SHA512 1e86204a3eb40a80a750bd2a931e70c71f127087d8ee928ba5117610f6e4f0b8c2bc98e532b5055ec8bb7c047880c59becd0dc7566457417ca28256dcb7f2416
SSDEEP 12288:ymw5HEjsChNzBFgl0WDm+ClVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuG4:rwuSOWqQCBq/McxvN2T/u1mWXMHM9
TLSH
T18185F14A76E80CF9EA6782398557C536E7F2BC113A60C71F1760C66B5F33261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 b74376022ef7d8d3ae01e380ba841fb7748d7ab4f09fc6cb50a472928f6ea935
MD5 b1b1ac92f06a8e9ce862eddbf1fae6b5
SHA1 cd1f6d4d1542624071d0952cd309bf0d6ff6cc77
SHA512 96f5e6082462be0154e9a30de1cda98cf211bf4da13b78ea1684e51d91ee79be376db72e8ca1748206195724871bd655a33ce4c6e6413a42b41d8c1fd58a03fd
SSDEEP 12288:1jZ1Iy+VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:BZuHQCBq/McxvN2T/u1mWXMHM9
TLSH
T1F475125E36D861F9E2938379C8E94616DB7278757BB083CF162002B92F32DD25D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 406dbed7da24323448651dcd14ba0166a610f5fb8bad5c3b9ba52bdeab575d32
MD5 0bfebe79402b802e7fa9316d2113f226
SHA1 9b52ba2551d82d2157ee91329c7e27b51ae5067b
SHA512 7f3d1c7f518d196dd550bd0809c3688123353ac0210743056ba705a09841a83ba37010619d9671818858f40ee44c40f819cb11b7b3cb2d3c905ca916c3ee0693
SSDEEP 98304:MQRQyi36YOcPQLvw2gAf+PN3sM/XxN1cHM9:TQyiKayX+PNDfyHK
TLSH
T159667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4573c12d966cc54dca28cefc985602722d5efe789a7c0cddb2f19f2704d85737
MD5 b2572959051e0eb0425107727c06c1a8
SHA1 ed3dfcb18924dc18e862d8d1220b4d1494a1ddb2
SHA512 93fe335df04d025b1df35ad8863c65380396c130f27df83525be546569297817e587bbb69d7a0f7cb05a00bb5914ca6d37c70c53f41a6209eeea3b3d85c3fc97
SSDEEP 98304:gQRQyi36YOcPQLvw2gAf+PN3sM/XxN1cHM9:3QyiKayX+PNDfyHK
TLSH
T12A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cd9246c4e3c4963ff4adddda4aaa44170578e336cbc689b9673c6db0a07a5e5b
MD5 4f6dbfe65a47609e6dbfbcb04942af2c
SHA1 8861b7f3b1ad37044b8da6727655dba8b226968e
SHA512 355d879f4df5c5935efe11ac16333a621a11dae8d4fb90d3eb16960a3072fdaa6741f68bab4cec6a3edcc87640940c7b3fa3393defa7e6855a2592a5b6035c62
SSDEEP 49152:O68Qg55nhheWu7PNU3/fCM/XxvYT/u1XMHM9:cthWRc/KM/XxN1cHM9
TLSH
T1E2B54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e62ec60d04f3938c8c6c188d3de63632d513f5460e7bd4cb4390a63135daf74b
MD5 44aafe90cc4ccfd82cd88bca7dd592da
SHA1 03f15e23696fe8bf525bee13a567329f3576b075
SHA512 cccc8d173290a5590e35345709b761fd50395114e83694ad2e46454552f389bc2cbff4cc332a16e1605d3afb608646ac714d133ef6073138159aac165392c6bd
SSDEEP 98304:Gy5112gYy5azzVvL69nLKnhZ3M/XxN1cHM9:3LIHmWhufyHK
TLSH
T1BF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e64faa981ca423babc569874cc12e043c7a1cd638aeacabd73ea7c323125564b
MD5 d095e5783f1704ab7b95251e690c7746
SHA1 87b5e52124883b943bc3cfd78fc2f867c3e4c37a
SHA512 0cc5570b11dee6bb2668959126d3959523bbb99ba2a038593a31254b9d06c10f059edc04822b16115d4fa4f5d312f53ce659c4dd358f94a90bed723aa3be6d9a
SSDEEP 49152:eB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glBCM/XxvYT/u1XMHM9:Mu6JmVxd2d0M/XxN1cHM9
TLSH
T1D4D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ffe23816e4aa9700679b18af7c50cfc77dc6f6ed10486feefb88fad70aeaa9dd
MD5 a41400d0d3253cc2e3ef3145a4e5fd7f
SHA1 889f203490380f1f7946416a23560268e6cc1b08
SHA512 aa1faba9156b2c48750d64fd21a082a51f1d01ce3efb261a9f96edad553930d25e5ab8547507c0b30f94ea9f9a112f0073f3b9f4f6d3a3ced850b1858553fcec
SSDEEP 49152:t1hpsNoJpF1A6UU44CwH7R4x1CM/XxvYT/u1XMHM9:tmifPbRhM/XxN1cHM9
TLSH
T12DB5BE13F2D901E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 aa1d3c960a96d000c98c68bff384db0e320af4907a4dc8299bb1baa1115d8db1
MD5 f133d4bfbcca12451407d9f024767c8f
SHA1 82b6525428a519859c206baa717e3a43dbd36fbf
SHA512 99de5cc08958c49070784afa0c43e4f6d2565c3257d036f0b034ef648167d9c9f2ea17dd426105426965413dcd780531428b32e6551de474ac036191dfa5baf3
SSDEEP 49152:XSuZQIY0Be2KRRVtOnks6NMHqwCM/XxvYT/u1XMHM9:N5dKTi61bM/XxN1cHM9
TLSH
T12AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 50e184e4d35804a9edd2b4503ed2e94a4ea593611ce6dcd899892c6198413fc9
MD5 6cd8763c215e5380683cf28f1f082997
SHA1 e4464859796288af56ba7760cb63e3e681c26eea
SHA512 db1e238645b0ce6612b6f59c2cae20fe9cdfc40c036561312c0b02ba5c376fe0e90107a8a5dd16c48297606a1bd337a236f0d6bb8c2e4208b96ab9d0cabe161c
SSDEEP 49152:6htSn8EApI0figngiDn0AP5wRCM/XxvYT/u1XMHM9:7X2iyphdM/XxN1cHM9
TLSH
T14795BE13F2D901E8D05ED174C7468632EA62BC150B38AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d7869db57fbb7ba8a343b44e5cf7954f850989c0317f072a55cabe44d325e9af
MD5 e7348ef5756394c734da10904459b62c
SHA1 07c7e2d4d521316287a9c7ca01c45dc0b16d4550
SHA512 608bd711c9a1abfa907d355d0b6950a2eb914333389a996ee479cf35a0ab1eb7f48f2a3a2a3c10bf5858fcd86afa254002a09fde278a32f732b220f743210c11
SSDEEP 12288:37VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:37QCBq/McxvN2T/u1mWXMHM9
TLSH
T1BF65231EACCDDAD6E703CBB2886C167A4E697F7CFED480B6B61421712770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 0007a7b498f98a52eb8121f79de036b16013f99aecd33228cbdda52bce00add7
MD5 b6e91602548f5987f1b466e458acc3a8
SHA1 b639c41aba369f81de8267c3726bd5524c31cbcd
SHA512 bf8f48e5e5d0d243b2af3814aad791f571f47af777c9e47b7f1127010db507e1c0b9624bcdd579267baa43c7aa0c2a0ffd0a68a3cd5de8ed05b46998a5399ae9
SSDEEP 12288:ziVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:ziQCBq/McxvN2T/u1mWXMHM9
TLSH
T1BD65231EACCD8AD6E703CBB3885C16BA4E297F7DFED480B6B61421712770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 e3b773b76b56d6d4195e05a377768d4be248d5ce9ece0fee6a5d285518f02402
MD5 5c0e107075b4684de3a1d4562f364ba9
SHA1 b32cd4240edf567f3bb0a064f12af1d15acbe637
SHA512 9651922f5b60c84c00fd47ac971dcddd920c742242c3d3c9b9cb656750a605795baa8819f1b2128ec429ce6ad4c291b31b2d008de09938d98a025a976ff0a355
SSDEEP 12288:SoVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:SoQCBq/McxvN2T/u1mWXMHM9
TLSH
T16765231EACCD8AD6E703CBB3845D16BA4E697F7DFED480B6B61420702770CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 3e3458457f2eafa005bc13f06871fb50760689d36294a8ba4df25fd865e41bb4
MD5 65ff9b490bd6aa9788024b1e5ca785ef
SHA1 0635eedcfcc5c22ab6edc5f2cc66892e8b521aa4
SHA512 aa075fb65ce1f15b893dec42063561604bf66ea9cb1dc1b097583294a00802ea09629f85427b623549b85558eed41aa63ec5d1daca3c3fd121f56ed098d09f08
SSDEEP 12288:yVBVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:qQCBq/McxvN2T/u1mWXMHM9
TLSH
T12965231E6DDD82D6E703C7B2C86942769E75BE78FFA082EFA60015751F709E09838E44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 7ed97f8558dea4c48cea0286784aa819e3564bc0688ed1ee76b731a21d4dbf54
MD5 7a94393e46c411ca2ad3726fe132912a
SHA1 5272358d1f71b31969f4acdaf25d2ff5683004ec
SHA512 dc7fee32ea9621928bc4f1f2509d6abb6a9db709d1a684f84ad07ff47f4880d24e8375e5a44b9a5e349d33eabe1f1116b1e22b09a0ce4f4871750943fc56500e
SSDEEP 12288:M5VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:M5QCBq/McxvN2T/u1mWXMHM9
TLSH
T1B765231EACCD9AD6E703CBB3885D16BA4E697F7DFED480B6B61421702770CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 8941fdb34f55be5a5af3927fd570e78dbba7d45ff680609049301ea4e7c92b04
MD5 288df227ac5a17d2b0bce1c67cd8999a
SHA1 459bc02b1473173822357f4a78a5344306775491
SHA512 2997a0c6edf2fb39fdfa763f20e5441ac3c9ca9e735026ca98df34fc07e0ff3e617e90db34ceffb94b4f3898666fc65d3e4e7c317424b097915a77727784322e
SSDEEP 12288:92VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:92QCBq/McxvN2T/u1mWXMHM9
TLSH
T16E65231EACDD8AD6E703CBB3885C16BA4E297F7DFED480B6B61421712770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 a939a0b8deee928132bb2be1b042fb9a1973f197a530adaf945085b173b24f81
MD5 5c94c82debe49eb828eb86420483e819
SHA1 a6c4f332a13ff35305327347ae18d5a32bf8ec6e
SHA512 824df898685759ca096b8443c78fd393ee5f702ae7a8efae9244bcb3692873a86e0d7aff3ee299e718371615dc6c7b9e5cf4455b2172836a470ec331168944e5
SSDEEP 12288:5aVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:5aQCBq/McxvN2T/u1mWXMHM9
TLSH
T12865232EACCD8AD6E703C7B3895C16BA4E697F7CFDD480B6B61421B02770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 010301dd207395fcd59fca0ebd3bc5fba33ceb25a324bb7c224fd723db82a2f4
MD5 22cd97138e0e100e5709e20349362518
SHA1 e8e7e4816a9d903c0a0536b2fa23e0f534ce4946
SHA512 e7af8f293740d213542470ba11aa7f7dc6e229508aad50d9d6e5bac662ceaa73868de4777ecfe9e20df50bbf9f5d86db2917e569fb684c1869e5e46a8591782a
SSDEEP 24576:5ZMEzFVSOCQCBq/McxvN2T/u1mWXMHM9:5ZMEzfXCM/XxvYT/u1XMHM9
TLSH
T1A6850199B39418F8ED63823ECC158916D6B27C295BB0C65F13A436661F333A11C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 394ddac44b300c71b0d368b39a30e10a9791791e720b3178e46bc4a1d77b8bf5
MD5 60bbf76bc8f2427f1005d20c3079f9a2
SHA1 1fe42865ba66071fa33cf23263484af64fc7f02a
SHA512 5fc7889da3aa1aa3bca37f1ba5ddcb81aeb7f5951b4d6f0b58b9d5f1aa0f658349092e6d4ce77ee53783a44764629f62955528940081376d12927d640e7de704
SSDEEP 12288:wXVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:wXQCBq/McxvN2T/u1mWXMHM9
TLSH
T13565231EACCD9AD6E7038BB3845C16BA4E697F7DFED480F6B61421742B70CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 8fdb5b2a8206659a5a9ddf2c93f6e07fe3d6e07da2d177271397ffde75d41cd3
MD5 586bbb192f435798d5bc3d9444c9237c
SHA1 0294029a34e7ae87c8c95a1470dac0d9a1a0cbb0
SHA512 874555009bedce73219f10b7f50fb549f37b79676f3ab24b3e27cd7034ee1bf674194c81ad0ed9288e0baa110a5e5f61173c9e27c151fcba3720cd3d8415f595
SSDEEP 12288:6jVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:6jQCBq/McxvN2T/u1mWXMHM9
TLSH
T1C565231EACCD8AD6E703CBB2895C16BA4E297F7DFDC480F6B61425742770CB25829D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 a8f83f6753bcc23b4f375a3cfd3671a105d508c2085a5f2d5eaabc564995a63d
MD5 07be4883c052f6036f5be7cd5229c802
SHA1 fe43f408855c3057b0b1f1ab8ed79b1d6f81270b
SHA512 6573dbf950cc4945354b20a08b19bcfea1f202e12d73fe57d13e6b4e63a0703cd45b9c7c2fa581ecce185360f25109ac4fe6d2e9c76932a867317af56880bff9
SSDEEP 12288:uyPz5L8+VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:zzy+QCBq/McxvN2T/u1mWXMHM9
TLSH
T1B875121B76E531F9D2278335C8661A12F776B8355B608AAF136007762F336E19D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 59cf1e1ce7ab71b945eeb84fdbe7825e46b072c72d1b01c4bf1c475ae88e03e4
MD5 cf7cf1d1a3e078b4d1ab04306e6ab1e3
SHA1 55821330a778b8bec9cffc6e6f0b535e6909cac2
SHA512 2a93afd8e1dce4f780870ad236e858c308ba56e8bf8655e0e8affb484f7dd4079880cb09ca1c61496dc39e67371da6db78829b8be0fb04e2b0baffc668413476
SSDEEP 12288:aXVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:aXQCBq/McxvN2T/u1mWXMHM9
TLSH
T1F365231EACCD9AD6E7038BB3845C16BA4E697F7DFDD480F6B61421742770CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 77fa95b83e96523570793ea046a26259a14b4c562a03d50aa96ecfec1b9c69ba
MD5 4841b002b2f4473347f236af40eabf1b
SHA1 75ad7bcf18a1295ec35dbcbfb681af687c0fb4d8
SHA512 407c3691bf80f7d343496627f127450d72f9a1dd52057c3a7bc0269d029e4d3a850fcfae18f38df1ff13595a80685fb1b722329c636c2cf5fd4498c956e9ddba
SSDEEP 12288:DXVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:DXQCBq/McxvN2T/u1mWXMHM9
TLSH
T10F65231EACCD9AD6E7038BB3885C16BA4E697F7DFDC480F6B61421742B70CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 19ce691403f6c9d2ef317ef436991807c1ddd1dfd003ffbb23b24423a429f43f
MD5 210d533b1a27a9218996f6ee4dd5f8f0
SHA1 52e0c2dcc9faca111cda7ed478ff17124b97b680
SHA512 5c32f86f4dae9c544bbe1ff41e097da3cf825886bd7bb589ac6713a76ce88c9d9990642214fc6cdbcaaa004331b14e81ebaf159730268573f7f173bc1dd609f2
SSDEEP 12288:ZyPz5L8+VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:Yzy+QCBq/McxvN2T/u1mWXMHM9
TLSH
T14975121B76E531F9D2278335C8661A12F776B8355B608AAF136007762F336E19D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 7fb6125193c0eae9c0d640eafd215442c3ac4f4d5308a200c874184b7271c50d
MD5 7c4a358b6dbd934606f1e934c4aafdfd
SHA1 7255bbf88f497223eb01e44e7fa303ed206a955c
SHA512 2efdbac861efe2f57810a615dbef3b160e10dad261f4bb641689145a624fb0e39b677aae8ae0cdb53779c9c1c1a83828320049f6584745c93946888ff9415cf0
SSDEEP 24576:oTdaLl3z0zDYQCBq/McxvN2T/u1mWXMHM9:oTwLljqCM/XxvYT/u1XMHM9
TLSH
T10E8502A9B39018F8ED67823ECC554916D6B27C2A4BB0C65F13A436661F333A11C3DF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 0a65afe1b1f815a2cf272998f86323b5468a0dc788902b1250b22a1366c2540b
MD5 496cd14edfdae16d5fd7c96d463a4863
SHA1 712e79b1ff38e26d7e89b1b24d681f8d26f8faa3
SHA512 6a426cee6d1904c56b3c2aa56b6f6243039117d456cd8dd8327dcd3f1f8305161cd95b564fd35dc6ff8e85f99986b8007f7164a2fbadadba2016ee688dcea5d2
SSDEEP 24576:H35d9CHKy7GZsQCBq/McxvN2T/u1mWXMHM9:X5d9CHKyaXCM/XxvYT/u1XMHM9
TLSH
T12F95CF94F3E814E8F1B7CA358D764512DA767C695B70CA8F03A4261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 d282a67a7acc5b0df7e44b0cbf80d46739d10481f4d166a48c194c246ca8d496
MD5 67779d6eac1db5a6e30f25abec434cbc
SHA1 025863ca6cbe663d10682d24aed7c70a467dea86
SHA512 0bb3e2a8fbd59582288ba4e27da093ee4b55e22902e37724ff36e28748748df70c2a6be58b42b02966ca3fc3b2025946440b1ae7055dbe0921a8de7f73f1bdd4
SSDEEP 12288:LIVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:LIQCBq/McxvN2T/u1mWXMHM9
TLSH
T14B65231EACCD8AD6E703CBB3885D16BA4E697F7DFED480B6B61421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 a9e3e1795a2f6a833125a4003c63cd43bb2f0a78a0d57e2a483eccbf1b9c0fe9
MD5 740abdcea78e9ed5bf562ea4f104b183
SHA1 909194f78c57b6a9bd7649765e1bc8491bfbea5f
SHA512 16e48b995ffb30cd1b23e379485977c764c1979435c8d4541d6f21fa1345e579dedd7f65f4c1b49654f03e7d84b79b6655aba309a7e4b4de90fc55ba8e38b3c4
SSDEEP 12288:neVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:neQCBq/McxvN2T/u1mWXMHM9
TLSH
T12765232EACDD8AE6E707CBF3446D167A4E697F7CFDD480B6B61424702770CB29429848
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 59f557c57519783406d53735c3ff7109301a8956201ebc2752d589e1498ceb27
MD5 b07e2ac722219890f08fa4cde11e8afa
SHA1 e7fe409c438b98800284dbe4f0ed4842982a1067
SHA512 d1363e438348cf3623f774adc4cfd5680a90195e33b544295a22a5969c0eda4b7aa9c3748e9913f2bb8f410e2aafe0cb7285f942093b118d256a96c076b72986
SSDEEP 12288:TdVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:TdQCBq/McxvN2T/u1mWXMHM9
TLSH
T1C965231EACCD8AD6E703CBB3885D16BA4E697F7DFDC480B6B61425742B70CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 d81c7c18e1a6f3c90e24b1090f0b1d4606d98fbeff4641c9063ecf80bdd8bd7b
MD5 865c675844d3ee57a647854bd11fbd83
SHA1 9306a5795edd5f3763100c1081fcf8c75070723f
SHA512 9df8aa92c24d6cf59070803b7e796bffffadb7511299038327fe3d1651949ba2065335a11a1196ee4cb5e69f5ab57836bdb0596f0c32e57c5009035136906a04
SSDEEP 12288:BXVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:BXQCBq/McxvN2T/u1mWXMHM9
TLSH
T11665231EACCD9AD6E7038BB3885C16BA4E697F7DFDD480B6B61421742B70CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 15c973ce5ed233c7da5f4bfc6f82210f4708dbdccff10b6dcaef929efe4c6272
MD5 13ab0684cb74e5ad8e604ade31b850d4
SHA1 f1f4e50926afbcaec6cace85fee10320d06e6d23
SHA512 28b113ba52ce8231f53e249e2ed062bd8ded5d9f3443ff0579f31352375b0627655cf07f4db2adcdca9f9da1d057320abcb1c3b829423e07ad63224116b43a67
SSDEEP 12288:/IVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:/IQCBq/McxvN2T/u1mWXMHM9
TLSH
T13465231EACCD8AD6E703CBB3845D16BA4E697F7DFDD480B6B61420742770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 e46d7511f67c1dc1cb82f9447acfcccb13a537172276cd44eca364ec887dbe06
MD5 286c83a1a9204b8dd57dbe11714d0fae
SHA1 26afd3d1bb6d23d224cefe550791b26adb4d6954
SHA512 c6d3a50c0ad1df84b335e41415c0d913bc6c6a37c30ac6bc852f35f3e8d7e4c9a816fe3753744515d7134974ce29e513685f743ded661c438fa71c25fff893b3
SSDEEP 12288:cPVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:cPQCBq/McxvN2T/u1mWXMHM9
TLSH
T1D965231EACCD8ADAE703CBB3895C167A4E697F7CFDD480B6B61425742B70CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 688abe00db5058e63f52801e81aed8e7b21b301afb98692bffc51f1824cdc478
MD5 9e757566ac34585ac25781a224b1b4e8
SHA1 61df56ae28df3cfa9a720050e1c1b8560ca892b0
SHA512 05ca2ba0bb791117096884b9c8f8328e34bf641b093443760e0760cc4998eac83555179758143b63709ad8693ae0d691f2903cef7ab08ed663bee8dddc1f2fd5
SSDEEP 12288:05VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:05QCBq/McxvN2T/u1mWXMHM9
TLSH
T12465231EACCDCAD6E703CBB2885D16BA4E697F7DFED480B6B61421702770CB25429D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 e507eb53cd7d0072e8c5d11739faa988518579e86d49f4a9bcd3adb3da065c3f
MD5 d8f6059acfe0241f5fe6fee700d8b47a
SHA1 285509ed007b11d197e5aeba3f20a8ad70eea9ff
SHA512 e8edf8d3c9924546e933bbb27e63ad1dc555ef5156a29d64e70891800b30f113686ee253d87d8b6b8a94c3b00a75ed1a3991da94236b29d3e0a806d75de6565e
SSDEEP 12288:/QVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:/QQCBq/McxvN2T/u1mWXMHM9
TLSH
T14265231EACCD8ADAE703CBB3895C16BA4E697F7CFDD480B6B61425742770CB25429C48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 11590d8558b319cc157ac6ba036b1a12978c9721fd2968ea98544879bf380dcb
MD5 9f5a74a5bd65787a8b9b99ba3fd535b2
SHA1 e1863581ce6fa811247971c8cf9815a4d9fed5db
SHA512 b55eb3ce3a6a6038450dfcb93ba389873d5816b5b7a97625947ba353592cf184e646ea1ce0c4e73cafe1a6813601506a5d6709a1807101f9123eaeece721acba
SSDEEP 24576:Gfwv+k9RX6wkyAIzQCBq/McxvN2T/u1mWXMHM9:0MnYIUCM/XxvYT/u1XMHM9
TLSH
T1C595CF2DEBDC44E5E177923889B7460AF6B178691B31C2CF129A53AD0E33EE45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 95e7e05568e4047710edc92c1f14173ad27c72a317645cc0ed29edbf40ad4439
MD5 d21e1764ce74cd83a969622a82ac8f65
SHA1 22640868b82ae459ff588d23145d308bf4b7f634
SHA512 09be00adeae8c00bd5885facb53334d2f621cec65c71b3da115ff294ba42bb8ed91a471b0a6979cfb974e6c54dd7fac090f42980026c557f81e6e98d6e20b48f
SSDEEP 49152:HYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xCM/XxvYT/u1v:jySzPMM/XxN1cHM9
TLSH
T1FB066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 936ebcdc34b4f8c60f96a6783d93e8211daff2a9e543dc0222c7c62528e670aa
MD5 44258639c7f64ebde9cfebe0acdc51f5
SHA1 852ae1499d49af1a638a5e59ac53a5a8b28b5fea
SHA512 7993e9bfcba82bb62e908cd53160d3151882cd6c23654161ea7edfcf6cf741ba2acd76072f9f2ac912f9fb61a519a75a5e9d8f1252221d0efbc8074c87df5158
SSDEEP 24576:b47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYSQCBq/McxvN2T/u1mWXMHM9:b47JUQj1irIhCnDHUPfF/BCM/XxvYT/c
TLSH
T11265AE1EA3EC01E5E1BA827885154A5AEA71782D5F31CACF2270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 d679b21ba027d8d4f419987f5970b47130191d27dedfc5a15588a5ef5a27275f
MD5 a538f69e57707863fd6ff772a85dd9cc
SHA1 19239e4369695ac0fae473419ffb1a4444d8861c
SHA512 67452e81b4079c41cdd0001fc4d5cb11eb9248366f63dd4050ed19dfe075d7f614f63cc303851cfbeea007de4d6907a51dd466c1510c35d42f7b2526af50eff7
SSDEEP 12288:dzsfHVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:0HQCBq/McxvN2T/u1mWXMHM9
TLSH
T1A675F01ED29842E8C16E9276C7594A51B7337D349BE0C3CB62D0F53E1F359A09DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6024caabddc621bb33eb8b8765d8bf767aee127084ce4e967902693c250cf288
MD5 9054d3376df9c6e80e79bd508447b993
SHA1 e0167a9e6b28f9cce28abd280f8446980cae2061
SHA512 9ea600d475d61430562bc8516e3e31914f6599f973f488b71767b8092fb6ec2d70971ea9b6392c711a10469f0215f370bb867e2e7f5ae7d3959f7d54887fe998
SSDEEP 6144:BsBC2naTsFju6GjOFZTyOotMx29O7U3fPkjfN8q5T+I1PQgsSq4KyGuVqrAWW4YE:G6C/U3fsHbs7DbWkAPyYjA9EUO/81cdg
TLSH
T11E4507007666CB4FC66980325E33D5CCAB707D11EE046F0373C99B7F9576A59BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 d0b581ce24b05791deb38297c99dbbec20cf0cffa7c9ca67fe8f8bd2c76e474b
MD5 92475ad46eca1e55a924f7252b9db808
SHA1 1c923fcc8f60e52d0a0a21ec94885b0d95d25c74
SHA512 b812b42ac5978766a2551498d035f78b431669bb22470844e5e95dd2f2302dcd0a1e0b47d16189b4d3c9ee707db0f418e5902f417b7e066ac26b9744d31243b4
SSDEEP 24576:46F6wjNDc4LELw2ikvzrEiborhv1rEwMEe00z:SLw2ikvzrEiborhv1rEH60z
TLSH
T11B75F9406537E78FD1B650320727AB8D6768AC03BB496F2273C5553AD86BF16A0F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 4b360af20095d97c90e793c01fac9879055fcb28c5c810587041eb6a6f5202e3
MD5 03a1f233d69997e1c86b1fbc39d3d936
SHA1 6bc8e74c013bc886412914e7f8d813093dd2bfaf
SHA512 a330f52ed937429ca1ce0bc349cd90ce6e800fff49169aab98cd2fbb4f4baa6f7deeadc5133536013a4dcd7812a6f7a3a01b0f3d058b5b438eccfe4aeb98f096
SSDEEP 12288:dL7/VTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:h/QCBq/McxvN2T/u1mWXMHM9
TLSH
T17165232E9DDC9A96F76787B1445D52361E2EBB78BF80C0E7B50022B52770CE19C39E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 52ba1d68f775a86e20cc2e8ecccd68717c2aa410072c02e18ca18530689d71bf
MD5 7e0c5bd6345323c6305be789f6581a75
SHA1 9878f51e8f876b7a59d84cb5e45233e937ea1740
SHA512 0ee53460e11f554a43d2f117925c993bb602beee16bb51f844c59ca5a60cdbe573d24a76fbf803d5a9e0d30f7f97c318b85348b9d9b4508844d9ba35e149d6f6
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYFQCBq/McxvN2T/u1mWXMHM9:Bgb4mBIBhGFrCM/XxvYT/u1XMHM9
TLSH
T1F465AE1E22EC02F5E1FAD2B88DAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 cc883b9ee650ee22079c587442584e147cdbcb6d467c69b7949a397e95133cef
MD5 5550e6e292172b302507c786d21a1983
SHA1 e39faf654838c96a4e2c8de1b451331a81e4f488
SHA512 7121e1e6a22206a3f2dac9e78332e2455e4899044e6333e37c05da2e8e41ff4492363fe489679e828040166170a46f97f3984716d61f57d9c9e61c46862e3430
SSDEEP 24576:aG88u8FpJqH1hzria7/mCQCBq/McxvN2T/u1mWXMHM9:h7ZFPqVoa7/SCM/XxvYT/u1XMHM9
TLSH
T17595016976E502F0D477D13889864663F6B2B8251364EFDF07A88B511F23AE14B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 e4c095d555dc3c195c39aab0f5528e2b9a04911c1086bbba996b585db0525a96
MD5 a33b9050e07376a17353f2280d4cb584
SHA1 a742bcedefad8ab08bdb1e753deb70a3278b160c
SHA512 6841bcfa3c640d3f7d6eab7ac730da2fe29adde7d78a9fd87f471fd26365c92956de7151f9d3dd482666cc20d06a7c327a9fc3dbe41d7aa2ee72959fb168141b
SSDEEP 12288:tHvUrBFrEjwaQGVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:tPUr+NQGQCBq/McxvN2T/u1mWXMHM9
TLSH
T17285E12F66EC18E5E676E17D89864719E772B8721711D2DF02A0817E0F23DE8AC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4ef4c01b721fb61c9c75bf12270c1f89acc18064f42138eea4ea8d4a9d128bf2
MD5 f14dd643431a5d36a01b0b6a94287f75
SHA1 96df1f4c47884e0f92ea2d99052c5455b9606304
SHA512 c251665862b55b256e46f26083a4e2a66bdba6cd3add52d7e9563b043f30c2e8074911255513cb99671972138d7dc423480984770af753aff718496a11b0db67
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHCM/XxvYT/u1XMHM9:TG05lO43bvM/XxN1cHM9
TLSH
T12DD5CF6E62EC11F9D1BBD17CD9C6460BEBB23825033456CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d16c40763a14ab8c719230424e696a8531710ba5d9fc7af09c92cbcede928214
MD5 7bc61a80cc9c19dd56d0654219965f21
SHA1 623abd36d15c414fac9fe45b26004214a3328fc6
SHA512 ce3c2584607f8ae29da0f78db750566c07f8e665d911752d5d8678a895189d2ca8ae7a93b7e21160dc0c673f13433672652e88ef37c344616aafdaaaeb6ef5f4
SSDEEP 24576:kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnkQCBq/McxvN2T/u1mWXMHM9:8a5POZ3+Jt2pasx2+mfCM/XxvYT/u1X/
TLSH
T13E65BF5EA6FC01D5D1BAD17DC583861AE5B1342553319BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1434b36655c667fdcbd75b0d6c386073f28f5b1f09d6a63037d64d9d55c1516a
MD5 415312ba9ecbab4511059925339b8535
SHA1 821e319c5b56fa29e589ed23ea9cd4574346f734
SHA512 c9e1efbace879483859a010c97f6ac8222340f49378c04491e8cb251b5308ef45812a598acb05a8410eda74368a0d474530c9d89ebed82ef6234565990e28bea
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkKQCBq/McxvN2T/u1mWXMHM9:PNc/zEOVHFyCM/XxvYT/u1XMHM9
TLSH
T17D858C1A22E901E4F1BBE1BE89779546FA717869573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b340b6f14bd1ff93bc292cf7f47e18acf6b228c6f5d0b192d94c8f0b9dde571b
MD5 68872e3f7926cb36cc98c9f48624060b
SHA1 96a22e54da0553da5d05b7162c6debd8ef0e37f4
SHA512 f8dd72ea969736cb900b994f07fd3b6894dee5ec80380e9ffe7eac090e87199d15cd4ee4e7eb956e2b3de15ac1547a03e4e2cf5e12a9eb6759adf2920fbe18bb
SSDEEP 24576:v8kNvNnaFeYhJNtmZBmQQCBq/McxvN2T/u1mWXMHM9:v8MwBtOmlCM/XxvYT/u1XMHM9
TLSH
T10255AF2EBAF846E4D1FEC6B5CD238512EA727461173293CB5290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 cd0123b7fd01b4a85483fef9014f5336217913799884f22cdab0b7291923750c
MD5 2fccd498a0ba91c3743bafaa01013a8b
SHA1 4989ae1d42663ff314e00a3ebf874b62586c0e98
SHA512 64e488bab2ee1808d6dafcf7c1e96b3c4eda1241af7bc447821ded36881bcf83a90d104103b619c48a39304476fe908143c307ac21bb4f93948bc32ae0ff7ab5
SSDEEP 24576:iD3FHshBIYQgAbQCBq/McxvN2T/u1mWXMHM9:iDVHeBIAAsCM/XxvYT/u1XMHM9
TLSH
T1B895E13EEA9C04E4E57BC2BCCA638A06E77138BD072155DB129481B51F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/360-77-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/360-260-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/360-76-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/360-82-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/992-111-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/992-309-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/992-119-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/992-113-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/1184-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1184-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1184-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1184-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1328-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1328-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1328-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1328-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1964-135-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1964-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1964-132-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1964-126-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1964-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2716-106-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2716-311-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2716-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2716-99-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2716-295-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2716-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2824-65-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2824-233-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2824-64-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2824-71-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3428-75-0x0000000000400000-0x00000000005A1000-memory.dmp

Download

memory/3428-0-0x0000000000400000-0x00000000005A1000-memory.dmp

Download

memory/3428-321-0x0000000000400000-0x00000000005A1000-memory.dmp

Download

memory/3428-8-0x0000000002240000-0x00000000022A7000-memory.dmp

Download

memory/3428-1-0x0000000002240000-0x00000000022A7000-memory.dmp

Download

memory/4840-59-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4840-53-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4840-48-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4840-199-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5328-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5328-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5328-14-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5328-22-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5396-93-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5396-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5396-370-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5396-371-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5396-87-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5396-280-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5476-37-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5476-44-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/5476-38-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/5476-50-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/5476-52-0x0000000140000000-0x00000001401B5000-memory.dmp

Download