96ed0a6adaa8fa68f7d8db6e47d8933ed7e229ad35fcdb04073f20029b23ac52

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
Size 1.0MB
Sample260522-tspbpsby9w
SHA256 96ed0a6adaa8fa68f7d8db6e47d8933ed7e229ad35fcdb04073f20029b23ac52
MD5 f1df02ca1e79eded2fb45baaaa56ac23
SHA1 b71554542d8ca07a8e656ab60c398f515caf6cd2
SHA512 8e52d53ad4215aae1d891338fec907a08d21a6810a9169dd62d758a7d30642b1d49c6a93b978dc2052b2aef75e74897f9a1498173815fea51624c526475d693b
SSDEEP 24576:3ZxmV0qksuPLjRVYdPcNYQh9pf1HjnamWzRdaz/zdA+Pol:fmV0qzuPvRVsE9pf1HWzRYz/zq+P
TLSH
T1FB35D0117BF0D172C26275B50A66C269A6AAFC305F3543CBBAD42B3D1F306C29B3D256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4604	alg.exe
5900	DiagnosticsHub.StandardCollector.Service.exe
860	fxssvc.exe
1864	elevation_service.exe
2580	elevation_service.exe
5272	maintenanceservice.exe
5584	msdtc.exe
5304	OSE.EXE
3392	PerceptionSimulationService.exe
1976	perfhost.exe
452	locator.exe
3640	SensorDataService.exe
2184	snmptrap.exe
4112	spectrum.exe
1780	ssh-agent.exe
2444	TieringEngineService.exe
1856	AgentService.exe
1248	vds.exe
584	vssvc.exe
344	wbengine.exe
1696	WmiApSrv.exe
4488	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f5e36438ee2c9d24.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173093\javaws.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173093\java.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6af9fca06eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc576acb06eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000855a4bcb06eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd9627cb06eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5c51acc06eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028095ccb06eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001feab9ca06eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
Token: SeAuditPrivilege	860	fxssvc.exe
Token: SeRestorePrivilege	2444	TieringEngineService.exe
Token: SeManageVolumePrivilege	2444	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1856	AgentService.exe
Token: SeBackupPrivilege	584	vssvc.exe
Token: SeRestorePrivilege	584	vssvc.exe
Token: SeAuditPrivilege	584	vssvc.exe
Token: SeBackupPrivilege	344	wbengine.exe
Token: SeRestorePrivilege	344	wbengine.exe
Token: SeSecurityPrivilege	344	wbengine.exe
Token: 33	4488	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4488	SearchIndexer.exe
Token: SeDebugPrivilege	2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
Token: SeDebugPrivilege	2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
Token: SeDebugPrivilege	2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
Token: SeDebugPrivilege	2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
Token: SeDebugPrivilege	2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
Token: SeDebugPrivilege	4604	alg.exe
Token: SeDebugPrivilege	4604	alg.exe
Token: SeDebugPrivilege	4604	alg.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
2468	2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 5764	4488	SearchIndexer.exe	104
PID 4488 wrote to memory of 1472	4488	SearchIndexer.exe	105
PID 4488 wrote to memory of 5440	4488	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_f1df02ca1e79eded2fb45baaaa56ac23_elex_remcos_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2468

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4136

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:860

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2580

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5272

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5584

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5304

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1976

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:452

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3640

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2184

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4112

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1780

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2280

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1248

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:584

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:344

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1696

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5764
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2848 2852 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1472
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2856 2700 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 22019ea014b1b9eec22fe8732c32bb5875a866043898c8689afa3a0d956627be
MD5 52da4d36ec266380ec712ba10b7e4a06
SHA1 b8f0c2f448aa42907e949e0c5b502368191528fe
SHA512 9b08dfb02520971a21bba096b1ea999b95c164da7cbfe81917e5dbeab9aa0c0940816bcd9308794851c9ab6c0a98722c031e9b435372742bf200fb4fa01ed5f0
SSDEEP 49152:6b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnT9pf1HWzRYz/zq+P:s3q6sjB29ptHUkL5P
TLSH
T160D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 70b5482c4df10485097c2e2c380b2d9e08b596856e2ac79e8713b59765727a89
MD5 87c6c72d826a48a9e0161460b019aa0a
SHA1 cc41fb9c544d2cbcdde40bf40e11c78b8d28a11a
SHA512 d884dd1e0c9c9f45b870c11f27ef822c296865aef96d6b92a68f2c86027e032ba9cc702338bb01a4f249f843b7e92e0f6e65a75df57ab60089b7029736176db8
SSDEEP 24576:FXYfDtczAUh9pf1HjnamWzRdaz/zdA+Pol:Qtc99pf1HWzRYz/zq+P
TLSH
T19305F128B7D408F9ED6B827CC8A18515EA73B8554760F79B03E489750F336C85E3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 f745aa0a65f3678f86c8edae0b944ebc3bec008700e1ad9eb22ffd6ef586b48e
MD5 4be6c29b4d38bc296fd957e5f74522f9
SHA1 82bbb2769efc34f7829de52514c4d0914c990f61
SHA512 7a7e65e3e80d2dc35d85ae9bdf864f5380b2e44d0bb34308ff846618fd255a3a7fe87db6df999325ab2627004b98af020dc20edea3ded347435b1117fe7d3cad
SSDEEP 24576:y0Le5ji0hmxxrMNh9pf1HjnamWzRdaz/zdA+Pol:yPji0AjA9pf1HWzRYz/zq+P
TLSH
T15D359E15F6788731D073C0B9C5D2A68EED7130865B308ACB4286C77C6F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 88ad73adc614698f5dc88bcc71f4f017b9bff77cd974cf9b36e9d24d0cdf3f08
MD5 c3013ffbc74e353c324eedea5762ca74
SHA1 df61fa6d41baecd430df38891c4a8dd279a4846e
SHA512 1fb3ed244fff44f6d72f5b951421756cfb5154b6820f2f0c2216c65b522a2a73571d17d45e5edad9336392232cb6ee12d38fb8c633c5d701c2c45649b5228081
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWn6q8wyurh9pf1HjnamWzRdaz/zdA+Pol:o/ezSC6vUzPveHjyU9pf1HWzRYz/zq+P
TLSH
T141755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1865bea98a45cec81a887180f354b78888f52e95e8c06566409fdd44ade19071
MD5 ba35c2a5746542b043dfdc05bae2ea7a
SHA1 7459965a1ad1c38ec8a612c58ac7d409a3f1f65f
SHA512 e78c45d313dc79321c7e745db88cb7ca10c1cd06c022f9e587194c590342ddeff8e008ae5ba39936dae56f067aa69b91aec4449c38efb227554096eb91c7cfaa
SSDEEP 24576:mVbqPb88hv/l+YYh9pf1HjnamWzRdaz/zdA+Pol:mVO88hXl+F9pf1HWzRYz/zq+P
TLSH
T1B9559F65F5B48331D073C0BAC5D2AA9EEE3234425B318ACB0246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8a657a5258d6e304bc1345458ede2462c74ee110df8fb5cfddbb819c35e4315d
MD5 68c2a3ee562825f26b519a955f0c766f
SHA1 a6ba9ec3b4c7718d5822d4b1f6834b484067451c
SHA512 11bbff22ca95b095789a9ca6729be98023ddd24bbb5d7b330db725a3ba0184056fbb83317bfd582f493e51fde47a8d959b33f07c6ecf5a45747e27dcbb150cdd
SSDEEP 12288:eLBEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:eLBh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T155C42385FACC68F2F3BF5779615C9299E9C2AC087C6072674966CEE94234C0DC91E933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 75ed460b63fbcaf1755c9b6db03acb6192d32eb44f4694f0753ff831c507b943
MD5 adb7af4cb03807f54c467600332b6194
SHA1 eea83d2ed836ac4ca862ff08122d3e7ad00384ac
SHA512 90ae0139d6cdfdb3e91c7e1d754198e1aeaa0f521792f756116e8ac54a9d6d58c455eefefc3abc8875599f33d942ff7f5cbeef608f16973f8cba73010620db82
SSDEEP 12288:XeBNUbTVO86UgEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:XJIUgh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1DD05CF6BEE28FCE2C27E4DB856518240E7A278304F61A3CBD175C20EDE235D55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 704b9b0296d2ee7af3df8517b103febee1322857e835e0097532299ae84cb3ea
MD5 f4ae2f29ffe2f3b7b871035bf9c05137
SHA1 2d15c7f2d14a01c6b8a617ae2b66d33b3666ce99
SHA512 37f521efde3ffe2258755ca523cbc0435382ea47cb92de0d24d2cdd1f52c0bd175d9521b6e24c480a2696448278bfeeac85caed7572ba3819a90dd67de0a8e07
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THe:DQvGAdlCEL8c/DRNw5Cd9ptHUkL5P
TLSH
T1A6267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 3b858e203dcf5f80d922390f568776bdc78009076608ff7eb60e82a0d870054f
MD5 1abc9dfb9fe4b2f5dbb21d63a4070b62
SHA1 02de7230056df4945a0a25dbb36027e5784b1907
SHA512 879cbd2484fdba9e62fd6d633f05ed7b44e5a578652b94e43970e8760f3654b76f0695e2ba980bc506cdbbf1ace9056c38fbcff935598248cfa2ac427a61aaaa
SSDEEP 24576:c0ewsAjuh9pf1HjnamWzRdaz/zdA+Pol:BljQ9pf1HWzRYz/zq+P
TLSH
T1AE15E031FE74E432D3BF0DB61B25C716546DB9204F612AC3E3A88E9D49306D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2aeb34a3dfd7a141539540dba86ff7f66facc4cc40f5897dd50238a87b4b8169
MD5 55a45beba90fb753767699ceb310c359
SHA1 7ccc3ffaeeb21b088b16305d8bc53f46136bcd50
SHA512 0f06432196ebbe8017f54a94b470559f136a5dedbd6ad3ea13a44aabe5394e04028e9904cb0782ea8dfda709aca859980dfc2e372c191ff78135775f3f1bb813
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHITRL5P:eUEtQevvqc2W1cpV2tI32+
TLSH
T17F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3a1be343eb8849fdb659f42f43ff91e37b70f95306bb9774278109dfe76526f4
MD5 71e9a3e2f7e3749c84509f5a3727aa39
SHA1 e02b2e7a79d7fab10f5998bc927cd64d4fb2f08c
SHA512 c38b26ebcb3e05ccffebfd770b1ed7bc7bf15cbe137844963772d3dd23eef7e555e1a6468a99db9a0e2d0f08aac6acf8f526103aebf3014c8b8be8c68a64817e
SSDEEP 49152:PCbRquA/m2yL5zTfFiV+XenmE3/zw9pf1HWzRYz/zq+P:IoquVjnmR9ptHUkL5P
TLSH
T1CAD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1b1b4dbdc3fd57bfbcf4e85e619770d834067bbd72090b758af6fe26af7a3472
MD5 68eed839d43ac6cd7f50b8c1810f31ac
SHA1 808686d7a4e0710c3ca096fb46559fe87790220c
SHA512 2417283665aab4eb7b17c227205f1cf530c0ea5310aa5396b2ac57336f407aacd9a27158d458a40bf12a2bee9ed03a7ad95041349ae6682555a601c3f322022a
SSDEEP 24576:HAhGL3IFoiwtA5l7S533h9pf1HjnamWzRdaz/zdA+Pol:HAMUFoiq5h9pf1HWzRYz/zq+P
TLSH
T14F359D81E7F955D4F5B3AA7899B68171EA76BCAA5E31D20F2160C11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ce978631ffe37b813ebe5e52df9afad2db4cd668efa59e14a3abce9318130c29
MD5 d2fecb90fdd172c303f0600627d3a206
SHA1 50cd78bda812e831ce5bb835b8229ba85d764c63
SHA512 8e7a6e71a82da1b3667febd213d7cd23f62d1aee50b83628f70713a564a55823a13fbee53fdef92510320ac4fa54984be7b9acafae86d1b104f32c2930a2282f
SSDEEP 12288:omw5HEjsChNVBFgl0WDm+CLEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yx/:Fwu4OWah9pf1HjnamWzRdaz/zdA+Pol
TLSH
T16405F14A76D81CF9E9A792398557C136F7F2BC022A21D71F0760C66B5F33611AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 17f0d2136c3bb8dc33605c2d8dc80d4d65de663619e41da229a5ef80e1b3c1ff
MD5 3083460bbe9ac306d71dd14ab8c60f41
SHA1 e044117c28bad5a715a741ca10551f508dcc15a5
SHA512 c1d79db121c64ace6c07467c639dadf9de38a1b760e40045234001871cdbe23f4ebd314e8806db541ee016b8563ff754a94f4c70ff8282ba105212d912ad6388
SSDEEP 12288:teZ1Iy+EW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:IZu1h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T124E4128973C820F6F2A7523C94E44649E7A2B856373153CF066586A91F33EC95E3E732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8990133dcbb24a1581c7c5db6def07d201e11476919f5914241efde9a76b1ea8
MD5 2f7e5ab505369e2eda9cf301267f3f55
SHA1 ec56449ecd65b41ddfe8032a55d644496e4d4908
SHA512 23231caca8faef427cf2f770800151d0c6073b330869533c25e2a9f3be8b626e103a9d2382c2eb2fe611ae6e02d01caf3b649f00352360ad5620a3f24620a151
SSDEEP 98304:HQRQyi36YOcPbLvw2gAf+PN3i9ptHUkL5P:WQyiKa/X+PNSTRL5P
TLSH
T19C667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d7ddbedfcb34f7e137135f92313d0eb25fd56ca897044bc6c7462c62764aa039
MD5 b714aaab5dc754443c130acac54c2ae1
SHA1 096a4a615f1f7775555876ffe2824559a0e5851d
SHA512 316e420820d4cf3212e388d9f1ab61212416b2fc6a09f0d1679fd988102ae822a5a3b3d15b3fe84e969a64e431f2f49d994771075e25eb9c2543724a06633f61
SSDEEP 98304:MQRQyi36YOcPbLvw2gAf+PN3i9ptHUkL5P:TQyiKa/X+PNSTRL5P
TLSH
T1D5667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ab92dce9d1203ef688f232238ff8b29008a78bcdb43331a9882406794e2f101f
MD5 dfda23072c4b00b305f7a8a96b212c84
SHA1 5d878e8733739907f66b9231cf9b530077e9ffb7
SHA512 006428cb00fd6fd27cc85c78451b90484450f550b665c1656993b5e6baca63853e34b546d6d3efc747d08c41e0a57b8d973edc6a1f59edf8a70cadc8e5da013b
SSDEEP 49152:R68Qg55nhceWu7PNU3/A9pf1HWzRYz/zq+P:PthLRc/A9ptHUkL5P
TLSH
T169B55A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bb6cc95f714289bfba2bc358bd9256015266537514cbc61fd080bcbcaba6fb1c
MD5 a7a4fab2372a705044f98d682fe4b72b
SHA1 00e6be9cf3ff1e8ad68e981e4474a7be8b8a5d8a
SHA512 17f135448a97ddbd941636f02434e5e38ba05d20a584cc91c1808808109c3077c69950cc380b0dfed148204e73240f0ce8f9c81f89762c706304c86d9fa394b3
SSDEEP 98304:+y5112gYy5azzVvt69nLKnhZ39ptHUkL5P:vLIHEWhJTRL5P
TLSH
T12A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ca87f457ed53d490fadb6125ba8e0ecb6df1e0ace6d615eb980f42773a9a2371
MD5 4680888da900db77b9825df2307bbbe3
SHA1 708682098d72c2a2e2caaa51a1e6c58531980343
SHA512 fa1c1a5cb9e808f4267cd7ad65d0cef062f3ba5fb1e45a88a90f5acbd96412b33b57219f4a97bafea90ab9e67746b584c159fc6edf60c7f645d212777f521390
SSDEEP 49152:aB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glq9pf1HWzRYz/zq+P:Iu6Jmdxd2dq9ptHUkL5P
TLSH
T1DFD59D13F1D901E8D06ED578974A9233FA62BC490B34B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1ea5afe49608508c8111980f9e2fbd829c4a87974ab93dbd833d54a6d3eb5d90
MD5 bd4f37b3bba142c3d62a8c93399df4d0
SHA1 3ff7a3fbfb3d8edcdab2773992c0abe38901d6a4
SHA512 21867c24a74f4fb1997620b060d5174ba57980f39d0e8ecf36f1a2717dc99cb345bb25267714767859c61d0c962deb4caf2111721e2269857f393f0343ed20ca
SSDEEP 49152:q1hpsNoJpF1A63U44CwH7R4xO9pf1HWzRYz/zq+P:qmifPWRR9ptHUkL5P
TLSH
T1B0B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 79ce91e21f3b701e98a2e978d72e4b9639eb15c437e12cbf922b6f35aad23242
MD5 1e41a681e0dd22db7776e67f8c80299d
SHA1 1a9023b09791aefc12848a792fb3780b74140fc5
SHA512 d957c3ba78598a7f286e529131736ab7cbedd9205056b766450fdd79ff5c997b7efd5a16108e1000f1f88f6d1a1bc3dc077d3f148a012b5c843ba28ecd1647fe
SSDEEP 49152:hSuZQIY0Be2KcRVtOnks6NMHqj9pf1HWzRYz/zq+P:v5dKii61j9ptHUkL5P
TLSH
T182C5BF03F2E940E8E0BED67887659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 296b6955947176a65612d583cfccd8dd2a09370c09ebe141e470510a1419257b
MD5 3f22a7a698156af5a4d13e9326f93673
SHA1 21450bd1f7420453c01c3577b9472f991f0f7af1
SHA512 1743bf4ad2ce570c6b6445435a35f29cfe3c6a4ed0159ec8ca54ba1a7592086bca6bf6176411e7a0754cfc1b5af2c50893c849677b926aeb3989286b3033327f
SSDEEP 49152:ahtSn8EApI0fig3giDn0AP5w69pf1HWzRYz/zq+P:bX2imphV9ptHUkL5P
TLSH
T16695BE13F2D900E8D06ED178C7468632E962BC160B35B6EF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 5824b4236d9f0ab26420986ece7c573006d95ac35b5bd62aa14ffddfdcb38d6f
MD5 e12e1740ed10cddaba9f78de34bef180
SHA1 cf6d3d55cbc5c51b4b21c5a5e28f0509c8083b9a
SHA512 c4bc336b943b69df215a3fa62bb263fa5fd5eda78e4c7cfd2bc3752ee9bc047696d93723980571e57e38f3e2dc797dd20d622da0856b98330609864aa70ed8a8
SSDEEP 12288:tpEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:tph9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1E1C42384F9CC58F3F2AB53B9911882CDE9C5AC0E7C6032A75A6BC9B54371D0D4A1E972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 eb169a2e3eaf4daf571926c6962e0742c0e675c8f092599a2907e36e6c9c46af
MD5 02b3b7d93c4b190832b64b9f2e2f4b32
SHA1 b8595aa72f73a7099e23c5aeeeabb3b04f1b475c
SHA512 e93570865b37d6b02b1d353a2f3871e3102032c0df51cddf22cd1a1e83d454a8033a700f53ce71758d99f8b91e44b6cdc4c124a35a3818fe8896b187379a67dd
SSDEEP 12288:zSEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:zSh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T14EC42384F9CC5CF3F2AB5379511882CDE9C5AC0E7C6032AB9A6BC9A54371D0D4E1E972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 7115ff6451c6b6f6c1ef90953ac42babd2c20570e1158235d606797b877d3b1b
MD5 647cf94389f673d31d40d2f0bb9d9bca
SHA1 409b7b9ee0d291257829e8b9da2ba97e1bc309ed
SHA512 1953c99e7dc27be87b24f803ff8a2322646bb5683263e8df7efcb38dc02d35d3b8d16c4e603b1786594879474de5040c0e3ecd0859b03bd4ec093e4583685a1e
SSDEEP 12288:XIEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:XIh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T127C42384F9CC5CF3F2AB5379511883CDE8C5A80A7C6032A79E6BC8A54371D0D4E1E9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 8b5937901c46f6502fdacb7f89731409f663d020c74f812ba2c397526ce313c9
MD5 1791ef8911ec12e1b80d8939ca7f94f0
SHA1 37e03fb34a8d81d3e974b3932965f19b648ab5a7
SHA512 03b9b2dfc6b130f7b1a00a81f4790ecb1e5ac9a17304d86807da6321134b38dc61f76514eeebb9d5b22dca5c96668d4bd8f994b5ec960505ddc0aa18cc9438e2
SSDEEP 12288:QVXEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:Ah9pf1HjnamWzRdaz/zdA+Pol
TLSH
T118D42385F6CC14F2F1BB9379C1288299F6D1BC49B93073AF4A2289A50B71E4C5D39E71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 70471355b755c6e62e683a099f3eb0544e2417e395077cce223b9c6b61795458
MD5 57b51a3993748641c7768cceb1b4ce8b
SHA1 a49283c21779c45d45ae07cf893ef28d08016886
SHA512 ef373f41c63cbf508d5de8c564493de9778a6ac37a3ee0f145fdc6fd5921c3bb583e622eb97b97f5de1757ba2b4f73ca07762d47a7ea9df7d6f9b8f2356f650d
SSDEEP 12288:bPEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:bPh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T107C42384F9CC58F3F2AF5379511883DDE8C5A80E7C6032A79A6BC9A54371D0D4A1E9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 bf4cb378ad3ff3c182758013a7c03ae78e7e198523cda762b6606b4ac9bfe95b
MD5 c76ac9f05445bf6260eb47f62d2064c3
SHA1 9301c36c305a724d7fd015a56e48be23b05088a7
SHA512 63c528910f16f3dbd7d3ad9daa5c5fe5f8db4f2d8ab77d4e9e02274397c308b18ea8aa6165d97d18319d81fbba287082586adb8dc6c27140b7f6f847147b1f1a
SSDEEP 12288:7WEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:7Wh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1B3C42384F9CC58F3F2AF6379511882CDE9C5AC0E7C6032AB5A6BC9A54371D0D4E1E972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 93afb81f36e73e7e9517054712c2e3c8c4d83620e16a708a5ed7f585583bdcc3
MD5 12db77ff2e493fce7bcef020ca857461
SHA1 51896e92adcb0953b42016fa8091f4ab3e804ea8
SHA512 d99b6b5ecb68a3faa0dfd88b5c382b2d9b2c0924df83dc09e47387cf89a344b7da63d4bc65a4f9e880678cc497c03a2a942ea0d0ca5bd111984a98ef2880932f
SSDEEP 12288:ZKEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:ZKh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1AAC42384F9CC5CF3F2AF5379511882DDE9C5AC0E7C6032AB9A6BC9A54371C0D490E972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b81d003d8be91d7e8893c851127591b3bc938928a8d287ee01e3d4de4dbbc75f
MD5 a48307c66e2ed417d5913b76804c6851
SHA1 3d1249120de7cae2bc7d83225538ebc41052fa4e
SHA512 a269dd31872a7182ff68cabad54d1072e1e542e4e82af458f8bbb9ce3842a75c5bd610f7e07651fd5c724f2ce93bcfb4fa15b831605a5eaa2623ffea7c9f2e1d
SSDEEP 24576:1ZMRzFVSOyh9pf1HjnamWzRdaz/zdA+Pol:1ZMRzfo9pf1HWzRYz/zq+P
TLSH
T150050195B3841CF5ECA7823EC9158906E6B2BC1A1A70C61F03B436665F337911D3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c08498461e12cb1d0431f7e31e112abe3dc4cae02cb6af590573064d315c4efa
MD5 14fe1166ffe9d674e8f8012b7e892204
SHA1 c6f89b2d1ad597d0d9b0a5e74324623bc463f5d4
SHA512 ec5745d04d0d97af87f095379425f026b9b7cc6fb1ae4d85c07a3d2128ab42c4b39a5b1e5bafd8c6729be25a17a7f6aa1b9f140e526810e641f2e11fb7d5f61a
SSDEEP 12288:OFEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:OFh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T183C42385F9CC58F3F2AB5379511883DDE8C5A80E7C6032A79A6BC9A54371C0D4A1E9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 65f543449ea0f96b5dfac11e099a8eef9f490854d503adf868a37f2f3bf311f2
MD5 a3ea550a211f38ccc264d24f7e1465a1
SHA1 6e42f64427e9cea89b17d85bf4636f8e47d477ee
SHA512 cf6664a5faf5ca52632a89b47cd2f0d5de2c51928d52fa7dde492fd8064c8979dce199b8db6503d7cc84e7c90df6c4b563035541c464d93acbf280dd0ab6ea8a
SSDEEP 12288:PREW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:PRh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T112C42385F9CC5CF3F2AB5379511882DDE8C5AC0EBC6032A79A6BC9A54371D0D4E0E972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 848946ade4c96b7ffbe6856f996e078cb679c1342e2f991f3a941b87d031378e
MD5 379ba227b52493cced7226e029c08899
SHA1 c10566a5674cb51da81452694f883f379233ce92
SHA512 de5bd13b3dcdd3fff61cdbb7701b9f41de3250293476f584f3b3fb3dea8f547795473fb8281be8a980b2810bcf273f83643409842a6f74343ad3e3b74b3a1cc9
SSDEEP 12288:TyPz5L8+EW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:ezy+h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1FAF40247B3D430F9E177923884650A45F7B2B8361B309AAF176446B61F33A949E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e2cd0301421219e5e9b521a3df5e7b09273fb01a681965f7d4a66e7ec82a3683
MD5 7c585a8670d3e5dc09f8357bca1eacb6
SHA1 9bc13ef640d37bf312602e552d49cf6b53ba9069
SHA512 654be71b4da4c4b6ec542ccf8ec3bdd1256e9a2039edb5eff9d615120968d2e830ca20385808735c5d0b7b2a894b606c981a17c32651368edf40991bac6bbb4e
SSDEEP 12288:mFEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:mFh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1CDC42385F9CC5CF3F2AF5379511883DDE8C5A80E7C6032A79A6BC9A54371C0D4A1E9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 c660220b2ef7014b31336b191a016dce93fd8b35568c61caafadc698124c607c
MD5 2dfb97a6f7691d1baa784dc1620394f8
SHA1 72f56949d6da321feaccbd99aa7d7a1cd4c57a83
SHA512 9ec5e2e15d4e0c33c42be0a8a0d771dd1af2d1c61543d58239fbe0bafcc56dd5e75c098f4315d0385e1830385449c5aa2290b523fe4bb9d94fc0803dfbd1d880
SSDEEP 12288:DFEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:DFh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T195C42385F9CC5CF3F2AB5379511883DDE8C5A80E7C6032A79E6BC9A54371C0D4A1E9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 b8ddfc3632fe8094ba900853f4d2d6a791f04e0fd24836e243a376d574182e19
MD5 5e4929f2f31b9db86c4670edb025d575
SHA1 884722cc43cf09bc99d2df333d609d8b5451c09b
SHA512 6dc6c47d9642578af6e9ec5ec1fc9dc66a4e587deff4fc1e83dcdf9b285b2e4925252e4ba3b67d4717bd02147f33143880f0e85be566d4c4b12c62a2a4103fcf
SSDEEP 24576:tCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAMh9pf1HjnamWzRdaz/zdA+Pm:tCUZPTY+8Wg2lIL8lrIUJLWwp9pf1HWM
TLSH
T11965AE1DA3DC0896D0BB81358A518A06FB72782E1B3296CF1160C77D6F27ED95E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 95cea082162bb3c83e0e3502089988f0fe63bd0c528170ad4c72ce51e6d4446a
MD5 21f90eea27e941b77823f4d921504787
SHA1 a86e3887b984f45a33e47e675aa0a92be27fc5fb
SHA512 dfe886f34f8495c7a4bef56a50cb51b48db52a2bdf5022e2e136c0ddbd7deda903227331b504ff9958240bcd6dec7d38e16619cc488e6563ce0402fcaae97c86
SSDEEP 12288:ebsf1EW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:l1h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T13BE40149E28802E9D06F6239C3554685F3637C2597E0E3CB56D0F97E0F36A849DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 81bac71ca40911dce84fc8d0ede57c8300ff4cd7acec9cd2b8942fc6656340ec
MD5 2bfd483961f99850619ad1d58e411941
SHA1 764074d8990c40609e1722a648f0160a1cd1ef19
SHA512 58f8e8ec353afc049b72c9ae43f3aef89c943a2418f0bba41dbf4d5cb42f8d6d17b8cfaa0b078f8e506ae632bc996f257531a858b1924f056eb192009eb50e8f
SSDEEP 12288:1oEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:1oh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T128D42385F6CC5CB3F1BF6778101C8269B58AB9187F2071D7A9168AE54230DCD9D3EA23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f03020301d360bd02d52894cdb875cda77a5ffef8980014f24cdf35d3e930d6b
MD5 f85f69ea969032cbd6073465e2281138
SHA1 9c3ebe2485ee8524773e026a25949ef1551ceab3
SHA512 182651048d4b811ed02d3995d282fac94d2b74e32e62d26f94c25fba6c0afb3b5bc39b08b792586b1ea6dc7ca58e8574c8c06eac8f85f18213625d4585b968c4
SSDEEP 49152:0RZwQCyiHiQEaiPnMb9pf1HWzRYz/zq+P:a9xPPc9ptHUkL5P
TLSH
T19085B01E62DC46A5F0BAD278CD674407E6B278165731A3CF0291C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 3efccf6ed8610a1abd8b9bf06a6ba2c1dd858af701b3893246b5fa734dace28e
MD5 47c9ab6affc227fc79ed6b7dc9d8d3e9
SHA1 b7cfaa061f7da25e996ff381f04ae98216d8e07a
SHA512 bbea9dd632a2af8c7ae65969eb46a1d180a82a4f83a48890d625cc94dbca4b4c593731552b8889cd9d753e8a2ef9cc78b35f83488936a80f1506ba64481bf8c9
SSDEEP 12288:CbxA1U7K4EW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:CbxA1UG4h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1F9E4125EA6CC18F1F17BA23D85958109D771B81A2720A3EF1591C2BA0F37ED85C3AF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 4d2453152d900f6da08380d84f9ca5570eb5eac3921ee2dbf3ff4c087ce27e93
MD5 b171e2e48eee3a2197c9c7b79d52a84c
SHA1 ac4a7288b4abbc81bd39d0f0ac5cc9bcc78bb62b
SHA512 b9478a1657f3ed7d2eaee4270ef529eccf556d34957af30f6c310ac88f7f82477a26c7264d6acefaa58878515395dbffe8a7445912745490b1692d74f623e9e2
SSDEEP 24576:9jsmP0yHaqrVqHra44KDzMsrnnh9pf1HjnamWzRdaz/zdA+Pol:9jRP0yHfVqzlAsrnh9pf1HWzRYz/zq+P
TLSH
T10445AF2EF2B910F9D4AAD136454507B5FB71B42D1F209AC70170C634AF0AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 cf6e64b9a95fb26a7c7ca421f4a01bdbb5a7aa3c971c9b00e7ff67c9c41ec5a1
MD5 ead718dd7fd18af7de08331ea68493d4
SHA1 ea0849cfe372d8c592e81987c9328fa11d3b7206
SHA512 6f3ff0335dcbbaa85b6f75744061832e1420865f148b462c21c69749f8bc64c49fa4ba40f85fc15a50616e2632ab312476fe51f5b0e18cd81f23eacc75803ee3
SSDEEP 12288:N2EW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:N2h9pf1HjnamWzRdaz/zdA+Pol
TLSH
T139D42384F6CC5CF2F2BB577811188299F981A9093E3032E75867C9B54335D8E4E3E972
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 7166daf24718a66403b42508f62fde910999d722f791276147e8c9ea62165cd0
MD5 10292efafe2443a25b45547afee3ea47
SHA1 761b0998779d391396352f6f52d36aabe09cb33f
SHA512 f4e7fce21f27029887cc6da03eadc9ec81a29be95ebae0843fda4e73e2fde4c3c2a9177984c6b0aa183a2a967ac15634ca0b8e7ae39e5b33ec10af4b2f4b1783
SSDEEP 12288:aObfA4LWO+vAYFTUEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:LbLBUTUh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1AB250144F7D800F5E97B823CC5668616E2B2B85D1760E7DF03A88A651F237E54E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 4e3b90fb28e6a0f31c7434a3caca578c57626f0ec9ba7b828f83133f151f3c08
MD5 c35c725d77d011380895b204a9d7b509
SHA1 463c3b11b8434e8f8ede25e33283b9139cbc9b81
SHA512 e18d4d668dcc809a0c6ea19432231075c2736bfd6e8e748beb140e50b12829f86ce02f6fa0027ef29fd892f8453ce6364f3d8819945762e018a6438b74c25fb5
SSDEEP 12288:l70Vm9IYNvUyBpZEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:CpYNHjh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1EE05F11EA29C1CE5E57BA17D86828209F2737856171192CF05B0C2BA0F27EED7D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a3dfb422ac607f056bad0885541be113d295704d77f73d5e1a27c48128de010e
MD5 545aa56a6485f195cbe55c51992fb04a
SHA1 74971e9a27ee59c4ad29b9f2d07b3b0cc5aa25f1
SHA512 c18744901c889c8983740818b568e1dbaa3c610a67f257e00ee7b4b2d84776ceb3b8067e0a241281f4b1732a0348dc68ea37cdbde8cac1df6e1fc8702cc62c20
SSDEEP 24576:vnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK5:vnXoJJYH84VVS6AmEOJas+cHBjSSKHPU
TLSH
T16665BF9EA2BC04E8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27EE55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e1fa431ff2a4cbc871b55edaae6801536fd8ac454f1b362d6354bb0b9b58c3d9
MD5 9671e0778933b2cd9443d1a1d5996b06
SHA1 da5a75e0a02294e4d0982902ce58d01061fcc0d6
SHA512 b2d67f87d30b3d6e46f290dabfb5c19b6b3e9d163f7fd94b248c56c73edb1d6525188fe70a5980282cce5613ec08593d6d4fe5e3c1b14e6aa8d8713dff3a179a
SSDEEP 49152:vDLL9TuJ0M/TYj2PY9pf1HWzRYz/zq+P:cc9ptHUkL5P
TLSH
T1B9858D5EA2EC42D4E0BBD6BD85B79146FAB2B855273081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 a9b675b750f123cf978f18a1f6065dbf8982dc7f5604f84fffe242ec88987bfe
MD5 ff961db256e12b6d72d08cbfda7f0e8d
SHA1 0cde3dcdab0962d1d830a79960bd403934bdc42b
SHA512 994f61c6c5cf4446ad00db39d6fbc9a35e54d6f32fd89e6a1ed77aa83b7b2e7afd0a8e6ec824778dd15dc017b1143146c12862c78b644bc97d13031d65c72991
SSDEEP 24576:uegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wUh9pf1HjnamWzRdaz/zdA+Pol:ungOJOmPOHz69pf1HWzRYz/zq+P
TLSH
T10A55CF2FB7BC15D5E03FC17D8A968916F6B1782613255ACF0160827E5F2BEE42E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 08d3218c12fd10eda432c190b07bda77c65ff5bb50902f4e51584c8fb1e3bff7
MD5 95d17cea71d81328c7f3cd6453663eae
SHA1 ef8a6d27c9360e47cf1ccecbc401477419ea7278
SHA512 d6e5e9c7e5f4d71da35981dab5d2bfbcdf514bfb13cf2b0a65450b36ea4c4ff8e5620ec56a5fd5824ebe95110814d76bf10b5e845ff1f572a9a2c7aa9ba1e9a3
SSDEEP 24576:6LJnJiTk3R3waE4JrOWh9pf1HjnamWzRdaz/zdA+Pol:6LJnJK8R304lR9pf1HWzRYz/zq+P
TLSH
T12A15D02CD2E810E8E4B7C2B4815A1796FF72346C2B2169CB59B4D5313F12FD0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f37eca9f295f3a7e806287bbf7d0a01a47af5963bee91f619a677f7c4975b2f8
MD5 d76d0406d8df391748d9b5f11e93503a
SHA1 427dc1d3dbbbee9cc0e28604354e3896e25444ef
SHA512 57ab21f949c665a6319cb4af7993ce183415415d198f5476d5784f7bd92531a746625e0a476ac608a273089ea6b03665dfff000e6cbf88ec511e9fa214b2ca93
SSDEEP 49152:d9mqCzDScAZmlvTcFg8Ph6k9pf1HWzRYz/zq+P:xF9ptHUkL5P
TLSH
T159955D05F7EA5298F8B3CAF1C96694159B327C409B34F7EF0A80C96A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 e4637585ebad556f9044a8fd5a8c83ea4f28100561710b19b4ab96d56fa3d9a1
MD5 1ef4238e487e1fa5cfc9516b584bc19a
SHA1 19d49ef25eee6d12191efa83d3716902ddf5c9a2
SHA512 64c5d4b64ba59d0969aea1b5aa736de0eea8f880fe6d0acec22cf1a9c85d836d6f4bb4ab44e460d415f8b77ce4d16954ce8cd34d48d62070bb6461743c90220d
SSDEEP 12288:hlYJeXm5nkEUuEkEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:hlYJeXm5jUuEkh9pf1HjnamWzRdaz/zg
TLSH
T1B3E4128DB6CC30F1E16F927D91958648E3A2F065271123EF45E0C1BA8F76EDA1E39E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 fdf59020031a82d74708283a4ebfb040475ff73f4857afd1034131c7194c5d8a
MD5 ed39472f1bde8d60731a846233265a8b
SHA1 98c43341c56e6ab373eae6ce4e0670e689d06ebf
SHA512 024ec0dc88e08ada9e469073ba6e6ffac5d219b640a0f6d866789d4a59eaae2ddad836741bf2908988899ac27cc1be1bfd70acd0000ca33493439a2ad6e45956
SSDEEP 12288:/mu6kyHEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:/7tyHh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T16CF41244B3C864F5F6BB063895628294EE65BC146F2053EF45A1D63E1B32FC8AD35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 98d945bf453ed3786da380cf079083894ed53631d8d74d1ef78c1b8714f87d42
MD5 08e6e1af6819cdcac6d84e6fe8a7f250
SHA1 9bc54b5e7d7f15707d9004690fd769ecd3b47777
SHA512 4a48c15dbb650ef8482a88243b1596ebf5cae92705fca4c32fe9c893c1b39a9c07ae3d83bddfac39d8d86f97077e390f6188bf6b8530882fddf4902d86d09282
SSDEEP 12288:qPUEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:GUh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T139D42388F6CC28F2F17B577C50284299E5C5B8183E2031FF58A6C9B58775C8E8D3AD62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 76a05b7cf879e39d0765aaacf36b8520eedb315edebefda4290c72bbe5ecb1e1
MD5 8430c45ba57b9e4228bac8ca552cc4f2
SHA1 fbd2d223dc16b7b01f99dceb10994fdc8ad68b5a
SHA512 8628410723800bcf2e7872eca49eb57648b1a6783429e4bb103e1a9e8bda5ea9bc4048d0baeeadf991cfe1a06533d995eb7469620998f870a194d6454214e0a2
SSDEEP 24576:qC+TyQIu93VAumZr7jmVh9pf1HjnamWzRdaz/zdA+Pol:q/TfIq+YD9pf1HWzRYz/zq+P
TLSH
T15E558D1DA7E91DCAE276C675C8A34493E633B872137196CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 1e6fe0c338928cc38fc11f188c9ebf36c7a1e60a94e490f2f5d0b635b2488083
MD5 af112fb4f0c8a62a564907da8ce4ed23
SHA1 70171392169694b15382dfc5ba019cc36daba825
SHA512 e2e2958c0feecec6fa614307655cd866fb2121d241e2ad1499632b010a9fcf0538710d53866132bab9c32c165e27e192ebdc093f939e9ae528b163dd4bce84f0
SSDEEP 12288:kcyrWOstaa3kcsQEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:xLQikZQh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T1BBF4F10FB3AE00A6E1ABC23C84454256F6B3B435572263DF06A1C7790B779E9BD38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1296ddbbab511ca88aeea763570bb86c76e89b523039d77844f0b2c7bd9e6c76
MD5 92a2fee57648de35a012558cabda7eb7
SHA1 c4f3cd2d389e94e8ee1f9ae6f52b3c90db3823dc
SHA512 4d72051502dbf5ed31c2003afb07663aa8b4b44903dd6ff3709a3ac2fa3e215e211ed73afcf2aa83e722960279aad133c69cb7f62664b95e607d17831acdbe46
SSDEEP 49152:IpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPB9pf1HWzRy:ZpC7b4+80GTk89ptHUkL5P
TLSH
T1B8A57C3DE2E810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9b0bce853eb5bedbc455e62337d6d4adb4f4cd3be56fc39f2085a99cba0ec7ec
MD5 93e53b3ebd8e45b2c284182ea661e70d
SHA1 f9aa55f978bb7bb94da9f0bf0880408c89af1f90
SHA512 25b29ae02d0fe675cca9d1c4f1ad75ec0990e48aa13d1c57da04a88a522f6f5545c9e1468a869cd63948b74c639d6862b8683201438973ab032438255ce89de0
SSDEEP 24576:DSAwJPE1IDAo+4Kt+l4413JUQvh9pf1HjnamWzRdaz/zdA+Pol:DqPCIo4Kol4vQJ9pf1HWzRYz/zq+P
TLSH
T10655BF1AA7F956F5E17ACBB4D663C601FB727822133163CF4290817E0E169E85E3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 63c920e8b6046ec3a5052182ab82141bb0393c56bfaa4679fde3bc1a2bd93102
MD5 4c4351b174842073c65bbe8188fc2d0b
SHA1 d3ca89ec03f97b4978a9c90653e6811753c5c80d
SHA512 07d3e8cda1d928cbff063a0b632b92638b2238f26fe4857b5ebbcdbbae4e7c232095207a89faab0990c06dc90884cbfcc6476f9c6239cd68611d8d86f1f82c58
SSDEEP 24576:0yLXPLcw94t/h9pf1HjnamWzRdaz/zdA+Pol:0y7PoXtZ9pf1HWzRYz/zq+P
TLSH
T17F25E12EE69C08F5E47AC27CD2638506F67238AD033166CB19A4C5791F6BEE4693DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 39db40250f4fc99473bac3f9cae45db83e349eee393956a7bdcd01cee563c369
MD5 806afe3cd74e9687ad9b0005ed148bdb
SHA1 0042cfd0c706525d63895d1a979db1c73589d9de
SHA512 8c966305efae1531c2e9555cc967b31c69549a0a49b7839e726bc37fd033b8019f91b85482ac4f5271455c55647f2f2b132f73df69e7b5cbbf4a4cfbbd5472dd
SSDEEP 12288:S9lyvj3IkxjbBzAEW9PiU+kBz7Lj7TaKUcnWyUgG/HRdaz/++dA++yxF7k/oy52:SWv8qjpAh9pf1HjnamWzRdaz/zdA+Pol
TLSH
T150F4124DA6C828E5F07B4338D125826990B2BC76277066FF74D5C9BA4B31EC4993EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/344-470-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/344-245-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/344-251-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/344-254-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/452-264-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/452-142-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/452-134-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/452-139-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/584-242-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/584-469-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/584-238-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/860-61-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/860-37-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/860-38-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/860-46-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/860-60-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1248-226-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/1248-468-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1248-230-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1248-220-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/1472-492-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-493-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-495-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-480-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-494-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-485-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-487-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-488-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-489-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-490-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-491-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-479-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-486-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-484-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-478-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-481-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-482-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1472-483-0x00000207D3B50000-0x00000207D3B60000-memory.dmp

Download

memory/1696-268-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1696-262-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1696-474-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1780-180-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1780-186-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1780-190-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1780-453-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1856-214-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1856-215-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1856-204-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1856-210-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1856-218-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1864-56-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1864-52-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1864-175-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1864-49-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1976-131-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1976-244-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2184-161-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2184-155-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2184-322-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2184-165-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2444-467-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/2444-192-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2444-198-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2444-200-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/2468-8-0x0000000002380000-0x00000000023E7000-memory.dmp

Download

memory/2468-64-0x0000000000400000-0x000000000050E000-memory.dmp

Download

memory/2468-1-0x0000000002380000-0x00000000023E7000-memory.dmp

Download

memory/2468-0-0x0000000000400000-0x000000000050E000-memory.dmp

Download

memory/2580-71-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2580-65-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2580-189-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2580-74-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3392-121-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3392-240-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3392-115-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3392-124-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3640-471-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3640-267-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3640-473-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3640-164-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3640-150-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4112-176-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4112-413-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4112-167-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4112-173-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4488-276-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4488-476-0x000000000BE20000-0x000000000BE28000-memory.dmp

Download

memory/4488-475-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4488-270-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4488-283-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/4488-299-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/4488-319-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/4488-278-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4604-18-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4604-112-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4604-12-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4604-19-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4604-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5272-82-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5272-76-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/5272-83-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/5272-91-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5272-89-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/5304-109-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5304-113-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5304-103-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5304-229-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5584-98-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/5584-213-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/5584-88-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/5584-92-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/5900-129-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5900-26-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5900-33-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5900-27-0x0000000000720000-0x0000000000780000-memory.dmp

Download