5e0e041aafe0f261c752376d24a59c223a05039e804b2118faade712415a8074

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
Size 1.4MB
Sample260718-mscvcabz91
SHA256 5e0e041aafe0f261c752376d24a59c223a05039e804b2118faade712415a8074
MD5 a095aac14730037ea52633938b5f465b
SHA1 96c1f320699712d3c4ed084d178dc8bf4a37bbca
SHA512 ab9cebf1c2bed8dda06e5f4fc4f04ba8f40344bf1e045e7d6f82179d7981f26562b898c0a222584cadb04e3294d893e30648887b43c828a38cc3656350c352a6
SSDEEP 24576:tNkodGRYSZoMHAQHp4GyevZ0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+N:0RYPM1Hp4GdvZ0VY3vSi+ttr+Ekw7n2m
TLSH
T1BE65791033498061E0E2E63F0A1BDF7C55A87DDC3637518762C7EA2B2A605D1AF3E66D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4204	elevation_service.exe
5180	maintenanceservice.exe
2560	OSE.EXE
5932	PerceptionSimulationService.exe
2060	perfhost.exe
1596	ReFsDedupSvc.exe
5744	SensorDataService.exe
1008	ssh-agent.exe
4308	AgentService.exe
3904	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1ba8c08ac618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\ConnectWrite.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\ConnectWrite.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d352244aa216dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000221dd14aa216dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ca2aa8ba216dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df31858ba216dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000348b8b4aa216dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017fa7849a216dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072e6664aa216dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004506514ca216dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe
4204	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
Token: SeAssignPrimaryTokenPrivilege	4308	AgentService.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: 33	3904	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3904	SearchIndexer.exe
Token: SeBackupPrivilege	1596	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1596	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
Token: SeDebugPrivilege	2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
Token: SeDebugPrivilege	2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
Token: SeDebugPrivilege	2768	2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
Token: SeDebugPrivilege	4204	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 2988	3904	SearchIndexer.exe	100
PID 3904 wrote to memory of 552	3904	SearchIndexer.exe	101
PID 3904 wrote to memory of 2596	3904	SearchIndexer.exe	102
PID 3904 wrote to memory of 5536	3904	SearchIndexer.exe	103
PID 3904 wrote to memory of 3200	3904	SearchIndexer.exe	105
PID 3904 wrote to memory of 2980	3904	SearchIndexer.exe	106
PID 3904 wrote to memory of 2024	3904	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_a095aac14730037ea52633938b5f465b_elex_hawkeye_luca-stealer_medusalocker_mespinoza_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5180

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2060

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5744

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1008

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5536
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d40c6f11812bee31de7478699cc60b4050416b493fb3af0b22d5f63e26eab409
MD5 1d94ef347bc6637d6b66d0ceeb8cec13
SHA1 067cbf573921116258e3ab4420d4c6fb8549dcd2
SHA512 747fa2da28a630759b8f5ba52e69f0d679f517f22b35e032cddc4a9fa826c52bedf2601d730d5497aa0529497bb452bb546c22b1b14c694a6630f7790af105ce
SSDEEP 49152:yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnu0VY3vSi+ttr+Ekw7n2m:U3q6HjBb0S/Si+ttrsw7n2m
TLSH
T19CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 700659023697ad49c7961bde229303c1d0a1b773b6032bba649005d5985c573e
MD5 835f4cb60718def145daf8d0f76aac37
SHA1 0886be06df6209268278855ae3a7802628e9202a
SHA512 6273929513b7f7a278872ed5c79e8777ea0d1ec3bebc09b214e62dbfdf5e28c5504a51b85713c33fd9703238d5fc27c1460f97999057c3b82243bf89a4d99fa1
SSDEEP 24576:KXYfDtczAf0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+B:Rtco0VY3vSi+ttr+Ekw7n2m
TLSH
T1AE65F22873D508F9EC6B827DC9A28501EA727C558364E7CB03E4A5261F373D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 4487cbf99b437b7aa5511b28e122c6c5b5b2a2e8e9cbadbbbec986b7ef239805
MD5 e5bd3f6c749b72300502256d9df622eb
SHA1 cde234fe51b7b446ff71342806c891cc2e56c691
SHA512 fe2936f705e0ba17777212f6368e34c89da7032aafd77b0353410efe87e34526d2e79e3e64230cfd6d2a1b43d2f37e10d2a02f8afeb97f9c02aac112b3a5a751
SSDEEP 24576:80Le5ji0hmxirMW0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+H:8Pji0Acl0VY3vSi+ttr+Ekw7n2m
TLSH
T1F4859D16F6788731D073C0B9C5D2A68AED71308657308ACB4286D77C7F6BAE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6dc4fe073a277269f819a2af3efd99f24e15c49ba1d7e4f14da47773c275bc27
MD5 1f1bfdbd666d439b58d01195727a2e22
SHA1 2580a4ea8a9d09b269f020239bab1c91e95a4222
SHA512 b10e2b3cfb078237523cb61852c133a3d386ead1c95d12d37889fa9af9ef1500655f46871a6ac3d85b6bec7d0fa7f8514d66328673c3dc55b187ff9b0348a875
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWE6q8wyu40s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+b:8/ezSC6vUzPvxHjyJ0VY3vSi+ttr+EkW
TLSH
T186755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3526c05653b90ccfe42c28b4bec1cce230392fef84eee7b6a4a6494559a24437
MD5 1445a79758e8bef3890e75ad3ce83452
SHA1 c173ac6cd0e997dd4ff0b339bc2b5e9497b2cec8
SHA512 75f0ec2dac9fde6afa98ed9078a8ee59bd8d540f9474fe7b5662eb2631667522f06a48c990f4db7383a64d377b4c0d566be1da845e0bf27e305c575d827a5087
SSDEEP 24576:lVbqPb88hv/l+6r0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+q:lVO88hXl+q0VY3vSi+ttr+Ekw7n2m
TLSH
T130559E65F6748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ee0f499e6de77453cf6871a9befb3ccbec7ac5db59727f51f9b0a50658857ccc
MD5 dfbc1e0590565006f67297846b31a644
SHA1 cc96b7a02b5456b824d433f33120eb88e3aaa99a
SHA512 6469977241fac094b9e7618dbaa965788515213bb671b34014e7d423843551df1c2b854c814755a9ee805118c3b341370878eb48e6132c27c1c1db551e2833ac
SSDEEP 24576:uRi0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+R:x0VY3vSi+ttr+Ekw7n2m
TLSH
T189452304E3CF5825E8AF9B3623FB95C6D8B8ADB9D0BD81407458711B7B3C1E4D4522BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 06d7e97d3f2ddf53bdca41fd935e64704cebd66ea961aaa09bb2aa7d1142abf5
MD5 61122ed6b66de6e3ad8f47e1ed32ea74
SHA1 b668dfb6c0557c44297de065e4ce58ef69a9043f
SHA512 8a993197d1446a49b8643039a08973c1db9f3758947c68180790232c99bc011849f6f49eec024f2f6a79f3efa869688d08ca1a0ad55e9480a403909d099632ae
SSDEEP 24576:XJIUz0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+K:XJIUz0VY3vSi+ttr+Ekw7n2m
TLSH
T11D65CF3BEE28FCE2C27E8D7957918240D77278708B6293CBD165820EDE275E05E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d959ebf4d5c87c0e3d7a6fcfd8a94debdf7562c8ae47e17f67878549d871260a
MD5 abff14c1396cd24eca994bddb0dc0b0a
SHA1 8f74645f3e1a9d54512382cab409e5dda7b3fdd1
SHA512 6eaaad3cb1ae81fff535f0622bb4aa191cbb59dfb0e842b42cede7620b76558ded0ec551f7a83588ae161e1fc3d30d76646a71c6031caa072b3c520b04ac07ec
SSDEEP 98304:fQvGAdlCEL8c/yRNw5CI0S/Si+ttrsw7n2m:YvyEYc/y3w8INaxt7n
TLSH
T17E266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 48abe6f49df6b8dc44e4420afcf0bb8fde0d71559c10d0b79f7b6af4d5ce2681
MD5 2804ae5bd8f8c9198563f1d63fdd7da4
SHA1 a0e2d6e8bd7f8dce9412611530b3488c7a6a079c
SHA512 598187aa557663fa09519cf3a550b8c49b77cde1c4d806ccb7ae37089926c7640e4b977598c231e4653cdaa88e2b7b3e909798f45e8e6d8eae299c2fe4612961
SSDEEP 24576:LdewsAj10s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+d:Zlj10VY3vSi+ttr+Ekw7n2m
TLSH
T18675E030FB75E436C67F0DB21B36C706587CB9208B6519C3E3E8999E59342D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 52daa8600f8b0bbee25d234380e571200fbcaab65e03e531602a79e2a7b78b1f
MD5 a79678ff09f2af54764613cdf65cb5da
SHA1 06128a5ac2e2c95f84d9faad6b26c177e3315e91
SHA512 0cfe2068506e83b51726b8e437ab6a3e31254b7d664849ae085c3ec18b9eba87f5616cbd7f170538a208298e34d72e92cad638572dbbcea67e6295d13e56db18
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHtNaxt7n:lUEtQevvqc2W1cpV2EI32/aT7n
TLSH
T117474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cda2bbce42068745f2dce8f14268edaed6ca08391acc6d17f69bb64da572d7a3
MD5 4d89ceeae200029c1e286e52f1399b1f
SHA1 565afb0b3de3f2488061372c4f58a55dda8ac5e0
SHA512 53087dabe4353f2791d83d9e200606e828179a6efac6e4d91270b98dfec17a772a549db247825ccb3101898eaed010a7c18dfd599cd32e9b751ef38db5e59630
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zV0VY3vSi+ttr+Ekw7n2m:LoqtVjnm80S/Si+ttrsw7n2m
TLSH
T1E0D58D0976B8C1E4D1F6C77886A2C647F37178158B3497EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fad985621bcc4f1ef03630326b272e3e0ca1c7efb9ef855d36c741cb0be50e90
MD5 cdf0d4d6de3ca809e794a7791af7ae2e
SHA1 70df08c8fad0100e209decba65bc8fb1971e7193
SHA512 df54c7b729678a82833e7ce9d7dcdf876bf8cafe5ae102e0cc15f76d4e37035bdfa936a699342bece0b5a8600bdae2ba767dbcb089e2bae30392a86d622066ec
SSDEEP 24576:uAhGLJIFoiwtA5l7S53c0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+W:uAMyFoiq5M0VY3vSi+ttr+Ekw7n2m
TLSH
T1CD35AD80E7F945D4F5B3AB7899B68171EA76BCAA5E31C20F2150D11F1E33A909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 50a238f7fb504c4fea8ded8efb6241bcadee7a73163acb0f185400c874faa3e4
MD5 d83f0767e75c5e98679cf19840010a4e
SHA1 8f133e48cc903be9f7a2f43343b6d2ce05d88078
SHA512 c36fabc3e5d861a481e23b79cf8fc4c47b6c9a01ce1856b22094396155d1df0c398f93238f39fc83ebde6c333ee91fb274da0d5208336a77d77c080ca81a1c23
SSDEEP 24576:QwuoOWp0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+9:QwDOg0VY3vSi+ttr+Ekw7n2m
TLSH
T1D265F14573E90CF9E96B82398697C136F7F2BC122625C71F1760C61B6F37261AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 906afb2b5447f7ed37a66a95b9f68fe73bd2341fedfed461a8dc707fa31e0701
MD5 a9a8392a8fbbb9ff051d47bcea75f8d7
SHA1 d5839d28b79c6eda0ce482b20e150ec73513e34d
SHA512 39bdf73cdeef6dc3c63e80b9ffb80bdc83b66ca48d7cf2ea6255953d8a664eeaf8e13688583e691179318e8dfd859c3f722e28422b73a17b9a6bd7cf75960332
SSDEEP 24576:mZu+0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+D:C0VY3vSi+ttr+Ekw7n2m
TLSH
T1B855120933DD20F9D4AB833D86F24646D7B17866A37A43CF2164626A3F36AD15D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a0aa982964803a5065cd9d54eecc2e073ea793f56fc3f1982364f04787dc958f
MD5 f59bda8af3fab0e63fc9c8144725592d
SHA1 b700d1ba3c2121c88eb2266f44057f6ca021ab01
SHA512 46dffe1b6970b78c5cf0a64a46051f4f9fb770edca5d4de46ba48f062488b4e93c2a4b59b659e4f4f24177c8999c39a85a48180a6592ff7f8a4ddaf9bb326501
SSDEEP 98304:JQRQyi36YOcPQLvw2gAf+PN3H0S/Si+ttrsw7n2m:gQyiKayX+PN3Naxt7n
TLSH
T168667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9961c637911c6b8fb6c469dbef9ee1a86f0af677af8a2f4dea92cdb8ba8427a4
MD5 6a5e5af00c279f4214d3b2550e355669
SHA1 c24982c187818adad21523cfd293366137cd53a2
SHA512 82ec716fa951b41280fd78b0785ab12699de652ecb07d9b8ba1c0a0b19b8b1cd0344a86e159ade85790a7dd31447687ddc8465ec2e48e47279b30ae98cde899a
SSDEEP 98304:TQRQyi36YOcPQLvw2gAf+PN3H0S/Si+ttrsw7n2m:CQyiKayX+PN3Naxt7n
TLSH
T1FC667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7f003ad40d333ef9b1d578c6b14fbcf0cf88edd0049f7859c684f64cc452ea71
MD5 85457c813a2e0af20bbf10cd6b7db6dc
SHA1 ace21c3dcfa5ce6c3611ed6bf194f85302998374
SHA512 57e0edf081d3695e18825020c061a5246190952e66802c1784a89598c6c92f69f8ededf48d70160cf97b3f29d3ae2bbbdfe5ac3b031a356c57a68c2bc6b4d02e
SSDEEP 49152:j68Qg55nhheWu7PNU3/l0VY3vSi+ttr+Ekw7n2m:dthWRc/l0S/Si+ttrsw7n2m
TLSH
T181B55933B2F600A9C44DE1769F4A872196D17C75CFE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 36853753419cb755203342ba20ebb9946b476c5a6a704956f7b9c5736d0eaec0
MD5 58fe2118a5695c2f30bbde2be9d188a4
SHA1 83e09776cb383181cab8533ba2991b4a00f31e67
SHA512 5283f774985d6968b09b2bfec6637f509e2ebe54729a5d5e3b4041f756f86b77378540b53f32e79313262fc0f0c41a318525481d25806e64a5afcdd6c2218987
SSDEEP 98304:Ry5112gYy5azzVvL69nLKnhZi0S/Si+ttrsw7n2m:sLIHmWh0Naxt7n
TLSH
T162167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d12a8576e716b4f0a1f404bd8cae641c769bc3404794068d183e227ad6258a77
MD5 9a236a1a7df9bde9c24677cee1f40c6f
SHA1 52bcc5e76dad460b385545a5f902041a7fa0ec9d
SHA512 48ec186b36eeb4cf4b661950cb8df639db93ec2818920c289f634c3e78f759967577f0b2208555db3694e0f630a659ecf0769d2a03f3b9d243599a5a9fcc0354
SSDEEP 49152:H1hpsNoJpF1A6UU44CwH7R4xT0VY3vSi+ttr+Ekw7n2m:HmifPbR80S/Si+ttrsw7n2m
TLSH
T11BB5AE13F2D900E8D06ED17887569232EA61BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c041f0980916c840a2ab8e06beaf08ccba67c46662b24743c1e9d544554859e2
MD5 7af8f7fb1db18d9ba606dacb83ccb124
SHA1 aeb7f931c651f32945deafcb2d3c1de86dfb47b6
SHA512 daf77420d2c6bac27bb95497fdb67af17ceec82ddd7144c5e9940b7574b1b177288510eab2ab8cea5506ddaf9f3e9923a19b7e301da1618ef860acbfb976bdd5
SSDEEP 49152:cSuZQIY0Be2KRRVtOnks6NMHq+0VY3vSi+ttr+Ekw7n2m:e5dKTi61+0S/Si+ttrsw7n2m
TLSH
T145C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5631c2fc6e49e433a9541e742978189f9dae91c5421a9579d8964a9b4216d221
MD5 4e7d971f5180d234694cd3cf9be57426
SHA1 a46e02d8786d9eaf63d3dadfbdd4093854785b43
SHA512 faefe3cfdbe27c81732c1028fcb08219683d867d649061df7e1e7668e55bb8fb2dec754d0fa3df9085fa6b81f98b59bd34b017e7ff7a858fa4047064e32b681a
SSDEEP 49152:HhtSn8EApI0figngiDn0AP5wf0VY3vSi+ttr+Ekw7n2m:WX2iyphA0S/Si+ttrsw7n2m
TLSH
T16395BE13F2D900E8D05ED178C7568632E962BC160B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f574d00c6b7fa248c4cf7dc92fa1ced66022daf8895957c686ac7610d8e087ff
MD5 0703d34e3fea339fc65abaaeec10bf65
SHA1 349fd051bd82ca0cce94d1c685ae55603b256514
SHA512 dcb05be4847ace7ff5fbbad543c195d86a4d0594b7e47569f33fce35c3ee03b0d46ad1140dcb96444d9a332ee74448a956dd67826cf295b06c301a4ce429b1dc
SSDEEP 24576:Hq0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+X:K0VY3vSi+ttr+Ekw7n2m
TLSH
T190452304F7CF882AD85F9B7613E792C6D8ACADAEE0BE4141745D70177B3C2E464522B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7b7bd07cb7e86804eafbb3d2cff160ec7f615f0abddbca2a9d1612b2c20302ed
MD5 6d53a7f103d5908276f9675de9a534ed
SHA1 44c42e99ae9f12a4b7b7897613988dab83fc181c
SHA512 1d2fa00608e3a5a9b863f6ae8113cef1d58fc616192606aaa2b132fc4ee1f2fbf1a6ad032e91987990ecf8115259756f9f7bf95f351db70efc14f68f460a5259
SSDEEP 24576:XB0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+X:x0VY3vSi+ttr+Ekw7n2m
TLSH
T10A452304F7CF482AD85F9B7613E792C6D8ACADAEE0BE4141745DB0177B3C2E464122B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 456b6a07862b513f92a807a5e3a66aef6f8956ca73adc9b3d9d3a5371d2747f4
MD5 7cdd5bffd2b94099933736e6a10170c6
SHA1 cef95d5a464dfa87781e112d89e3b61a22b3e7a5
SHA512 551af207338831302d24866d77cda8b39e83f98150fb5d3fca87f23cb212eeee04ce03cd1ad407ef1d3dd4ac9e76546fd62d20985f2f1820e9d12ca451fef2b4
SSDEEP 24576:8b0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+4:M0VY3vSi+ttr+Ekw7n2m
TLSH
T16E452304F7CF482AD85F9B7613E792C6D8ACADAEE0AE4141745D70177B3C2E864521B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 57486e566868c9d2039a0c76c29ffa86434c7acb05abf1881d389d1fcfabce04
MD5 c3fbfe96d14b8d5c6728ec042c7a13b2
SHA1 0d04d483bc89851b7bde4bb20ba4fdba2536e18a
SHA512 0a230e5d247f249f0dee2bcc41422f5e280a16dafa274634ec79f3c55d779b7583f8a1fdaf47c17dc9f36d4d09f0935caf5a091e995ef100624bcf646e46e65c
SSDEEP 24576:K0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+C:K0VY3vSi+ttr+Ekw7n2m
TLSH
T148452305B7CF44A5D86FD77983B79186E5B8BCA9E23A428B6504301B3F383E468317B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 77dc9b28f7c6fc0ea2f7aacb7e6937853543e2aad4ab9ff16061eb3e29f367e4
MD5 6f6f9d862c6ec08138c05340e9ad70f5
SHA1 daf3aba76c6ad3e1c01b01440ffc3c352189114e
SHA512 5fb46e5c53cd160be579177a9fa9e62d1e0297eac2989cda20258d08d1ee36f123f6dc9a33c2f1a6b63b8d3174c878282e04b25991fa66c4fdaa7fd0596bf429
SSDEEP 24576:YU0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+r:h0VY3vSi+ttr+Ekw7n2m
TLSH
T138452304F7CF882AD85F9B7613E792C6D8ACADAEE0BE4141745D70177B3C2E465121B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5938660b6d07ef9062904cb1068058a9c7dd1cd90f433afde3d6daf7617a9e83
MD5 b05829049b95403810fa00ad49ec81a1
SHA1 bebd7d12258eb23e9f47715c77d0a98a7d7a21a5
SHA512 e2cca27bc9b2a32172ffddb2c0fa7cd4014122e49f2df49b2db28a8e7ebb17bb44efcaf8c344f26281063bc7d7939da2bf1152efb7e8f656a23ec97110fde210
SSDEEP 24576:D90s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+b:R0VY3vSi+ttr+Ekw7n2m
TLSH
T1DB452304F7CF482AD86F9B7613E792CAD8ACADAEE0BE4141745DB017773C2E464121B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4c32ca164a7dffd40a387e9ddada010e2648372aaa07dd33d3dd7af6b4c2ed70
MD5 9e239516afedfd0161eccad97d706f95
SHA1 ca1b8fee1663e85cce580f85a41c2d064482f9b5
SHA512 3f83b0be393a85479e40440f510cd31eb8290ee4dead41f4643c14c1e5582558abbcfda204150f68f96f61ec2979a2fa93b5674626f18d854178274f8adc4008
SSDEEP 24576:OZ0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+r:Q0VY3vSi+ttr+Ekw7n2m
TLSH
T163452304F7CF482AD86F8B7613E792CAD8ACADAEE0BE4141745DB017773C2E464121B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 498cfc43ebec4270c264da39b18b4593284333fcb64fa0ccdc8b5d990280a56c
MD5 743d00ea8f450ad4895321340582d1cd
SHA1 98624005cec9db2444906c1cb7639309a6f4aef2
SHA512 dbd8480179f1c8aabe93b70113ef5f7fdb4113b9e19d8b6395c9a224ecb231007a08cecfbc1749ca75e6a75c585c6f89792723ae9f8dfb1fc57f7421af312087
SSDEEP 24576:3ZMSzFVSOh0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+f:3ZMSzfN0VY3vSi+ttr+Ekw7n2m
TLSH
T13E650254B3951CF8EC67823EC9668946D5B17C6A4770C21F13A832276F373A11C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 43112605decc3e59714ce39fe49b30dbce67ab04d39bffc669637e2b63d35600
MD5 e005554d888b3594d864aaa10d03dfec
SHA1 96e94883fafd9167696fbac93437e0e50b37c5be
SHA512 809ed986d9a6575fba3485229031fd0a483d932633e33065aa4b60ca7580ad4c08ad55b1ea0f5d90044977a4885d65de4b37a71e2aaeeccb1f5e995be34a0cc9
SSDEEP 24576:tO0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+f:U0VY3vSi+ttr+Ekw7n2m
TLSH
T1E4452304F7CF482AD85F9B7613E792C6D8ACADAEE0BE4181745D701B7B3C2E465121B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 de3e3418d3b62d41b074749880122db64a79ab6b9107855d3ffa4f2637b98289
MD5 6aac3c2ca70ac7e8593225cfa66dd234
SHA1 9d0752368cffe76c43e7dba1dffd5eefbd441da7
SHA512 adcd80b5c0fdd5e1ba361721ee770364b2c65fa7d49b499d7ca5687c4598ae9bfd4cc187f9ef735ede0fcbc3a490bb79ea76f62c47672007d20c3f7d4379937d
SSDEEP 24576:3y0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+E:i0VY3vSi+ttr+Ekw7n2m
TLSH
T1B3452304F7CF482AD82F9B7613E792CAD8ACADAEE0BE4141745D7017773C2E464521B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 56f8bbe4bd0566382bd139b46aa00048ba9e20d16e1fff82da5f623e19622664
MD5 c162d7f20fa4cdf953bb8301cff39a51
SHA1 662c3231003872d4c4a828e77f16f1099d60f481
SHA512 5919e5596c2afa4bd6025ecb0b4741a38fdcafd44f255cf52a744ba41c2758d013a9ae29d5592ebb973980d032f7266da67a12013d58c5b3beac4f70a88f05c9
SSDEEP 24576:JzyF0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+W:JA0VY3vSi+ttr+Ekw7n2m
TLSH
T1A4550207739A20F9D47B833985A31A42F775B8768734869F226422773F362E09D3A770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f2b594fcfc9ea5f65f40e48b7291f8e4e45677909100ef6cf1082b47036bb5fd
MD5 94a28acc92655e95c0be35b3bfaf5490
SHA1 f6aabbbae14a6f275a406619011cafc0e94f32fc
SHA512 215d519cd075cc3aa83f4ab64c82ef664f8889148a1b78da41bc3682daedd6040aaf883200032b2f650063a2531d4427785613752af085d2200e6b3694681374
SSDEEP 24576:3O0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+y:e0VY3vSi+ttr+Ekw7n2m
TLSH
T124452304F7CF482AD86F9B7613E792C6D8ACADAEE0BE4181745D701B7B3C2E454121B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0ef9e6418f91fc0170c92025940c7c02868a0b915b388f40c3da292feb9a6c17
MD5 cb6488ad4ccf07c79e60ef905e2e064f
SHA1 1275bb49427ccabdb3f83e41338996ad9b888ff1
SHA512 030ad92136c68baf6600ac579aff378ac1bb73edcab05483f865a1e3b552127f01e72412182e72197a63e0e0430b4da88acd4422daf85fc2f40532cc5c0ffb69
SSDEEP 24576:2O0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+8:d0VY3vSi+ttr+Ekw7n2m
TLSH
T1C1452304F7CF482AD86F9B7613E792CAD8ACADAEE0BE4141745D701B7B3C2E455121B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 84d808e7ac444ccfa03e7f6f9c640ff59651eb359db254a35a403e716d576d21
MD5 064acbd67769f86de321f4738702875c
SHA1 ea30e85ca0b5392705455c07f9ed14dc98917574
SHA512 328fb4dd7b6a1e2dd3a475ddd079cda8c664125787e51856e9b150b018ec23631b59a75ed50637321057f94366946f6133ea1ffee70a62117a13b19f8a76bac8
SSDEEP 24576:yzyF0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+p:yA0VY3vSi+ttr+Ekw7n2m
TLSH
T1E8550207739A20F9D47B833985A31A42F775B8768734869F226462773F362E09D3A770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 0554405f4517e5eaa8d0715dd038c9982764be36830b895eee3890a8f303ec48
MD5 e5fccdbe3f5b22dc901323968d24c13f
SHA1 af2d771eb746292fd241e63719da0d8b65ca4e1c
SHA512 f4aa902f8b5014bdaff6b59726b6233ac372557f80acd569ad40f94396764273105a37cfc9ea655df50972a94856a393a2d3166f0b07b2386c4d67a5d69ce961
SSDEEP 24576:KTHaLl3z0zDL0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+F:KT6Llj40VY3vSi+ttr+Ekw7n2m
TLSH
T1BC650254B3951CF8DC67823EC9668946D5B27C6A4774C21F13A832276F373A01C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 7e126f04bdd363208de15271b3e64255daeb17c576146387c665401aae3feb01
MD5 15b3fc720ebd2445575a90519437a6c9
SHA1 e5a24ced215fcd6bd2e4447e99c1ec78039eb034
SHA512 3af8a7cbd1b3ca20dbd6a10a5d88deee7aed0becf31db3a455b8dc5576cc3409f30e0acf99f2f077b411e81b1654b85c0d62f7ce40713768683a3ab5551abffa
SSDEEP 24576:x37d9CHKy7GZn0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+i:h7d9CHKyaN0VY3vSi+ttr+Ekw7n2m
TLSH
T16E75CF90F3E814E8F0B7DA3589765502DAB67C5A5B31CA8F13A8251A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 af7486a2a80f9bdbecd4b6489daab90b423ed3da26bd94ce13f190dfdf7a9250
MD5 3fbbc96c3e396e1862343cd160825880
SHA1 a2e080849cc8e7d2116affd9eb65849daee90a25
SHA512 138ec13e9a7ab69949e8c004b610a21f7f4c062390edae11e72c587d680eebdcaf73dd1242d9e0dcc148d29b4d77d09d1acbc3ed2a67757977c5d5310bc95a01
SSDEEP 24576:w70s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+z:o0VY3vSi+ttr+Ekw7n2m
TLSH
T11C452304F7CF482AD85F9B7623E792C6D8ACADAEE0BE4141745D70177B3C2E464522B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c4a7e1e6af9edc0553a0e1e056c0c3ebec6007a0b971fa95a3e3f07cd12d6bd6
MD5 6f9f39795bccdb161ea1fafdbf7141b7
SHA1 08d2e3cb2387f94f1916f60b607703ba70458aec
SHA512 2f49915f058be04db7051f58158c4e11c5829f8915fb03bf0983b501718dca6747873a3401ce529e57b6a1f843dc14f7070ca4ff26e8202be218d4c079d6c817
SSDEEP 24576:El0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+k:G0VY3vSi+ttr+Ekw7n2m
TLSH
T142452304F7CF482AE86F9B7623E792C6D8ACADAEE0BE4141745D70177B3C2E454121B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3a867e901e4ab9fbdb15490d77c5aa297d25824f1d8c832de3e0e4837ef77974
MD5 451d2cbafb10e4e63d3795d0290eac8f
SHA1 8df276bd3bcfe0af0c242f428c35e46b0219c874
SHA512 fb09f0c5c6e6df34ad88912dea4ed3691da87d85130f88e1428658648940e2f0140022398642504572f069b5a7cae7f04c181384e03c462cae468f43e86e3b7f
SSDEEP 24576:CQ0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+H:n0VY3vSi+ttr+Ekw7n2m
TLSH
T10C452304F7CF482AD85F9B7613E792C6D8ACADAEE0BE4141745D701B7B3C2E864121B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 cb7f7de480ce2bd193ad96011e0995a8cb9001ab9a6e368ed5c15a82c992bed3
MD5 c26b0bfaa7521512d3ead356c9f026ad
SHA1 808c5d30bed8e0778014a6f859b4255eb642d425
SHA512 5edb08c6b9ea3ebbe7b72771f5ea473603b7077d70ae33c62388734d39b61672b2302809d20c97b5f9374af12188c87059642f7672dceb5d920cb7906a1f6d5d
SSDEEP 24576:VO0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+2:80VY3vSi+ttr+Ekw7n2m
TLSH
T137452304F7CF482AD85F9B7613E792C6D8ACADAEE0BE4181745D701B7B3C2E854121B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6f0c4c5f24a7b3bd3ab334e1d92349dd69e4336c123b95b98b5c809c2f7529d1
MD5 a807c591064e2ae69963368ab3864704
SHA1 eadb6027d604831414d638842a0282161743621c
SHA512 f59f38eb364abd5f6df0d9ffb13ad9617a36e7d68634a028033f222169f11516295d5c79a9502325803b994eaf1e3767e4c63e84bc0e724246f2c366cd841b52
SSDEEP 24576:Q70s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+h:I0VY3vSi+ttr+Ekw7n2m
TLSH
T14A452304F7CF482AD85F9B7613E792C6D8ACADAEE0BE4145745D701B7B3C2E464122B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 3b2b639b4e559771dd8490cfab8592651b8d0eea399d360fe8249ac79d4af657
MD5 b09bd4eaa7f29c9849dab54588693af1
SHA1 c18dad3d9bbabb6d2a3405ff0ef224126168709f
SHA512 0bf70adcdedad59cd78f2f4c07c45b1913a1cbafb4f9497d9c5aac223023f2cb0715306485320b38ce7bea565f687f03e11776bb852158b82f9926341698aa2f
SSDEEP 24576:1G0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+B:k0VY3vSi+ttr+Ekw7n2m
TLSH
T199452304F7CF482AD85F9B7623E792C6D8ACADAEE0BE4141745D701B7B3C2E854121B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c3ea62ceba215b52cf4e628853ae5dfcc27b7220403d9501d3e9df2f04353c28
MD5 a7c2ced97b03a32a76cd96728d351840
SHA1 f330eee0ee122452e38898bc54cbb93ab459cc7c
SHA512 b6e8c93ec222d8052728f29a8ea2777a77ebff8ebcfb4e35e8a47aacdd50ac4afd1d8c254b64d3157912a0f0924b44aa33b8228cc8ebc92f826c02065356f462
SSDEEP 24576:jU0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+n:A0VY3vSi+ttr+Ekw7n2m
TLSH
T134452304F7CF482AD85F9B7613E792C6D8ACADAEE0BE4141745D701B7B3C2E464521B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 231ba96a929ae227bd5662a96d488ad4d07c4cbc46ca7d9b8b9581aafbec4bdc
MD5 bf10cda46b76d041e5ff02440759a9b0
SHA1 127b543f3b8ccf45879ddd33ce845a13f4afa548
SHA512 f260fcd14a849f7c79ceee5c0f5aac129fa3f54323f5d9e15583caf1b8f6da644de8c2dc3e003abd5c2b0bba4be1bb93ba12850f7512c8ef4cfe8cd4b28f7ce4
SSDEEP 24576:hD0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+Z:h0VY3vSi+ttr+Ekw7n2m
TLSH
T11E452304F7CF482AD86F9B7623E792C6D8BCADAEE0AE4141745D701B7B3C2E454121B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 2b3dc71dbe2cfe269f06eb44477bd08ea0c4a98ab346ccbba9e1ba8d61c03b1c
MD5 e0ff558fbd4008d0565c7cfd584dec64
SHA1 ac5b3b94aae24525ec76d29d18b9de656155b7fc
SHA512 8f215d99a443668ac8bcffec42877a66e8e6d0544bd0fe5e7aaa401898483b5c56b04cf2934319fd78154fd748401e767c95d8c6a35f93e4e77045147cbf34ff
SSDEEP 24576:Ofwvok9RX6wkyAIC0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+w:SMnYIC0VY3vSi+ttr+Ekw7n2m
TLSH
T12E85D029EBCC44E5E077923C89B3460AF6B178695B31C2CF129A536E1E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e6b2b8682bef9cf63f96be0ca9e63bf113ed15754f977b3687ae3a788dc2de3c
MD5 be51d08386e59c0ae35b75aa64c8d6a6
SHA1 8d4bb4a316266b2ababaf4157bed92640616edf1
SHA512 65b9363f689e82f955e501337f8fad7aa370a003199dc5bd9884693a33374ac68806535178a8226a49eecae3c3f7e6612cdc2407e0c52f83b2ece3ff599fba26
SSDEEP 49152:LYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/0VY3vSi+ttrv:vySzPn0S/Si+ttrsw7n2m
TLSH
T1E9066C56A1AC01D5C1BDC1B98B1BCC1BFAB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cdd312c6fcc00a99faf5409ce853334aa75f61fb59754e370adcafae5bcb69d6
MD5 58bc23706bf310528c8df40bab8bb84f
SHA1 5476278f37b25904b5f956b30089f98dea97acf1
SHA512 ec7aed968f03bc17990f5404deba5162016a79ee37e55f1221cb6c11f23a8d89fc8fbcf2ac07fdd650fa03ade97dc2e74eca0d7e18dca8a7e9b7e8ea5c81f939
SSDEEP 24576:V47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYx0s8YsWb4KSi+ttr+EkZDOs0tvbbU4:V47JUQj1irIhCnDHUPfF/P0VY3vSi+t9
TLSH
T1F765AE1DA3EC01E5E1BAC27885154A5AEA71782E5B31C6CF2270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f07f959cca494d69fa722d65b707c17e04d2887261c47f9de771dce3e6bc9966
MD5 04a0481cb017affc3692eed858dbbc08
SHA1 4d05e87b7c8783f530bfc567c62b637960e914a7
SHA512 4407e5fb3d1476ccebeef879db6553934e70109953c33868f1827ef7a355bf8abdab46e73c13b332232ade4308916c546635a37ab4afce1b3347922b43477e3f
SSDEEP 24576:c+0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+P:r0VY3vSi+ttr+Ekw7n2m
TLSH
T15555F009E28901E8C06EA279C7968681F7377C6593E5C3CB62D0F43E2F396909DE6753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 956KB
SHA256 0ee0808dab529b7ad203b95f0f3fa40487027410cf25ed88d9beceb223aa1c07
MD5 6dc18b9c7e82577da546f4fc3b8628cd
SHA1 284419ddb74d169a4743fe6615fb6c20c8d57d1b
SHA512 c7cf422667ac2202af3ffa5e5fe002cfa25882f5ad20ce53ac2f3e2f3382dbbe87f0a77aa58fb96827ab056891461f840735005b31dc4afedb53ffea5ad80975
SSDEEP 12288:Xp7zfU3fcg80BmcozI9MDx/Vsk8jglvlMbm0fqO2AXok:Xp7LUPw0BmcozI9WTs1gYbNfqgYk
TLSH
T133251751766BCB5FC6A944321E32C2CCA7707D01FE05AB0372C9472FD576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 fd1418a730e9a31086175ed4a56f826e478d5e70d5423856ad863f3b3224e248
MD5 b5f80249f0508c74111d5d5cc4f5f077
SHA1 cfe0f5ed02f7736505121a3ef277341ad54e3e7b
SHA512 783cb46317765b3c5640fa105c84531b47b1be2d25167e8795331b9fa540d13e02d74d93a6d9f09e52588cf83bab9d5077e1dd4e1d8017f249eeb986f93d8aa3
SSDEEP 24576:nWcpWBmcozI9MUBmcozI9jzI9DYBmcPzI9XwBmcTzI90BmcsBmcozI9FBmcozI9V:mBmcozI9pBmcozI9jzI9sBmcPzI9gBmL
TLSH
T16D65C6816537A38BD1FB2172072A9B4DA7A4EC0773055F6673C8493AD81BB65B0B83C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e76f7873ce131fb594c93ec0b0ef59e5029eaffdab4d916b60c1140a5bbe68fe
MD5 616edcaf88ef961d0fa8bd301998661d
SHA1 89f3e8872cb8f463277590589172c82059407d4f
SHA512 18ef69bef0d7a7e68233e293ed81e28a0c12a14345bd7f8bff0608419d900b1ce3cf7901264959e9f0dea991be25a97d75db0dbe7bd4f3f9a9e7ff6164191a76
SSDEEP 24576:d20s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+e:d20VY3vSi+ttr+Ekw7n2m
TLSH
T12E452301A3CF4C25E87F9B7513AB8185E86CBDB9D76881C3B408711B773C6E49D7226A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4897ac8d1619fa59b2ab7f84cd0f25720405d0c27a49889e66e748403657e7fb
MD5 de3848ee5a45846c1a3c487d21050431
SHA1 12285fb15fa0acd719bef40fb7bc552c3e4cdb85
SHA512 2af8bef8319b388d88aee4eb13114c7a9ebf0d5fe9e840b1f62fb13104c4a10904900d2ad23401a92b57e22dbd5cede1165f0251ae77f8758e5441a7b3e316b8
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bY40s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+y:Vgb4mBIBhGFx0VY3vSi+ttr+Ekw7n2m
TLSH
T1AB65AE1E22EC02F5E0FAD3B89DAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 7f84106f1a9838084bc6e4a4f38e22fcc92198ed172177eaa56dcc199d339e46
MD5 1f8c39e0f526f226c3d19177362066b4
SHA1 eab155965c7de405b5eb37a22ba5db466ef66023
SHA512 eaca71ba0bfcaaaf7eb715106fb56a60487d72c66dace34120e8b4d52b048b390cb3bf88d9bc98c4eccb3a6b9e57729cfc0273fe7c387b9eeccdc53875090832
SSDEEP 24576:YG88u8FpJqH1bzria7/mh0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+N:b7ZFPqVea7/w0VY3vSi+ttr+Ekw7n2m
TLSH
T11D85F12577E501F0D47BD1388A874653F6B1B8250364EBDF06AC8A562F33AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 340e653d3654caa29a99cbdcec9aad4017e5169993e216c4c6350f3a4f3dc00b
MD5 8fd005f53f6ffc0627536ecb42797a8f
SHA1 093269194c79e2fe476db9698fac1dbce9f548d9
SHA512 c42b219eb8c801875a562397f6edb1608fc38e9aa33edf133e3baad0b56bdd6c1ece4f60d7c9108ee988130bcbe6a271e8e68e33ed50a39041ee42dcb4a6ab57
SSDEEP 24576:WPUr+NQN0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+G:WJQN0VY3vSi+ttr+Ekw7n2m
TLSH
T1B265E11E62DD1CE5E57AE17D86828709F771B862531292CF01D0917E5F37AE8BC3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 82620db5ece20ba1c1ba20e755e27f186c8df2017549b9fd175ac93cf9fd078a
MD5 46d15de121d44774cf71d6d1700cf167
SHA1 32620db0093922715285550a18c3b49e29a0dcd5
SHA512 9e7b793409380611e1d30362fe4eff170c9b3148f1cfada3a4993921be69d7e52ba5c8cb64a17e5ecd8c9d2b5a597fcd2e463036bad78357a7eecc84155b8e2e
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj90VY3vSi+ttr+EkwN:oG05lO43b60S/Si+ttrsw7n2m
TLSH
T1A7D5CF6E62EC11F9D0BBD17CDAC6460BEBB23825033556CB02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ca6f2251c4b85d3bf944399b9f052f81ab5c77f6eb078bd86edf670c5b0c2f4f
MD5 29bdd63b966aa5a4104b259dd00dbfb1
SHA1 3a2e6d804c2e1519d0fdea222cba8ec794c5ed45
SHA512 bb8d144f3f77c3980a4417f8c11fb6d565dc6cdb98f9f14c815f64660eb0c31590dc305d0b9b4bc10205d857add69de913959d2f21abc48f5fb8bed0db15aadc
SSDEEP 24576:1fa5POZ3dpFWVM50JicR2hG0lasx2+47eidn/0s8YsWb4KSi+ttr+EkZDOs0tvb2:Va5POZ3+Jt2pasx2+ml0VY3vSi+ttr+I
TLSH
T15665AF5EA7FC00D5D579D17DC683860AE5B1342653329BCB112182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 49c6eca7c2d78636cb10622437bbbbb44a08db2946a396c90855a8394b5f457d
MD5 9673c8349115fb09b48f0e0685124f17
SHA1 fc3ccacbdb7ad7cf297e922a7c5bd30c2ab8bc9d
SHA512 26f3dabf5b256ca2075ff963252cb20cc7d63bd9561f27e449557bbce709ebcde6faaea508d73c32ce72f5d86143ef5c23a707aaf4577b5a14b270865b0b06dc
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkJ0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/++:fNc/zEOVHFQ0VY3vSi+ttr+Ekw7n2m
TLSH
T1F8858B1623E901E4E1BBE1BE89779546FAB17869533486CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ee055d505554bd861e56bde47fb8dedbfa39bd433f76a7c85b3140f18bc75017
MD5 2863ad4c3b0b89ae4c1abfa8659260b6
SHA1 ef07538f8771b1b6ae22ca897d04b52220319f33
SHA512 755d7d98a357bf5502729b8a9b885018fd02532a731ecb0ee0aac2b43e85a37461fa390c89a34b0b0ac6c1000cb6987afb3e93449f6743fbf0396ff1b40007ff
SSDEEP 24576:68kNvNnaFeYhJNtmZBmD0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+m:68MwBtOmD0VY3vSi+ttr+Ekw7n2m
TLSH
T18755AF2EB6F845E4D1FEC6B58E238512EA727861073293CB5290C13F1E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0fa596c686b65455a9b9a3f9f9d93359ac6a2b3c9dac59df815a83dd46752f45
MD5 0c3e24eb6bf2e170528ff14372176ada
SHA1 424b5340764dad18bb88d029ad5efad0234a3a6b
SHA512 53a9d893e4440e1b523fa6b5b32c59b4e0368fe4fbfcb32a93090596eabee3d8fdfa84df55d72ae3d2ac561ea211ad9f993cdb4548a38fffa6dab8e6cc370441
SSDEEP 24576:ZD3FHshBIYQgAK0s8YsWb4KSi+ttr+EkZDOs0tvbbUs2/+i:ZDVHeBIAAK0VY3vSi+ttr+Ekw7n2m
TLSH
T16A75E13DE79D04E4E47BC2BC96638606E67138A9433256CB11D491BA2F2BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-300-0x00000000007D0000-0x00000000009A2000-memory.dmp

Download

memory/1008-301-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1008-393-0x00000000007D0000-0x00000000009A2000-memory.dmp

Download

memory/1008-314-0x00000000007D0000-0x00000000009A2000-memory.dmp

Download

memory/1008-100-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1008-102-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/1008-108-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/1596-79-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1596-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1596-315-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1596-317-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1596-293-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1596-73-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2060-98-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2060-69-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/2060-64-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/2560-48-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/2560-41-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/2560-49-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/2560-38-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2560-265-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2768-0-0x0000000000400000-0x0000000000566000-memory.dmp

Download

memory/2768-1-0x00000000023F0000-0x0000000002457000-memory.dmp

Download

memory/2768-7-0x00000000023F0000-0x0000000002457000-memory.dmp

Download

memory/2768-97-0x0000000000400000-0x0000000000566000-memory.dmp

Download

memory/2768-6-0x00000000023F0000-0x0000000002457000-memory.dmp

Download

memory/3904-130-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3904-302-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3904-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3904-129-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4204-21-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4204-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4204-14-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4204-13-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4204-20-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4308-114-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4308-122-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4308-113-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4308-120-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4308-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5180-47-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5180-26-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5180-33-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5180-29-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5180-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5744-90-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5744-299-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5744-297-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5744-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5744-84-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5932-281-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5932-54-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5932-94-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5932-60-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download