7bbcd0d6f7f030f90be886e69627a6cba8b40e9e538835272f27ac4984d3e917

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
Size 1.9MB
Sample260720-vxjsfshv2m
SHA256 7bbcd0d6f7f030f90be886e69627a6cba8b40e9e538835272f27ac4984d3e917
MD5 89d0c6e0ec423c56300e3fb10af365ea
SHA1 fc135751b1ccaeb78ab680cc35557171b7403ed7
SHA512 cf33ec09902fa35403002291788659f45f7709c49ae5911b9b96773af4af7fedf0708f29c787af1b1430b29a04df7c8a89353e3705ee52a1fc3baac6497b41bd
SSDEEP 24576:w16+LIcg1fnyy/v5brmYRr0xsqjnhMgeiCl7G0nehbGZpbD:OXLFg1N/v5bN0FDmg27RnWGj
TLSH
T127958C62B3F580A0F5F31F70693652649E7A7DB25834C58E9F90390E6E71A40E936F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3248	elevation_service.exe
3288	elevation_service.exe
3440	maintenanceservice.exe
1856	OSE.EXE
968	PerceptionSimulationService.exe
4816	perfhost.exe
788	ReFsDedupSvc.exe
2512	SensorDataService.exe
1872	ssh-agent.exe
4732	AgentService.exe
2764	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a89fcefbe05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b7716596c18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000627148586c18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3edf3576c18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c007cf976c18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5eadd586c18dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2a733986c18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5b77c576c18dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054f1e2576c18dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe
3248	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
Token: SeAssignPrimaryTokenPrivilege	4732	AgentService.exe
Token: SeBackupPrivilege	788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	788	ReFsDedupSvc.exe
Token: 33	2764	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2764	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2764	SearchIndexer.exe
Token: SeDebugPrivilege	6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
Token: SeDebugPrivilege	6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
Token: SeDebugPrivilege	6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
Token: SeDebugPrivilege	6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
Token: SeDebugPrivilege	3248	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
6004	2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 4648	2764	SearchIndexer.exe	100
PID 2764 wrote to memory of 1848	2764	SearchIndexer.exe	101
PID 2764 wrote to memory of 3440	2764	SearchIndexer.exe	102
PID 2764 wrote to memory of 3424	2764	SearchIndexer.exe	103
PID 2764 wrote to memory of 4604	2764	SearchIndexer.exe	105
PID 2764 wrote to memory of 2164	2764	SearchIndexer.exe	106
PID 2764 wrote to memory of 240	2764	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_89d0c6e0ec423c56300e3fb10af365ea_elex_glassworm_remcos_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3288

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3440

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1856

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:968

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4816

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:788

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2512

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1872

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3012 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3012 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f17ec54ececb5cb36d1b45ad7bcb89651def67af47d66f78be21fc4bfaff9a69
MD5 1b456752f21195fc49f5388ae1c10ec8
SHA1 44e44ba70ec3fa8161df3ee2a206c8529c4fb9ef
SHA512 06ec9a4bf292ed66511809fe3ad9736cccc4a4143f0048818f1e72a1798cf1f7d728cf7b6f7e99f9c65a007f35a03b63e75c9d38af8ec4ebae5c21b557af409b
SSDEEP 49152:ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxnQDmg27RnWGj:M3q6sjBTD527BWG
TLSH
T1A6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 9a6c469c785b3942a853cbe69853fcca698e7bc975996ec7f565a029c1df7410
MD5 4cf297e1d744b6219248d45801bbb3e0
SHA1 7e10b5b624681ee232656afa675ff4f3a5e8eed6
SHA512 405fdbbac1d793d81b2e42c41816219e4e61a0ffb4df20eafc2fc4c87ae038d84d09a50eac789ce1dd27884187f3653a33476eaaa40709ae2c2e7a0a2d5a331a
SSDEEP 24576:IXYfDtczArsqjnhMgeiCl7G0nehbGZpbD:ftcyDmg27RnWGj
TLSH
T1C6050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 56c1c84d834fcd3349423eb5018d5a8f7db8650ba6ea03f42646f313e6a38138
MD5 94162ca3ae23c8265d0bce25af1da55f
SHA1 62a7ffb8f652eb0965fdb60ea8b7d7c5e9479cfa
SHA512 ec3258fefd5c68719df5fa24e436fa65c305112a87a90c36abaa129ca5cd373c4190331f9de02cf5c79b7b0dd18604d79533a2ff7c45245e5cc66031f8739984
SSDEEP 24576:H0Le5ji0hmxxrMcsqjnhMgeiCl7G0nehbGZpbD:HPji0AjNDmg27RnWGj
TLSH
T197359E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d5ff214f2212c50af969971ab87f841df9ca7b5499c4d19a310d0648ac8ad242
MD5 01ae29759289a29b5e7274e23f777af3
SHA1 e63b020664a53bc98ceb032a96e07478642a486c
SHA512 4be73f711cf1069bed41b67a9e780e926f49aa85c2a25b3c0938a20ec8e47827c77b770cbfce661115b5416d4a6aefd5e3dce6858b93fa76e7ca2f4e9baf85b9
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWn6q8wyuOsqjnhMgeiCl7G0nehbGZpbD:6/ezSC6vUzPveHjy5Dmg27RnWGj
TLSH
T1B7755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 86ca377d2db8afd4d98716a845c6a4454547b6d2fe4fcb126a491e13317aaadb
MD5 41c3f064bab549bef7e04a86f7755b02
SHA1 9eec1500c0055e03634283eff4b01d8713e63831
SHA512 1c8b4de647a12163b71bbbc541abe9c88d00d4470f96025792863c31ae2371ca2df5bb7f0f5a879c7e3daca5f879b1dfb919dcdb1e320ad7f496d625aff7a24b
SSDEEP 24576:bVbqPb88hv/l+YfsqjnhMgeiCl7G0nehbGZpbD:bVO88hXl+qDmg27RnWGj
TLSH
T1A9559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 727f53d951ce128826042269b2ba68ccd5998ad46457f2752792355e90cae3f1
MD5 c6aab858396f8276887478c9c6ec720b
SHA1 01a6fe83ad0dcd5b21b279cf2c7000b93ad8cc58
SHA512 c4743e410cc814ef01c706279f8df30973d986841003b47b56c9d6e5a93b7d3d32c323dae06e76f6bc152ba4e790f5a6324baf73304595998de57ed388c1b1e5
SSDEEP 12288:hLAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hLAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16FC423BE824C10CAEA7608B5C3E9F55EAC177E5698200C436A637DFDE6F5464CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9038cbb10dc897a604ac6ad0bda8d1893d860d7f637a183e4d25512ac495ef0a
MD5 6923ad989d7592b4ac5a12357b6a7f33
SHA1 e43fa235ceda699304856e4dd3bd24c4745764e1
SHA512 974e034a899c4301253fad3590b9a3c513b67eacd2c21e30ae99faf52932c1c603553a549f83444ca3f95e62198ff04ff467f620535fc2f38b1c3b2bddf5ed05
SSDEEP 12288:6eBNUbTVO86UHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:6JIUHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16305CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 025e46ca9dc5e254c7f274632bd41e4bad469240f22aacab65e8387ba8f54362
MD5 bbca9ae488749b810d9ae04c5a2ecef5
SHA1 61a4b8f9d7ed2877ce7758bd003422a20392677b
SHA512 434df84a0ce99598be789694fa8e3c2c33066dc5852220fce7a15179ac20c425b59600ceb7a30a7fe9860b0bd8797540978c5b866f7b7489174df8ba22f8776d
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THq:cQvGAdlCEL8c/DRNw5CSD527BWG
TLSH
T1A7266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 6ef1e499bc7f99bdbe0e7d7d4dba5de80b5970a908b4925a102fe1d96940190b
MD5 075aadfa4a29ae3bcf17c6585dffe052
SHA1 1a8aad2d508da1906f4e7d36a80a50ea31ccbd2c
SHA512 753495a3680d3f2dfcae7a3334d0d0c2ec9cd5e1399a0e4a71acc361b09f8e3fcf1e2347e53534a3967849be032fe830c3617067292fa38cf0e9e14a9b27d3d0
SSDEEP 12288:yAwSfxL/2Dc3RDLLmt0LDQewsAj5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:30ewsAj5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19515E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cef79e06f283290f2c1befce418cccedf214d5caa74b06b2eb8ada3e12e367a3
MD5 140da5cac3d0a4d8805596fef577a9f8
SHA1 671e65717f4cc1d6f4ab14a6794ac13384dbcefe
SHA512 2f60d2ca25daf59621fcd18705cfa0e1f219fdb5c2599bd0044eb8feec570119044db82c96d0393f64e6937e668b4dc52911550c5c0907a86328e99971cac437
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHFVQBWG:5UEtQevvqc2W1cpV2tI32QB
TLSH
T10C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 302d6a1b59237bfb72d4e65bfa2f115dec8bc329f2274ae8c786323408172736
MD5 05dd0041a309973d34b287418ba9567e
SHA1 b8a7d74accc592d70635edd3605dc26750adca59
SHA512 160ac0df7e488c78f0ee8a0263f0a259ae1e084c138fa8da9a481d4fd34f3d28d68c7cc6b48803ca2849c289dd3f22bcffe376afd517da830bab431abe07885a
SSDEEP 49152:+CbRquA/m2yL5zQfFiV+XenmE3/zdDmg27RnWGj:zoqtVjnmOD527BWG
TLSH
T15BD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2df1ac2bd8f13435c57ea3de40407b21618fe639ed29920400206566c659c8c7
MD5 a4baa5891f93a6b9eba06c424d3de62b
SHA1 bc3759880f16b364fb96ab3c324664f9b38a7ecc
SHA512 8351d414444cdbe28259438f0d683488a1e7a30e47ff65a5b5ace94e9c4c811a9e57993a12e5e4236e246e3cd981e242b62b4af01a5354bc17ae37004c945822
SSDEEP 24576:BAhGL3IFoiwtA5l7S53asqjnhMgeiCl7G0nehbGZpbD:BAMUFoiq5+Dmg27RnWGj
TLSH
T18E359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 a1bb149f8e17b8b34c1d0b0131db1dcc899714b08d3cd4745b3850b2f3f5cd7c
MD5 0cca02bb4a171930c2292895b7773f24
SHA1 dd3016095b2eb78883c79a99d32e97ae9bfecfff
SHA512 38fc3a63f5fd81dfc70f943e3a179014d585ad566d3e5cde4d169849b86cc740a73a99192aeb21da4a3a636e3cba6ab34ecf23e4c233d1c49a8e5df0295bc3b3
SSDEEP 12288:Rmw5HEjsChNVBFgl0WDm+CuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Mwu4OWlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C105F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 1b79516ccd46f0bc6778838d7fc87a662e49b79a30c4ebda73db703eb442ae5d
MD5 713c99b4cb88d5f5ca147e83fcd76539
SHA1 82c903a04d1f6e9832bbf3afc26ab45defb12e4c
SHA512 d27f8d8afd77b4af6fa640f97ad38d76aed937b0decb92d47b5eb17897c5b2d553003fde00172e753e85cbeeddccb5843556d87d07e0425c3698f911b0f4d26e
SSDEEP 12288:weZ1IypXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RZuksqjnhMgeiCl7G0nehbGZpbD
TLSH
T112E412AE239820FAE563417CC6E5D609E7333C62673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1a956be1ff0db067cc4c1e56e9e50db87123b12412b843587020f2b92823abf4
MD5 901693ff34755276b2bf7dbf5cd04225
SHA1 afd8150f8038c20add7e64c14b475a33acf659bf
SHA512 f3470c5ab001637b7333adc81e5dd161b6373aa351d3f8defe3a32d927d9261c127096ace8811270f38279336c91184c5c7b197a00e87d5e37816018cf4352f7
SSDEEP 98304:vQRQyi36YOcPbLvw2gAf+PN33D527BWG:eQyiKa/X+PNHVQBWG
TLSH
T1A3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7558e48142ee8f0219fae65381d1fe888496bdb02562748795ca9e033ec39624
MD5 fbb795626334cf9728a1f17573285a11
SHA1 db8a439319d0f98fe9538ef511af22b2c4c4b23a
SHA512 1b3af7a5a650d1afc8e9c9589e0fe801607252d0e767232d846e3115e9cb653648bccb4ab9bf9a0e0c4aa71043633fd0d2ee4f4d1189811c3d54b5c57b48482c
SSDEEP 98304:EQRQyi36YOcPbLvw2gAf+PN33D527BWG:LQyiKa/X+PNHVQBWG
TLSH
T1C8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3a79538de8bb1e18bd5adf052bb1b47e1abcccbc97c89b66af2f8b62278df5fc
MD5 bec7108e5686621207d0bf0f78797510
SHA1 df5fb71b3b558986e8f64ca08365a74ae11fb3a7
SHA512 84e81cfe165f1e5bd6aa36950e99f1f8f340b97c56fe511590b85ff4175f0d86d30f8ad234d2097f992d0753acd82966699451e157345c772a31dff9439bf734
SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL00sqjnhMgeiCl7Ge:Y68Qg55nhceWu7PNU3/NDmg27RnWGj
TLSH
T139B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 11a329d50d33b3fb670d94b8ccbc06cb6ba67994a961976a7d891043b7b35605
MD5 70d9c5dfd9704b8a5df143a26184ac6b
SHA1 899a1464df24135b098adaf0d132ac49ded03119
SHA512 0830f14167c8c8984cfb8794cc7e74137f2be7944460297cb2f1c8ad68d7d4396d5f9e4df175d0dfb946cd36bce54e142d7bb82017aea6b01c59d43b02ddb9fc
SSDEEP 98304:ly5112gYy5azzVvt69nLKnhZ8D527BWG:ILIHEWh2VQBWG
TLSH
T1B3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0ac73e560f30efa67fe4a515e7885a6a290f01784265844639e7959c09c4de24
MD5 58e00f83d9305810bb360f3fa8223a04
SHA1 410d2b5d9459b49f00a87dd57870e779bf3e4032
SHA512 01a0dff3a8049d1a7b74acbe5b89eebec54303b84d4a47567c4dc3c5fcc27392df99e89f1d8a9fa26abcfd00b5ac499f6b794376fd4c5ab5f015d171bda63191
SSDEEP 49152:qB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glvDmg27RnWGj:4u6Jmdxd2dvD527BWG
TLSH
T11DD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7824284e24f2155bb9956678f72cf8ffce884d49ca564dee85c1cb9eea6555fa
MD5 934233a484929f6b48eadd9338c07337
SHA1 9cf1d2d388881d6b88ae287487ede72a2a939662
SHA512 8699f7e46d85792bbe48e8c0a4605792584da02cbcd6c5f38b424c8e1ad62d7e85bee240856149478335750b0af79b362a9f00f59848fa113471fe5f47a944d0
SSDEEP 49152:W1hpsNoJpF1A63U44CwH7R4x7Dmg27RnWGj:WmifPWROD527BWG
TLSH
T136B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9300926fc47f6c636db5334e1c213a141fffc80e8bae8d4c803ce432b4c43f81
MD5 b201483cdb9175071648adf4ecf154ec
SHA1 e2c668225d2114d4e28f20ce5c6ec4359c1036f8
SHA512 cbd3d9c33316458dedee5a6a3c1373a18859894de12235188f800d5314014044cd4fe04a181275663a38df948cc9a589f9ae154399f12b2001343511a7809fc2
SSDEEP 49152:bSuZQIY0Be2KcRVtOnks6NMHqADmg27RnWGj:J5dKii61AD527BWG
TLSH
T16AC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a9ddfb4d260ff1d22209ea4de239c12764aa579784a5ba4d5e0365351b5b9fd2
MD5 e0a7e090faf340b4231c2ce6ad9d8f90
SHA1 56a10a777ebd03c63999a456ceab71bbbe43d54a
SHA512 d7301a6fccb6b00e5f4363e517bb560544046ae31db5ac99251e019d5408b4081de250f499610e26f0eea40dbfa423e634b5a2253d5ab90298e39a98f477afcb
SSDEEP 49152:4htSn8EApI0fig3giDn0AP5wfDmg27RnWGj:pX2imphaD527BWG
TLSH
T1D195BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 cb38b2dfbb62ca6516661d55ff19830402d5f2cd0842b55f74118932d06ba960
MD5 9b9ec10b1808f382d241a9c3ea8a43e2
SHA1 549d6d003f8625aa3b6ecedbb87107fe2342b537
SHA512 ebde426fe9427e1ea922f0bddee5c8de949114158c84e6ded7ab0a29c76a89c27284320f98a7497824d049cb5a73d04bb57feec573983c3a56270fda2c584dad
SSDEEP 12288:toXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BEC423BE914C01CBE92644F5C3E5F15DAC073E57E92004937A9B78BAF7F24A84B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 0e1d2d1ae75c680a800d7b593c12fff85191030d798b6bf6b9fd223764ce68f6
MD5 8d4efaa39f7736ac9431dc47177159c5
SHA1 57a46a28e927aec74405b8124c69dda3f277d476
SHA512 893efa5474da669455c6c3298be587a857e00d6dfc8d7d9a52fa341a6ebce32a8cbdc8ccffc6eb5f61fb53eb1b1a9049d0c985980c3c8d73573c17034cecf4cb
SSDEEP 12288:tdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E4C423BE954C01CBE92644B5C3E5F15DAC173E57E92004837A9B78BAF7F24A84B39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 027bf5fbea6aa0ac81039e2152fc14196ccfe9e2fcd5df8a88ca96a4d1c6b820
MD5 67dc97f161d817e3ba6d98e4ef437371
SHA1 02437d8ab0ff4a1ad127dda0b263d3ce6c98f24d
SHA512 efb2821c29b8bdf39af17d58e738c29bd675e4217247b83f80fa73758d8d73ab43be4455603319dfec2a787b9fd20322b00b42f06f04781b8fa7a4fbc03eda90
SSDEEP 12288:CvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12CC423BE914C01CBE92648B5C3E5F15DAC173E57E9200483BA9B78BDF7F24684B39462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 adacb760a6944ad1de5ff05b7e8c6c872832956743fdac1b04d1882bc5995e59
MD5 898aa8cb50654b6eb92fe35bc37f44f5
SHA1 6e7e3b16ea12e4eedade1d5d911752f02ed571c4
SHA512 fc173db00caceba8e76c66afd74e7dd9a967cf0019545e35ab06bc14fd5e19b807fe142b6ec7f45b226c4420874eb7297c8c259046608a68bf72dbf7c5e7ba9d
SSDEEP 12288:vV6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B2D4236E535C01C6D83285B4C3E5E11DE8277D56EB3005DB6B532CEEAFB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 96b245c75dbb9d958a9266a48a34d0ab12091e528404577a1ddd7af3c2f3c583
MD5 a3812e728a1d653af910270ffa9e563d
SHA1 ab891c1a1e8c2bcfe9c9aed62cc1d92ef41f16ed
SHA512 a9b774e442fdc5cf3e59c32c8c73ed04517e2bee369811886f61be4c3e7886c375352ff24175d01ed242c9c8765fb5ab17a05aa846dd44214ff974af20199791
SSDEEP 12288:OSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C8C423BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 83093b57104204ea11daa96a95cd5202567b769dbbe0902d649c16225ccd5939
MD5 51192cba2b1f0ceeaa661c9ad7245b81
SHA1 4fe9f780982a0aa8d28edb76c9bb08121eb6fd43
SHA512 5c283901562a7985841128b5b00397de41d1aea6f9403ea42853d817bf71812fe24af16811dccc7afe1b0ec1a8c694145a11e5950848e3f57fd8b23467671638
SSDEEP 12288:/hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11FC423BE954C01CBE92644B5C3E5F15DAC073E5BE92004837A9B78BAF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 ffd5e5c2d226788248853604c20db3eb1af128b4f80b98a7ee818a796fbff8bf
MD5 ff268edc3ce4773888459240a247860c
SHA1 805fd04fdf12d7756d573b7452d09cd74ed75c76
SHA512 80d83a93b494059df2d98803b1468223c6ac06971c09f5a8f3a5cb65b09c893abb8363a71f378f2bc56ee5f17413c8b9e71c1e8663724d63003b860d042ae79c
SSDEEP 12288:K1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:K1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F2C423BE954C01CBE92644B5C3E5F15DAC173E5BE9200483BA5B78BAF7F24684B39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 8973e730fc336b0b6ef0ecaf156a68fccef26410f6bdacbeb7fe8d7ab58bea7d
MD5 06f930a309d95bd82e2f4138b5459eae
SHA1 3205ea60e2564d1b1884c667319f03568a7886bc
SHA512 fe7fd02ea2965363c372f8ae4947a132763fea0a8cbe1da7ec381de4f7a59cb51efd1f71e07a849c44e606d143e79015aa34ce0e84a74886089cc6d10de6a444
SSDEEP 24576:3ZMRzFVSO9sqjnhMgeiCl7G0nehbGZpbD:3ZMRzflDmg27RnWGj
TLSH
T1770501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 634e95c8193a8065783910d4480b34d0cbad1104ca52a9c8ca8b75cb736e9e03
MD5 85d340bf001a65441a696d61cd485759
SHA1 aee1029ad5974ffe67d4ef4bcd2c4190981f4d28
SHA512 74a49018709a086ec424e43581beb5e80438f37bb01a5f20680f0decb223664e0c4c9c986aabf8e9a5cfaf2490248cb320661b8e6c7b021a3212cc6d052ab040
SSDEEP 12288:TUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14CC423BE954C01CAE92604B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 e829604648dd7b809c531c4deebe9a5fdba89d27777f560a9c2733ac0aa2a2c5
MD5 46ae3bf005e473db751ac5d2851ffd92
SHA1 b810b1f2b836f6dcbdb738d8ce91a72abe99d4dc
SHA512 d4889e0c45811b4e218e46464a065b00b9e941a5b87a3a268494447bbf1f8381143a8a1dd4e083b016c280f2097233aa7e45ebb597d74bdaf6b6b874f8f5d93c
SSDEEP 12288:wwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13AC423BE914C01CAE92644B5C3E5F15DAC173E5BE9200483BA5B78BEF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 4c95191e70750b3b4fd2ee76f424b48c638ea977f75c1499c9c181eff4a7158f
MD5 d6d376c6a05643c96f2563ab309c6f00
SHA1 2b33bab2f946eecc04e00a3a1d749eb649ea1d50
SHA512 57cbde586b031885488dfda4720b4a50bc92a547b0e8cad7658a8194402f0d3ba84033074c0dce4e80a55ac4f968beb6d6ea27970aac26adfcddf77bbc0cc07d
SSDEEP 12288:AyPz5L8pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xzypsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EBF4125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2c0bd0b89a9fff20bad861b0e2411f87b228797ca0069d9dbf50d99a21ea3926
MD5 9b1e0011c66b8c3c18383c061e995464
SHA1 09d95302c6dcc26ff731f092f393c8e81cd9a428
SHA512 dcadad23b38be9e0fb33b9064b2badda55146b36abf54a45e6a56fc051517dec6e4785972f9239ab1d3e592bcfc70d7cd77df6c3176d65d3e4f2b54bc108cd8b
SSDEEP 12288:xUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10EC423BE914C01CAE92604B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 18f5631cfa35c239110582c3f7d7446495894a43fd8e049dcce797d472c29470
MD5 9423e45dfbfa1f5ae69eb32b1e6a9773
SHA1 464b8f5d7eecff3cb82a1efb7b256348e7fad7d4
SHA512 9359ea6005680c933978a6bbfec48126997de807dccbe3eac7059fb862eb8c4e59d1bc4f19556a0464f40132fab8d23af362b782de2875b3dc3716625417266e
SSDEEP 12288:NUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17EC423BE914C01CAE92604B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 4bf19cda4ab766fdf63c219f2b8f9efd170e514deea87f40a0748df476d6e468
MD5 12ccc823c0a70504a2c22ca69963a082
SHA1 57b8bedbdbc458340b97e0f5977579273782ca1c
SHA512 51ffe5da25d064e30ce05438738c7b1db73f53fc1d5691ef21ebeb0ff8dbe8d3d503dbf4b3741f6d15b93799c665ab43c1a384bdddb0cfac5a26b14a44004ada
SSDEEP 12288:ByPz5L8pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QzypsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E9F4125B73A530F9D1378178C5A29A06F7337C3247204A9F17A506BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 91c4db72670e80e75db368981bb1b3acc5f3c5bac42c85c28fd7f15b9f183529
MD5 dfb0fd9f7078fafd6da4cf4b3b6eb9c1
SHA1 68b1578780a2ca4dff0952eba720b161ce06e91c
SHA512 543b1f45b20ea7ad9b66fa88c1db678aab85a94b19dc9e482f96ef0eec65212533ea93e131b42fe7a9ca37fa6e628adcfd4609e5598aaee33480aefcb4b55c25
SSDEEP 24576:3TDaLl3z0zD/sqjnhMgeiCl7G0nehbGZpbD:3TuLljiDmg27RnWGj
TLSH
T15B0501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 fe623d1091ebab1480cdd183bed0c2a459cf7261474f1470749e42ddab9bca47
MD5 20c6e9b4b9388b31bd4f6108c5053cfa
SHA1 d9c09f47ab1588060d6f29c82eef2ce150565d95
SHA512 77d2f2b62b1e8365d6735883e618806a2634154c7811a9ebbae64a7d78cff1d70be0693c63d73c2f8ee2e457d63bc228f25469cade2c02d9ae2148b908f4710b
SSDEEP 24576:A3vd9CHKy7GZTsqjnhMgeiCl7G0nehbGZpbD:Kvd9CHKyalDmg27RnWGj
TLSH
T17B25CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 8c1f603c0640c9c0ef460e7b9752d540660e267cd5024c5aedd45786e3a01f27
MD5 861ead27f1ff6af1a05dab9e07d07d67
SHA1 74e7fa6433bb523297f2a3e938debf452dc89130
SHA512 0093e193da6b08802b09b1206d2acde5e80293791c94b7232732a98f00a1d10e8d57f12dc61abe2c767f4d090ecd09821675c5cb22089472bc2c8b0861b961e9
SSDEEP 12288:zPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T198C423BE954C01CBE92608B5C3E5F15DAC173E57E9200483BA9B78BDF7F24684B39462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 36b08a6adaa48061ddd278c963827359e925f0d01e1cddcbdfa3adea0dc7fabe
MD5 6ed93c9c7610d8e083a93890fa96a861
SHA1 ad526cd6c0f7e478a88acfecc65118be9762d7a6
SHA512 a5b717c3ba4c2b5d1dab2756d583fd47b78e05f2384a45d18c68bf7e99bc3f4bd2eebefbe2b5ce44b12df3b66ac82ca872c4b0aeea569331fa6b4fb34129c9fc
SSDEEP 12288:3JXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16DC423BE964C01CBE92644F5C3E5E15DAC073E57E9200483BA9778BAF7F24684B39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 57b8b11e9ecdd4ca8992410acec5959ae6bd156897892c10a275036756862ffc
MD5 15b3d64eb42c188af34a2dab327202b3
SHA1 ecd02556fd07e37724e1527365b5cfece99fda4d
SHA512 608c452a9e2ea5ffd73204fa7500467ec21732aa1b09e1df1cc7592e4b8d1d727f24096aa1dfce8b820cf70280804e28422affd970dc069e2c33b94096a23d4d
SSDEEP 12288:RGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T125C423BE914C01CAE92644B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 6fdc33aaed95a983f26179c59420170461f9cd4afb8fdcb1082ae01b23b0ec4c
MD5 86a57c407388d1dc281b0af3e4eca98b
SHA1 a592d34c9be565bc1c840bb8569c1ff76dca7b73
SHA512 e4b4bf483dca558e3697c09f12a079508749d1b5142897013ad4a0df9321e52043d8cee81303ab2560ee9dd6e957da17d14cfc81358568237e9eeab825e28683
SSDEEP 12288:FUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T195C423BE954C01CAE92604B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 446e75ecb11767f12af23efa1b0603bb715b111bd0751927016fdbdb271d0679
MD5 1ffd6816781918ba5f62e11503cc7efb
SHA1 5fb92d306cbe3044821cd6ac060a93f7a20363ce
SHA512 729bd4c3299cf1c038366b8ff51b07911dfed6d511f758b22615c72672bb52e8d73193073d5a0d8d348a3ddf9acd55777eb56080dbc35b6a797649432866c695
SSDEEP 12288:iPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E2C423BE914C01CBE92648B5C3E5F15DAC173E57E9200483BA9B78BDF7F24684B39462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 ff8c3a9cbfb4921c6270a6a5b769525ba731aa40496c3d3fec1625d2a6c5abdc
MD5 9818e76636b42bacf2e0cc5a97a7d9d2
SHA1 8d74a6dd17b8391f57ebfaa6740c778ed2f2877a
SHA512 c43f4c0414110f67b36a5b739cd8c51cca0130e9c3f8c424aea86d9140dfea0405d767266681486f7ddbaacef378f917ade5bc2d4607636f5bca34dd29221408
SSDEEP 12288:bsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bssqjnhMgeiCl7G0nehbGZpbD
TLSH
T157C423BE954C01CAE92644F5C3E5F11DAC173E5BE9200483BA9778BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 37c1dc5ac673541b0f4c947f357488abd66f33f92b774b896b1d21dfb3d71e66
MD5 1766c85ee51250a05005757b977d3457
SHA1 10ca2898c819db27224035393db3e2c82afdfc4b
SHA512 b23345182bbb9e5606701cb06a5205db5d9aad142a2d91a4b84460e831a3980c698890b5e506bc825a96bcae026fd352c35c0040d6790f9c9800fff52883d70e
SSDEEP 12288:PSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C0C423BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 45d6e4478875d37c72cf266f4d725322ecb297e2a8931a37f4d4f1bc3201ce91
MD5 3ceb5a61cc534d4d43d22fda62d302d5
SHA1 2b3807de38cacd64198eec762e95d91bedde42e5
SHA512 de5dbcb5673dfce50d7bea9f6fb0244ae44dd8611c3fa7fac8b3fcbc36272ae238639b29a14902515edb40f1386d6f18f8cc859e8301cffe8d9358db02365608
SSDEEP 24576:bfwvUk9RX6wkyAIgsqjnhMgeiCl7G0nehbGZpbD:xMnYIcDmg27RnWGj
TLSH
T10835D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a492cd337c4e4705b5a93306c67788ce07da63d9ea3d8de137fa1840a4de4c16
MD5 5dfefe95d3c768c038c6da6c40240ada
SHA1 a6a29b46cebd61683682d1f3b0e3400f472f5f97
SHA512 75099d8435cd87aa432bb326c301e9824ad186574b2ae3b34cb358f52ca675ef30dbebae96313c7d5f6bedb77819f3d4ac56476066406b14fe6d5b7fa2f3f7f9
SSDEEP 49152:CYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/Dmg27RnWGj:ZySzPXD527BWG
TLSH
T1C9066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3c6df01a145553fd5a5591dcf14f46bfe08a980c4c1b6013d9d8ae0b582c29b0
MD5 37d82af1913fb2fdf70008cef639a291
SHA1 041538d56af18863298f8bab43334ea27dfd4f0a
SHA512 57ea5b0c96711c719a32674eeb3b5968f539eb9277b81524bb77b388827585bafe561f78a842f7b7d77a46f7bad8a98aef0d223c418bf2b7a9ffa89fcccbea80
SSDEEP 24576:h47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYtsqjnhMgeiCl7G0nehbGZpbD:h47JUQjTirIhCnDHUPfF/vDmg27RnWGj
TLSH
T12E65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 2b56a694d19261166110c83f7f5cd425cadbb81cb95c68c24da78ba0aba3d003
MD5 d54c5e2c412b71b745204dc3a793a6d4
SHA1 c5889c277cdf11d778c8ec46f5b7422f0b376ae6
SHA512 a9d082252d46b7a9815bef1f914c103d5cd5346bfab4c26fad03ac9088e720611da49288833e92a9877acb5782df0aa9056c0f7043df9507ca4133e104ff95c5
SSDEEP 12288:QbsfkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EEE4015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EFA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1008KB
SHA256 c1d9a43500972619ec0a4c27ae2c77e295e04f7f3c9eb58237584b0b204fe194
MD5 a8ddb4fd127d696e919ac7fe2cee1526
SHA1 2206a88d163abd900e8b2450375b69913a368489
SHA512 e6e1195094bc02aaf6e6a387fbe66ee83c4b7e233b4af420bc27ffabf40fc3a65461764d31984b1ddbb3e877affcb2ebda1c3d6b8e5f69fa0b54b4b2b272c18f
SSDEEP 12288:Ujd+JU3f3SnUaxWF0qQ2Ut8WcSCYMvk6s4GZopBOsfA3K:UxmUPmGHFI+B50
TLSH
T1DD252710766AD75FC6A980321E37C2CCA7707D01EE059B0772C8872FD57666DBAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 f8bfc3b3f4885600dda6d64ce25b138abce40e084a9c8d12c165d07557e04470
MD5 2288f6e0bd46b222a607c98ccab26826
SHA1 0be5fc5ecbefb42803450ae7960ef653e63b3af0
SHA512 0f65ff5a516a18b62ad437704dcb76e715b087a3e17df2d6a8e87e0af3811a167df9962e3b7d7d91ac66fedde55a89c4dc48636cf0ef27571839fd4563397387
SSDEEP 6144:v9DOQXkTEcxycyl993RxxWFVCqQ2E3/26tMxZOxA68laWg4IPedXGsJgiaiaty3D:v8tIFxxWF0qQ25VUI
TLSH
T16245A5816537A38FD1F72131072A5B4CA7A4EC47B7095F27A388453ED82B726A0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Options.dat

Path C:\ProgramData\NCH Software\Copper\Misc\Options.dat
Size 170B
SHA256 9c153b159286d203a566850ce3e5b81aed3d2fb1615b05beb206c295fcb7fb6d
MD5 c933d498e3ff9477076a19e7dd893242
SHA1 b416b63d74646bafaf7373e07e9b01f971b85e34
SHA512 a96eb6427c6cd7c19fb70c9a6cd5a5a6c358d3bc93a645d0b6146e21195fecf9f4a43e10cc69744c561f051d68e293994776d95cff3bf0647a4beb40f2c60774
TLSH
T10BC0806005427BF4C47D0C25050C310B0611034434D3D18DD49CF9807F12D30F55177D
MD5 SHA1 SHA512 TLSH

Submit Download

Options.dat

Path C:\ProgramData\NCH Software\Copper\Misc\Options.dat
Size 194B
SHA256 987d6e88d286c7abb2c5661454ff6b2641032e6b7e47059d6d42d908919af465
MD5 78eb4dfbdb0782111d790014bc7b8e58
SHA1 68b76f18aab2579fd99ec73f7d73eec7fd6464f9
SHA512 86b6cd02c53dea8e168332a1b174c9324cb34296e4f1e0d21ad179394fe1b226481ae80b433c21c332a92681759b2482892dc594da2414ed3e18ebb5aa653db6
TLSH
T14FC0126006436BF884BD0D26561C310A0A2143C574D7D5EDA4ADB9806B56D74F561B6D
MD5 SHA1 SHA512 TLSH

Submit Download

Tax.dat

Path C:\ProgramData\NCH Software\Copper\Misc\Tax.dat
Size 165B
SHA256 85b0b8e4553ec759d0a7eeac3250a2f410a1c6ace93e8544faf31719884f0688
MD5 545c3e22271954f577aebbb28111040f
SHA1 c0226d380c60d03bba30625b86af5d937cc0a427
SHA512 0ca65fd21808e80c3648208a4332171b9be2df814f4af758cfd4c08ac7c50d60106e0053c545604d839e2a3240335b88fb2114efeb7b93b0f05206cd6f483414
TLSH
T16EC00268286CA421F5027DCF4405F21A48FCF2CF49C62F26B0A4C2E11095C0414BA54D
MD5 SHA1 SHA512 TLSH

Submit Download

Transaction.dat

Path C:\ProgramData\NCH Software\Copper\Misc\Transaction.dat
Size 31B
SHA256 a235d3ffba307a2bfed6c430244c43b0041b7d8375369a91d55372be86c5ab48
MD5 8436afcb629a03913f135877cc757919
SHA1 34a3c420e64f2b7cd309b2e93be304a5a9dd1f55
SHA512 a6fd6778cdd32164c1822dd0a9f0142e27d4a442a4bc1da869caf87c243be16356790a55f5e239b876716a1934e25a1b34d7809cd969d9e3dfe6aa33bc629eb1
MD5 SHA1 SHA512

Submit Download

Transaction.dat

Path C:\ProgramData\NCH Software\Copper\Misc\Transaction.dat
Size 31B
SHA256 afa42be79a6300e4a461621922a620b75ff2628d1a63e557d8f6f271c48fb15e
MD5 b945a94988093b8a3c3333c8daf824e6
SHA1 cf7a97a0d3280d55ef85dc15def5a9de5a9cfb25
SHA512 c0708a1708c6d2ab9c0e5cc253604f6b3877aebc63eb90857122ed5529029f74cc41d3c2ed146e21c6611553a48385f7ea72404498dc6f61d3da67f3d88fc398
MD5 SHA1 SHA512

Submit Download

Transaction.dat

Path C:\ProgramData\NCH Software\Copper\Misc\Transaction.dat
Size 31B
SHA256 b978d21161b164f3d87fddd7b5948f863ade51e7c6c54ef69b5e915a0c3f14f4
MD5 19e898dcdd9ea10b9641518f94e8b242
SHA1 1089501426aadde81ecc7bf69d598947627990bd
SHA512 276ee9eb86de6ca6beacdfe911bcace9de6f08df8e5a4c55f5d7bfd9ffecdc883049670e46c92199bfdc0aa82ac9a6f30be99e2d128be039eb7ae62733aedfdd
MD5 SHA1 SHA512

Submit Download

Transaction.dat

Path C:\ProgramData\NCH Software\Copper\Misc\Transaction.dat
Size 31B
SHA256 9ff3f8b6e6f6f0848bd2d58decf6b03642bc7b2e23087307e0cb9e14a5f1297f
MD5 3310655c25a5e496257dd474ba3951fb
SHA1 e240196b7752bb7144940015804659a769d85d87
SHA512 d3546ba0510c1f7406f44cca36441ece8077144ae7741086d8da66136b11b2dbbf7c3823062a902bfde3b98fbdcddc6127609d450cd8f64cb5c162c4371f2785
MD5 SHA1 SHA512

Submit Download

Transaction.dat

Path C:\ProgramData\NCH Software\Copper\Misc\Transaction.dat
Size 31B
SHA256 aafcd67f1d6830ac0e25d0de0b89736d22ef0371f4228d61682e8fd26556023c
MD5 f5c4d4e6885c491db3cc60b92b541f45
SHA1 cb44295e89dba7bdeec0d8f354c41f68d56541ef
SHA512 07d5a4b8faa3d0d22016aafef9f8f98c5f80ad7fc79e054211c5760be74f530c82400a2682d4c12fe005b6a0930ba438ba14b5be068638d7b133d18644f1b988
MD5 SHA1 SHA512

Submit Download

Transaction.dat

Path C:\ProgramData\NCH Software\Copper\Misc\Transaction.dat
Size 31B
SHA256 323419874712277c6e8e6560fc94e3c4f555e5294659d3bbcf2d3f15e78588c0
MD5 9561ee6bbd22226c690bd254e05f8590
SHA1 75b43cba3c1c6d667675bf811f0464cc7a8d5e5d
SHA512 6306e5f00e417001776eaa5611333eaf9d59abb34718fb7ade77d9d2c632b3a7da17abbf95fc6f21295e5132af38f4a27ca170facb966f0935300100b879bd05
MD5 SHA1 SHA512

Submit Download

Transaction.dat

Path C:\ProgramData\NCH Software\Copper\Misc\Transaction.dat
Size 31B
SHA256 1ff8c2fc134fe0a968ac47bf5e252cf2c2a838dace3d6581ef01729c5efae533
MD5 06639850e924fcdccee3f461de98e8de
SHA1 58c09aa5941cc85d8508b0b53d4bc38ecfc7fabd
SHA512 b0c31d2e98f62d19260f11d613a978e61722e4e0516945f9e997ee055d370ebda0b4a1659fd099c4102d49f25caeb823acbd0ccb0dd32843bb416970b2fe359e
MD5 SHA1 SHA512

Submit Download

Transaction.dat

Path C:\ProgramData\NCH Software\Copper\Misc\Transaction.dat
Size 31B
SHA256 158b09e242aa975f119671735da77fe76424f8b60cbec9ca38fcd9a6377817aa
MD5 527245907724944baabd7b3475d83e74
SHA1 5b6f733d30483cf60bc2e90107868e59c856c91d
SHA512 b355feeca64f9b9f04a2deae86113d5e92f3885497c1fc48ffec7cb5388650cbc6294ce0b04535e6d16645a4bfaa01cc726afef51eeb326e94d4886f60ce5afa
MD5 SHA1 SHA512

Submit Download

Transaction.dat

Path C:\ProgramData\NCH Software\Copper\Misc\Transaction.dat
Size 32B
SHA256 3bb6b3f9ba45b57a5e217cd9860bdcd2a2927445aa239da9814ccdfd7b8779d1
MD5 ed95beb2e6acaa548125a891bbcae368
SHA1 352972337032a08f288725913207bfd345b39198
SHA512 6c646be68fe289f18b78ddc8216d1412a8fd6b02124220f43817cb84eff8e73a0b2f28010b5081f2b350db871b6f20188fce340f38d47d3587729a89f7631a7f
MD5 SHA1 SHA512

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 37f7a72b86f872a46515bdcd1fa6c9e4a3f80c2139556d7cfde141053399499a
MD5 cc0aa9a81756f48527ac7b10c07d670c
SHA1 8a64c221290e59036fdc0211597e0ee46af38dc0
SHA512 71f3151c860dc8abeed39639b77f39c23d3d182aed18ded5a55d1e992ecf1b04ad98881a89e293c0540208f6a5f69acbe529b4159d82b3d129a319bae97c8861
SSDEEP 12288:zM78Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B2D423BA934C118AF83609B483E9E12D681B7E669F2044C3B94778FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1f5e7133bc32fe383ee578215f1c0afe1916ede94fe9e83a9bac90db2849f23f
MD5 249e52b4a84e99eaf039cb9c4a2ba4de
SHA1 44f5f77c780c87780c6341d071e8bddd2f79d96c
SHA512 f8280dd1f3011d9d59665c2c247e328ae4afe9a68d264be73ec7fa3e31826783a4b84c2cea181d460113595a3237273cfa8884b77ffa5d83829f7680b831a68b
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYOsqjnhMgeiCl7G0nehbGZpbD:Qgb4mBIBhGFRDmg27RnWGj
TLSH
T16D659E1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 3bcfc151174d8976b798bc93129433848f457a2cf415d0899e71989a8f6c448d
MD5 b7e751dfc52e891ff4531e5b839a835a
SHA1 d7957c4fbf711a8839b3a12039623fc7151cb624
SHA512 8263a3f89e761abba842a5d93dbb1b4bccd790de905ebf25523d106f3e5cc2bf139b37a81773bf9052dfdd35da20e4e90fccb7dc3f6fc2b302a39eb02eda6704
SSDEEP 24576:/G88u8FpJqH1bzria7/m9sqjnhMgeiCl7G0nehbGZpbD:O7ZFPqVea7/qDmg27RnWGj
TLSH
T14E35016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5480f148e7715cec9b9bc702a63f29b04e2b02cc868ca801a4ce174ad4a77234
MD5 1b2341602a82fa0affdf16c45e778303
SHA1 aa1406b08bcf839aabadc7f3d2d6a6d8252913bf
SHA512 3feced97256a5e3383e033fc3ae632acbaa7eac0025eed9488d9e91fe8a868835380ea1795863dab09e6249edc98d335cb314c33d7d4cd279adfab3d7ebabe80
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj1Dmg27RnWGj:hG05lO43bED527BWG
TLSH
T1AAD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 149b8c63b3057cb89d920daf19fab424d37d0045783c8f644bd19192035a18bf
MD5 c7c84113e7f2234afc924e433cfafddb
SHA1 709f598917d3f3989a31c483864beef97ed4b00b
SHA512 04242e1ce3126618f19326f0204044dcacee3a1e24dc216691b2aae1e83a21eb3039500830e6bde0787e7dced3ffd3e3232bc676182a4412e92caab2524de42e
SSDEEP 24576:Nfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnLsqjnhMgeiCl7G0nehbGZpbD:9a5POZ3BJt2pasx2+mNDmg27RnWGj
TLSH
T15F65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 538b30f1a7c74860b3574ba6ce9e2e56b28b30b1d0605be092a9a45ce010aaed
MD5 d4007caca1db59909b473dc4ff5b12e4
SHA1 cccdc397dd928b816287459845769a2a609663db
SHA512 88bf099752a5b82ea807e32b4fdea23f027594322245e3c2e8cac4e2655e2c5378c93c550ee9604ae7bc017498217bfa09d2abb3f62b3e25bb055a5b7dd394b7
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkFsqjnhMgeiCl7G0nehbGZpbD:5Nc/zEOVHFKDmg27RnWGj
TLSH
T11E858B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e5b48aecac10d68dc5af3743234deaed0baa98a45affb6a041415db396e36ed8
MD5 9b3dc0ca67af008955d7cd66f323fdf1
SHA1 fcf6f285b1131f956695470a4b676cb338fc9ebb
SHA512 7ec890d5eea60284147910825ae58ecf8aa117f3d255fcb10f96dd557aa9cafc60b44400838bfb13e15281463ff44831199e40a48116e9d954845b1fc77a1930
SSDEEP 24576:kTkNvNnaFeYhJNtmZBm3sqjnhMgeiCl7G0nehbGZpbD:kTMwBtOmLDmg27RnWGj
TLSH
T12A55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 597f61a7ab8091c1b72994b13db106b5252a6473ae1f6bb1393db8bf5c7cef3b
MD5 7fbc4475ea8acedd0fc6984470585f80
SHA1 f3e3b25668068c6365b9d78be8fefdffce39194e
SHA512 d5650b68bb8e71f01fe8a569bd626a26139214828a3d949ed739f8ca997cb862d506002bb43fb39520cf5c02886f90dce685b3ce1b4570bdcbadc96a8891c9e1
SSDEEP 12288:dHvUrBFrEjwaQRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:dPUr+NQRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17705F12F62AC18E5E676A17C8682C70DF6727862171192CF02E1817E5F73DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 6b7d57c722ca356eafdb8cfc934fd1de41b38c4a7df9d09c7526a97dceceac02
MD5 1e8bc474675cf0d90fd16d0799eabab8
SHA1 5d97c37db3c6f10afee04099d548ac776503132b
SHA512 00c613fccaccd7d344de66544cf531d87d8542d9430597230f128c493f3378b35ef73ea982574ce966f54928dc34e35e7b7284d7a3eb48ae4d83c4f223dd03ff
SSDEEP 24576:bD3FHshBIYQgAIsqjnhMgeiCl7G0nehbGZpbD:bDVHeBIAA0Dmg27RnWGj
TLSH
T19A25E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-424-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/788-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/788-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/788-425-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/788-109-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/788-108-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/968-280-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/968-87-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/968-93-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/968-85-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1856-194-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1856-81-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1856-75-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1856-74-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1872-141-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/1872-351-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1872-133-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1872-135-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2512-128-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2512-350-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2512-348-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2512-347-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2512-122-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2512-121-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2764-171-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2764-379-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2764-164-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2764-166-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3248-23-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3248-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3248-120-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3248-22-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3248-15-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3288-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3288-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3288-53-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3288-52-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3288-161-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3440-59-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3440-60-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3440-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3440-72-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3440-70-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4732-157-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4732-159-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4732-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4732-148-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4732-154-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4816-98-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/4816-103-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/4816-97-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4816-317-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6004-0-0x0000000000400000-0x00000000005F2000-memory.dmp

Download

memory/6004-107-0x0000000000400000-0x00000000005F2000-memory.dmp

Download

memory/6004-6-0x00000000024F0000-0x0000000002557000-memory.dmp

Download

memory/6004-8-0x00000000024F0000-0x0000000002557000-memory.dmp

Download

memory/6004-1-0x00000000024F0000-0x0000000002557000-memory.dmp

Download