b9453e2f9912f132a62c5323a2e1160ab038e2ea84e14135dde3fdd247de4fb1

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 19:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_1d450e24ff55fe7509ac21f5285b150e_elex_luca-stealer_mespinoza_njrat_remcos.exe
Size 1.5MB
Sample260720-yf49lsdv7q
SHA256 b9453e2f9912f132a62c5323a2e1160ab038e2ea84e14135dde3fdd247de4fb1
MD5 1d450e24ff55fe7509ac21f5285b150e
SHA1 76b9fb884599566d52ea9e7c96a5795188d0b17d
SHA512 a15991d03915b134f3605e99b205b7bfc0b820a4deac47bc962b4f76ca242f0bcd3b5577f66ad5f8349ba0479be94caf4107eec69cc41330215a28d713097719
SSDEEP 24576:zjjx6X/laMicEEhBbcIZgXOkDXhXTA0ImCSERIk1k7c+vDqGJAAg:d6X/nEIz+XTAhmCXIk8x77AA
TLSH
T12A759D61F6E2C0F1E9D320B2DDAA7AF648A46E05CB244CDF5EC03D5539701D2363AA5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6124	elevation_service.exe
5104	elevation_service.exe
2988	maintenanceservice.exe
4772	OSE.EXE
3264	PerceptionSimulationService.exe
2848	perfhost.exe
3164	ReFsDedupSvc.exe
3504	SensorDataService.exe
5944	ssh-agent.exe
5236	AgentService.exe
2236	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_1d450e24ff55fe7509ac21f5285b150e_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_1d450e24ff55fe7509ac21f5285b150e_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\892b64ff8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_1d450e24ff55fe7509ac21f5285b150e_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_1d450e24ff55fe7509ac21f5285b150e_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_1d450e24ff55fe7509ac21f5285b150e_elex_luca-stealer_mespinoza_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_1d450e24ff55fe7509ac21f5285b150e_elex_luca-stealer_mespinoza_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025163c808018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c25341428018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2dc6f808018dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b548d808018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a31971418018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aaf568808018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d29263428018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
6124	elevation_service.exe
6124	elevation_service.exe
6124	elevation_service.exe
6124	elevation_service.exe
6124	elevation_service.exe
6124	elevation_service.exe
6124	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe
5104	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4808	2026-07-20_1d450e24ff55fe7509ac21f5285b150e_elex_luca-stealer_mespinoza_njrat_remcos.exe
Token: SeTakeOwnershipPrivilege	6124	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5236	AgentService.exe
Token: 33	2236	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2236	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2236	SearchIndexer.exe
Token: SeBackupPrivilege	3164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3164	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3164	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3164	ReFsDedupSvc.exe
Token: SeDebugPrivilege	6124	elevation_service.exe
Token: SeDebugPrivilege	5104	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2444	2236	SearchIndexer.exe	100
PID 2236 wrote to memory of 2644	2236	SearchIndexer.exe	101
PID 2236 wrote to memory of 1812	2236	SearchIndexer.exe	102
PID 2236 wrote to memory of 2132	2236	SearchIndexer.exe	103
PID 2236 wrote to memory of 4504	2236	SearchIndexer.exe	105
PID 2236 wrote to memory of 5132	2236	SearchIndexer.exe	106
PID 2236 wrote to memory of 616	2236	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-20_1d450e24ff55fe7509ac21f5285b150e_elex_luca-stealer_mespinoza_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_1d450e24ff55fe7509ac21f5285b150e_elex_luca-stealer_mespinoza_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2988

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4772

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3264

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2848

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3164

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3504

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5944

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5236

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2444
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3000 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3000 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a240f7880f807addefa1bfa2d5770fb6e67896a244f14091bdc26e73bc30b47d
MD5 c207da97c9baa58ab2a8f91c6472c533
SHA1 1992f5a9b8d282f5ba10def6110fb41c442d6fb7
SHA512 c6670fa74bd7766ca50964bce7b1bb88c62e00752cb52523fc4d248274dbcc6b2747bddeff088335513abf31cd6e17f09d841d00832a74c714e0f3c8f7849f30
SSDEEP 49152:Kb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn7Ik8x77AA:83q60jB7kk
TLSH
T116D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 370e6a17b2b1f08881de0d5338fe4461f1638d361cae156c047f86c441744b2e
MD5 c09bf3e7d9de02616dc4fd0d68b708dd
SHA1 d4556587618aa5f8709e7185fa1e61577609ca17
SHA512 31b770530d408be544e6448060aa02c40e850bf0ebf3eca3c9d3e4f61a92e2e4d1e833bb33f57a282846ee6734e0a2c57728fa1cd5cd15be511091cfed82d880
SSDEEP 12288:J1XLsswWkxy2lRq2czALBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GY6:HXYfDtczALBERIk1k7c+vDqGJAAg
TLSH
T1C265022867D508F9ED67817CC9E28502EA33B8554790F7DB03A49A3A1F332D85D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 fa5a47061160c2e1b60387a63dba104ef60c18e605766502f6cfe180f6acb4f3
MD5 99dd30492c84d6cbcf858ceb50a53370
SHA1 03c1063cee0e1475469bbbd9173e45d79bb4e078
SHA512 aeb20555b35b21b844db9b214a43f059601d3413513860bf0c4d6cf4befbdc424e21aa70915d34af5b1d3db35b365ad2d376d6d161ddcae3c23b7ce02d191c1f
SSDEEP 24576:r0Le5ji0hmx2rMGBERIk1k7c+vDqGJAAg:rPji0AQcIk8x77AA
TLSH
T124859E16F6788735D073C0B9C5D2A68EED7130865B308ACB4286D77C3E67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5e9b71961504db2ab55ee1eef17349d32184bb21d0086a7cb88a8200e6dbe3cb
MD5 9cc60bdc5c1719b9db529e0735fbe2ab
SHA1 fe80357089e927e4465b1158dbb7fdeebb6c4287
SHA512 419c2417b3402a203a2fd4b48ce49c62176c2fecd2af7c5cbd11cfbf6d9f341e7b8e4bc5aa8cba0cc454bf2df95e0fd85e9741f8c2fea82195132f340c546f03
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWr6q8wyugBERIk1k7c+vDqGJAAg:G/ezSC6vUzPviHjygIk8x77AA
TLSH
T166755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 09018981a309087c92481a3f022cb38fe8393d694f414278b6712f3f729807b0
MD5 91665baa82ed538c1a4848aa64126e4b
SHA1 94a7a54a562b9072452ead5b0b739262041ffeeb
SHA512 d146f1f521ae866718f00836d6a97c576fcbb61698f0607ec2a2a0cb3e74c25d54ea52971bc8f24a1466a6093bef1fcc0f6e33c8763f64b2b75684dbffc8d8ca
SSDEEP 24576:JVbqPb88hv/l+b/BERIk1k7c+vDqGJAAg:JVO88hXl+uIk8x77AA
TLSH
T11A559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 ea18a32ad7c16c933915bfb21afc70f85ee503b182f0b5ae2b6fa7441f3c1c9f
MD5 47a8d452e70ead61d19cb46173bceac6
SHA1 973ecad8574f582cc79c987ddbdb857b06508abd
SHA512 611a9a6a9bdfe3caef03f6d3cc1044049a488310c79ecabb869006098b755c04c7c537ab7c4b92570849ceb7c5884d8200705df4ceca47f18a9da75b7ede2ccb
SSDEEP 12288:WLaBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:WLaBERIk1k7c+vDqGJAAg
TLSH
T1574523450E1D28B1E75389F8D3CD7A8A7D12BC5C6BC2A5E30A147B2F18764DCC4D92EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 38b6726639b4fa4622af8b6210ca69ed0e24a0b194dff73605104fccd77ff2dc
MD5 898ba33d11960f81c7e9369fb4ecd3f0
SHA1 2ae1b29a9a8893e496e668294d2bc8ac5e50389a
SHA512 6948fceab621bfd739fdfad1a15bb5f9f643bae647c17cc22e122cd7eddb6a3be995beb34366dbcbc2333712f5359551ab1a7a5a27a2472c8e73255e3701c803
SSDEEP 12288:peBNUbTVO86UHBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgC8:pJIUHBERIk1k7c+vDqGJAAg
TLSH
T18665CF3BAE28FCE2C27A8DB857918740E77278704F52A3CBD165830E9E235E45D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2393c9fe98c047d4612aeac48ebd1e37586755c461455245637101b403a32c88
MD5 3b4f7e7d85875b4c8fcc2b6d92fee17d
SHA1 2fda411e98a82d81904f732274ce5db651e316d2
SHA512 f067044f8787ff9d6a9932b0f6c3479a0b06cfcaf3c2fa32096639c1375cdc961e7ce33a3a4d08af6485cc173efbf1f302b15e25a9df007664e7f2b03e6afc33
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THD:vQvGAdlCEL8c/RRNw5C2kk
TLSH
T15B267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 caeee411ee10a83a818a3c55b1f38f9485b75a692534d5d6b5309a0b064dfa2c
MD5 2dbf06242d370bc7ef7d1f4d6ad0f440
SHA1 c404d38c39ad6cdf77c36164abff0b27404d3def
SHA512 e9206e14435bf4b994484c62902ea529bae84f65304bc0dae3caa18cb98fd8832a494075543cdd2f92a41641b32cd7525d81ed53dd4b403808a65fdabb5be27a
SSDEEP 12288:TAwSfxL/2Dc3SDLLmt0LDQewsAjBBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHT:M/ewsAjBBERIk1k7c+vDqGJAAg
TLSH
T17065F131FE78E432C3BB0DB51B66D706283DB9204F9119C3E3A89E9E59301D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e512c581ed4c3241432aa87d32335abf9225c80ca0ef06a04783b785563cc82c
MD5 0f9e061e9cfefc3029d5454eb60449c5
SHA1 2b1e3655c19e6455a1d473abd4ba81e9b319dfc0
SHA512 ea7b473d1940fb692e493d82264ec004662792799360c30c7b7dd9b75b307310bf5139ef3b0804eb46d293747b4bb0005f68d04dc88a6e0c8523429cc525566f
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH2k:iUEtQevvqc2W1cpV2RI323
TLSH
T109474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a3b9b2cf17812ca87daaf9443bb26c317b48870446aeb7a92116087971445d58
MD5 2464a78b7d6372ce8ec93b44dc4e0c7b
SHA1 ce1c3d2f875085afb747720449556e256bbcadf2
SHA512 8814c5f51cf5ccba8c29c4746bc20706e12510043bc80139585d97015d6ad0638fdbcaa13ef6ec7b6a36f855fb4e7023bad774ca37dbcc49eb208e63d8a01530
SSDEEP 49152:KCbRquA/m2yL5zifFiV+XenmE3/zMIk8x77AA:/oqHVjnmakk
TLSH
T15FD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b91a5ef05d85b5230f88bbbb0359473c8a623d7f0aba42e16e35cecf0a0e8963
MD5 c1a2507676e82f0836880cb18dc10b01
SHA1 25d8da32fda1cfcf408a74bf1a595a93bd6b5474
SHA512 fad09ff1eaa7b1cd32b2e197387e80e18a64c40f6b7bad895d536597d135ddfc40fef63bd993a9e27c595c2445675cd3111009cc3b63df5b90951f0f9aa7e149
SSDEEP 24576:PAhGL2IFoiwtA5l7S53MBERIk1k7c+vDqGJAAg:PAM1Foiq5BIk8x77AA
TLSH
T1B735AE80EBF955D4F5B3AAB899B69571EA72BCA95E31C20F1150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 e2d9a41a5b9250f1eabc464596123310b4285cd2ef000f0877a3041a5d872c93
MD5 e12135282922473be005c74422f313e4
SHA1 b070fba152d1acee771f023cbdaaef8a6c8b9e15
SHA512 372a5428b4098da323ae1b20caab3e09b73c0cbb4b92b3a4afed0213fc53df067e39b43e319489a3d553dbaa51b5ac9bbc172598079913bf1b348eedeb950697
SSDEEP 12288:Zmw5HEjsChNXBFgl0WDm+CABEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jHm:0wuiOWtBERIk1k7c+vDqGJAAg
TLSH
T17C55F14627A91CF9EA638178C68BC536FBB2BC052A51D71F0760C71B6F33261AD2D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 d36ddb61ea4cbcf033e6e506ec71be8d0bb1e64612771d7fea12298bd249567a
MD5 c97527188178ff0574adaad01f4fa248
SHA1 954eacaac8b4a5445878cb0b3c7bea741ae9f861
SHA512 bf068b72d1418182adac612d2d1ab2891ccad8732fdf7afc77e30ab0d81ff7f6a8ef27ec44fa4c1907bcb3dffcceb1bc021e651145585d37b746002580ed99c9
SSDEEP 12288:2IZ1IyxBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:5ZuOBERIk1k7c+vDqGJAAg
TLSH
T17945124917EC30F5E2A381BCCAE95A49EB327856276253CF0624576E1F73AC58C39372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d2360944cd6bc33600f5e1abf462efba4694149ad66d2e4ee4fbca3dfea722d0
MD5 702867136323a5b4d6fba8d248478ad6
SHA1 fb047dc8e138a776252abbbad14c53bcfec90878
SHA512 50a85ef6396539cb3f95c7bdae0cf246c5d4476c376d21d15a4d17a65cd2b44092e2120121cd4a328de1c313c363ff99b76fd0e980fa69f325282cf0ad69ab24
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Un:PQRQyi36YOcPhLvw2gAf+PN3Xkk
TLSH
T161667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d69c0cbe50139a73d25b3ef87e2ec5d8f46c2577bbabc70782365cc5e3dfcb7b
MD5 818bdf270b59ebec3051dc5c01fee77f
SHA1 3e94b4f1e025ccf614a350db42b1920bdcc9842f
SHA512 79bf3336ce352524ad961c6c58cbc1c7240e5f47faa114961c085853c4079f8a391186b8ea8fb7da26cdc45bf847a11df2715e35a6e090e58323db34373e9a0b
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Un:CQRQyi36YOcPhLvw2gAf+PN3Xkk
TLSH
T1E5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 286d5c23412a95a9858f906b81973746cc5aed97a5e3b0ab54ca98df5dd0154c
MD5 8e0d17cf88ece30088875c84a64e4add
SHA1 8854c9b75d01cd44e27c6df7101361cf84d30d4a
SHA512 1cd32b7507cb5a8fa592fc8b3f7437b410e2be02a34d877fe7c3027495a6b0736534ca319dcabb854cd4644305884284471c573b051c81ec90355273ff044e86
SSDEEP 24576:bwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0eBERIk1k7c+vDqZ:T68Qg55nhceWu7PNU3/cIk8x77AA
TLSH
T182B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fc02dbb1834ce60e6235e5d331839f1ea931068a6a46850ec5578a81c910f4c0
MD5 782f9bb69ea62691774bdff2299b9742
SHA1 e4cfec8dca08dc34d3a33cc99b7e13599ffc9a2b
SHA512 f3124c0dbc7a81624c6a7f8f8956b085131d2b71f2829e100005f4bd5951f8507a3bc65c9d6759121a03e709dca4dc447f242c6db06169367a4f52e23fa5902b
SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99l:ky5112gYy5azzVva69nLKnhZgkk
TLSH
T175167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5b702a448ad70e2be1c0865e46c428857005898a7714b39ccda55ae0996587e5
MD5 56470b80764aaa924595c46accb33975
SHA1 9225e00edce218c2f5ff2df634c62f4260944ffa
SHA512 e5d9ffc34b8a7952e57e4fbbf9b775454db51baea19c35af354b53cb1fcfbcae5602edf58acca40fc4c56f31573efd2b2910eb695f494343959f330e949cadfd
SSDEEP 49152:DB+taZ3usBWOBr4tEG20bqx0z+n217aau1glcIk8x77AA:1u6JmUxd2dtkk
TLSH
T1CED59D13F1DA01E8D05AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 19155846d1dbe067eddf1d452cd1f59dc8e94446da7647332e83402f1687bb52
MD5 7f13d50647861763a80032c842420911
SHA1 7b57e1a2c9a2b02de5d103494c75b0101d90a40c
SHA512 60aedabd9906efd166a5e300b69b332eff0a2f13fad7ab81b6075147de5620688e337da7b5f5fed141b4cb1debb85770bc1f327186dd77b35b12074dfa27d6d9
SSDEEP 49152:c1hpsNoJpF1A6BU44CwH7R4xaIk8x77AA:cmifPkRakk
TLSH
T152B5BE13F2D900E8D05ED178875A9632EA62BC460B24B6DF0A90B7961F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2bd167424682b6ed085b9925a03bea14c458044a07921adc5412c92a62b8f0ed
MD5 124d6fdfd06a7a5b0479479aa805120b
SHA1 29dcbb090876c12d849c8911306423ecaf04cf71
SHA512 072b55d05784b478ede2cfac0bbabedc8185799750efe0d946602da7cd9b266ad2e06ad8782e1c8b6630a86126968da1e56048d8c037c3f6a0bf3ea410babee7
SSDEEP 49152:WSuZQIY0Be2KNRVtOnks6NMHqLIk8x77AA:45dKvi61skk
TLSH
T131C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e5a5cd557ecf6860b6baf61140ce662e1a5abbf9bcf52e25c53254181d520e54
MD5 7c99b6dcb0ddd8a421e65f88617d40f2
SHA1 1af888b186d5f61c6b23a4ccda7e9f39ad0e68f6
SHA512 5ba401c43c7212f3ea49abf1fc731b2867eb0d0cdf20a22184ed67cac61a198c0dd16dee5ece9ead65185af26a86e662725314605aa0b36be67aadd1f6e50d1b
SSDEEP 49152:IhtSn8EApI0figXgiDn0AP5wmIk8x77AA:ZX2iyphOkk
TLSH
T1C695BE13F2D900E8D05ED178C7468632EA62BC160B25BAEF0A50B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 a52d47b048224ae81f1d56df67ed81bf5f49d323d2b2bf613c9e81f88efa986e
MD5 5192ec05b520d114315bf889ae097ccc
SHA1 82f639efe92b077b9b64ad67ceca39251cc73574
SHA512 acb4566a93b70264c437bae5818caefe262e58f0be75bc042940e09eb312241d3a65eeade1530c46d6c572b97e70f62fc54069f9428ae221a154b5ca3fd4c3ab
SSDEEP 12288:EiBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:EiBERIk1k7c+vDqGJAAg
TLSH
T1214523450D5E18B6E34289F8C3CD6A8ABD117C5EBBC261E31B09772F19B24DCC4D92E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 7bad03cdee4c80bea1ee09fcbd2c23d44e4ca4637a0ec80219cffa121f0e14d1
MD5 8a29e8088e04d2358f62194d0db91a40
SHA1 6a477d256e1b4d706221846bb9813c92a1d24995
SHA512 0aeaec92caad3bc8adedb4d266e6867ad0c52a25b46055108341947dbfe93c6f16f1d7bd9b6402564e335da3d149025a8fad4be9244041d4530c7abfa78257df
SSDEEP 12288:qlBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:qlBERIk1k7c+vDqGJAAg
TLSH
T1B94523450D5E18B6D30289F8C3CD6ACABD117D5E7BC261E31A08772F29B24DCC8D95E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 79a02be9f16de86a64b2bffc2e9f1905ff49d80e23e90a435a4d8fa6954dc535
MD5 6732ff1ebfca34105844c7854fd823c9
SHA1 fdaeeae1a665919e534299f6c3c71ba3000a0f8d
SHA512 c2f3a3970766f6aff2d5deb6337ac15f7626823fdbc5220502f5f4df668d3f71a3b318b6f5e393d0d7011f3da9327c6390b89a62b808e60dfd1cde7faba5f26b
SSDEEP 12288:/PBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:/PBERIk1k7c+vDqGJAAg
TLSH
T1264523450D5E18B6D34289F8C3CD6BCABD117C5EBBC261E31A09772E29B24DCC8D91E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 5611f5067a3e27de063ab458cd8c6a3f375a01d391a6ac081a98b0ab081660fc
MD5 27352854ab175673d2982c61c6509580
SHA1 5218b66b095e259294f576d7d7a2ae69d7efc90c
SHA512 62148f427e89cf3e104ffc0122a1971e390676c2985343dbbd28c70383098ea57b621b9bf92f4b05c27838204688ced2ae94da8e480bf15ebd28d966ffeeecb9
SSDEEP 12288:/VsBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:6BERIk1k7c+vDqGJAAg
TLSH
T1ED4523450A5E14E1D653C5F8C7DD5685FE31BC99BB42A2EB4B002B1F0D722D8C8B87E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 e50a5ac491d58dab95cd49de2f4493a00bb26ecf6db7cacee47c4f162e174ac2
MD5 ce144f05c04743d482aaecacf9e60ee8
SHA1 a1ccdd3c3c3e99b9bb92c41d45444bd6ea194c5b
SHA512 43c5a30d787111a978accd0e0c7c10d81d09761bbbaf71aaca8ca70638b7913cc4c1b949239fd91182341a29a1573bc7f0bceafa5528d6454d3ad057a91f8c0d
SSDEEP 12288:PEBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:PEBERIk1k7c+vDqGJAAg
TLSH
T12F4523450D5E18B6D34289F8C3CD6BCABD117C5EBBC261E31A09772E29B24DCC8D91E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 7d91df44f7348b24aa81dc7dee79b207858fbf1adbc034349c3921bf74546eba
MD5 9c723af93c8472a0f1a42ca6ffcd3d56
SHA1 d2e06d06a9e04ce6f3c6f6afcac04c0c2a6649fc
SHA512 5e531502af1c12cb28190760e9d80c10f2cd030eb78b999d15da8d1ad6042ffd9ab0166dff043dfc075f0e81abf7bbbce8a18435c7d7be3a49e7f88deb8ab177
SSDEEP 12288:ypBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:ypBERIk1k7c+vDqGJAAg
TLSH
T1214523450D5E18B6D30289F8C3CD6ACABD117D5EBBC261E31A09772B29B24DCC8D91ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 c58a8bde15f8931a9e1908e5c6311aef8bb3170ce137a526263c8fadf818d6bf
MD5 d57b76c89a1eeb317b24693766449a0e
SHA1 f8e3ddc1ad1600772de4860737f44c51f73f3054
SHA512 de9c3b5cd5a20a096b1811944f9a86a61ec26a78678f18409ea857b34403b6664a380a36841f8c37d24a37542a48a0f20c64e3cd13299b1f6a83d2c0efbfc65a
SSDEEP 12288:q9BEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:q9BERIk1k7c+vDqGJAAg
TLSH
T1AA4523450D5E18B6D30285F8C3CC6A89BD117D5EBBC2A1E31B09B72F29B24ECC4D95E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8fe089c71dc40008e0a09884828520752d3d484fead78e15e580be419d2e5fa2
MD5 dfdf288d0a7ac3bf8b18d58df559cb17
SHA1 69a9189ac35bfd3cc075a536a0bfbd419dfc93ec
SHA512 7a438f972e1836001abdc7d46020a827f7bb8f119676c45ac9d9f35e20cbc7e62daa169941a33515e8465b9fbfc386935cdca57b5812400751dd618c3dd4a15e
SSDEEP 12288:3iZwbvzzFEoS2cPvyFBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLt:yZMbzFVSOFBERIk1k7c+vDqGJAAg
TLSH
T16C65029573941CF4ED63817DC9599906E6B27C5A1BA0C65F03A4372B1F333A04C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 ee517d63116c93baf656d07c2dff4e8a77bc08504de9d325070ade68a784f10c
MD5 c16bfcd6cd80617fd9649ce5a72b2f69
SHA1 3735319c8a91b6ea4650fbe16ba9b9dfd4ca59af
SHA512 031b4b8e868df3fa7a01cd9fd5172688373ff6c571045a406c5eb8055ccd1ab1208eb271e4efed85ee518f1dfb2cd6c798bc0913be986c889237107e8a7e1b04
SSDEEP 12288:N+BEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:N+BERIk1k7c+vDqGJAAg
TLSH
T1FB4523450D5E18B5D34289F8C3CD6BCABD117C9E7BC261E31A097B2E29B24DCC8D91E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 ad74e82a7a588f4225e10f6b84800faadabe4b58bf6831166afea1624a6b971f
MD5 ab4210e12f7d00c2e0a94e270d716ec0
SHA1 842e5bd55919ac0a7b572456f9cd1723532c45cb
SHA512 a624b97e5fd4fca450f332c59bd21f0349a094d1cfbfd5213ff97f7995c804249d71182ec495329de60d06129fad0cad64d18a93962202861c6bce5474fbef54
SSDEEP 12288:HKBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:HKBERIk1k7c+vDqGJAAg
TLSH
T18A4523450D5E18B6D70285F8C3CC6ACABD117D5EBBC261E31A097B2F29B24DCC8D91E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2b09c7a36535ef19cf7c1357a9e6de4d4c4901c046b94810da1dcd5e44efc095
MD5 5716f7270826baa76f00b40c356075e8
SHA1 df800f0a0f5081418fd1580c6ea6bb4e31316df6
SHA512 0410325ecd9ee8c53cd087e394dc050aea635e623bea88cfd19afb3aa3487999916a3f53fdbb5a76c9938e10895d766aae0621a96fec666faeb2d75e03d2e5ca
SSDEEP 12288:PyPz5L8xBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:izyxBERIk1k7c+vDqGJAAg
TLSH
T18355120727A930F9D1638278C9951A46FB72B83617519AEF1764173B2E332D08D7EBB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 2693b928a636a778cd5e0a051fe1908705e216158c28b6270ecfc40003979986
MD5 a4224c4d4f4e3bfcab81c3114f708875
SHA1 a7c3d79e1fcb6699bdb786a5fd5da94f4314b75b
SHA512 decd0f885804cbafb06a8e36b2f2f2038d95f987038c126ea9802ce816b2b5bd6108244728a742aa0408ef4570ad1ec27c55b882d1eabfbb49eb17b0b6186166
SSDEEP 12288:i+BEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:i+BERIk1k7c+vDqGJAAg
TLSH
T1874523450D5E18B5D34289F8C3CD6BCABC117C5EBBC261E31A097B2E29B24DCC4D91E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 6a315da58cc0c31013ef9989532cc8d7a6f3170736c56ccdbbd791f960e9282c
MD5 95f692f0f3a5e39e27682c3ed0c9435a
SHA1 d80d85851ce2a468250fa33ec8a64676010dac2b
SHA512 887d2ea4389d4e49b5f3501e468052bd85700ab6e699b4f15e2eb174161483152b7ae15da6ab4d5e3e59fd4528f74af817d62d1de67966d29c81ca0f0d3de2fa
SSDEEP 12288:e+BEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:e+BERIk1k7c+vDqGJAAg
TLSH
T1184523450D5E18B6D34289F8C3CD6BCABC117D5E7BC2A1E31A097B2E29B24DCC4D91E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 6f46c8b379023f204c15b59123d9d72227addf843e2a398ca13487ccdf38c920
MD5 e1585ec24c46a6e46cadb723a2686e49
SHA1 faa769efa8d0bbaba392af46ebfad64eed837e8a
SHA512 c37e1888865aaacdb852dd568e7e4ee2275d9ccf8e9fd00deb051fa8c5ca2dd28460cac77076d61a3b85764d67fb8b57d2f75355c8c87fe4c61dbc68417f9976
SSDEEP 12288:FyPz5L8xBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:MzyxBERIk1k7c+vDqGJAAg
TLSH
T14B55120727A930F9D1638278C9951A46FB72B83617509AEF1764173B2E332D08D7EBB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 701ba655275d719cd6c72866ca95388407c820d6a9d8a8b5e7d39657bd4f6af0
MD5 6373fdc2ee1d07acb16a518f0306694f
SHA1 10658bc72f36a25bd479896def8cd7edd60322b6
SHA512 450aae86bbf221c93d2b7e292f140c7d7349caa749a5a466be5df0c704ba0dc54c1a0f30e38d2487657c625f284336cdc35295f1ebacbf97e63237bce649b243
SSDEEP 12288:QCd9pWYoaLHF3z0z04PDvhfBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jHm:JTYaLl3z0zDfBERIk1k7c+vDqGJAAg
TLSH
T15765029473541CF8ED63817EC9559906D6B27C5A0BA0C65F07A8372B1F333A14C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 a4b460eb801ed4f6eaa4a714c8e94c77946372001b9d3316c0091bbb62ee7cc0
MD5 fb9ed7da0566cac847b3fc17ea9f2fab
SHA1 01dc1431eb18eac870bd190347366450f52ce1eb
SHA512 a73b14e93f13a500bae9ce292b3b7c934ab0aefefbe3479924e9cbad7aa3cc1b26ec4c2d19100078d7f4ad540c78edd13c1f4f775d89589c9f1d9fcb60db93af
SSDEEP 12288:Vi4e7jRdTfgwCHKy7GLbbdIvYBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6K:V3cd9CHKy7GZzBERIk1k7c+vDqGJAAg
TLSH
T19875CF90F3E814E8F1B3CA75C9765502DA767C5A1B61DE8F03A8261A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 e9dbf993483022eee52fd0130c18a104f4a7eb768a75c08b3e21ada7864d7639
MD5 27bbcd5f7b89ed32e8af951608c098b2
SHA1 1711fa1d1de07a92795c5a0e3773b3083ea8a09a
SHA512 bd4e5e6fda562099928284e9df51170b3e6a779b825c340c738066054e699b01ea537d6ac6cb243af4afcb3406c96a025c83dae6c0ef8035f9512c9b61e51ce5
SSDEEP 12288:6vBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:6vBERIk1k7c+vDqGJAAg
TLSH
T1574523450D5E18B6D34289F8C3CD6BCABD117C5EBBC2A1E31A09772E19B24DCC8D91E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 79bdeae4190e6a798e6e750e670ad3a4c854e5514348281f4c37b7b0f76e9256
MD5 be0de824c3a95e04b22e5702b089ef0d
SHA1 e43724df5be2aa1f47f45ddc856dd2c6f66cce53
SHA512 d15ec81452dbd73470cf6afdd1d451e95dcd5582fee2c5a93e1d982f31744f21beb6a87ec6957ada11b3fc4acb26d944fa35d5052910063841a68e5a9cabd653
SSDEEP 12288:pRBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:pRBERIk1k7c+vDqGJAAg
TLSH
T1E84523440D5E18B6E30285F8D3CD6B8ABD117D5DBBC261E31B097B2B19B24DCC8D91E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 b100dffc0d9cc32902a19bb74ceaf95c8dce614b4cb9d61f7ae043303ab9ebe1
MD5 2b1e62f10759f0f9646c11426902d5c0
SHA1 c3410dcbecef9eb354db6269949537cf22ff4fee
SHA512 81951bce049fbf5e182c127be20be20d2dd417e0e6d24f3ee9d576b46b4660c1ad2996f90d2640d1a5793ddc675340fc69cc71cb1ffe18d5af0f1ca0c34e03a9
SSDEEP 12288:zYBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:zYBERIk1k7c+vDqGJAAg
TLSH
T17B4523450D5E18B5D34289F8C3CD6BCABC117D5E7BC2A1E31A09772E29B24DC84D91E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.1MB
SHA256 f0ba6ad83ba4611ae3aab6fc2453a010bf84b8c9049463af87c4429e883b7b1d
MD5 4b626331d7595a8d4c2f9877755a8fec
SHA1 bb307b5e9d8e2b21731d113942772d3b1c64026f
SHA512 177b4010fb191a01bbebe9b6f1440463f6a98ca05b8a4f0d5e352ff23987147a558fb66a8302052869e1c8f9f1209f06580cb649235af5ef219f706f1a6e75ec
SSDEEP 12288:M+BEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:M+BERIk1k7c+vDqGJAAg
TLSH
T1504523450D5E18B5D34289F8C3CD6BCABD117C5EBBC2A1E31A097B2E29B24DCC4D91E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.1MB
SHA256 784040bc50ac27cab20eeb8ad8b378d7c59a913af6430a37f02512e703574d4b
MD5 315bb2024b93258c9de9ca483683b6bf
SHA1 b85e41aa30c72671fcf2495095bc8ef29fcbb33d
SHA512 ea95e4249f405dc2f1fd44cfca294de5a19e7eaac987c0a0920fae422e94828d504426c6223f3a0b9e9300bb0c021266651fdf1f6c85c01fdcb1c78256614985
SSDEEP 12288:uvBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:uvBERIk1k7c+vDqGJAAg
TLSH
T1B74523450D5E18B6D34289F8C3CD6BCABD117C5EBBC261E31A09772E19B24DCC8D92E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.1MB
SHA256 445a2b51e80dbc439fa7576abbfba1f5c72067c6dfad4e0b1ef71906e66f3466
MD5 367221aa32fa28860845193daffaf16c
SHA1 15cb3b12b444426aa028384f4e23049a3868b9a8
SHA512 b576cba55fa8ca7d79b7821399cfb04f3de8485ed459c327d728f6e00eae21e42055f454e6b77f1e713bd7d236642cf84ed8538b548406d8cc5a7e40739bd18c
SSDEEP 12288:zWBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:zWBERIk1k7c+vDqGJAAg
TLSH
T1074523440D5E18B5D74289F8C3CD6A8ABC117D9EBBC2A1E31A097B2F19B24DCC4D91ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.1MB
SHA256 784c580fa9cfcf9ca402a488aab93a1218275f3b73087a5e45fe83fae6e93d0d
MD5 41a11e0146104957ed00d7a0b7209546
SHA1 d9d39fe3dffae9f574b757be95e4b9f7fb7f2709
SHA512 4f349daa62367d5d8a120eb633833f2f409d42b60bc9db96d8812f2077a905f36f85c63293e30c6a5f3790aa8e3818536fd7698074524cf81d67b2dc3cb2c738
SSDEEP 12288:UEBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:UEBERIk1k7c+vDqGJAAg
TLSH
T1A84523450D5E18B6D34289F8C3CD6BCABD117C5EBBC261E31A09772E29B24DCC8D91E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 c87c46ec93577b94c019ef60f877a27af1ee59add2290cf970df45ba47463de4
MD5 faebfc5a4b9b11b84c103b4fa06bb450
SHA1 607ea95c7bde442194f1e3045652ffbd09f8b3a0
SHA512 6f7a5a6e3c70c85f7f42d35ee44694b3534559f5db721023d463bb315fb3aad2e47effd15b6159a8e50504e9bcab6ec41b619166cc8649a0fb7479bf7a2b59f2
SSDEEP 24576:pfwvxk9RX6wkyAI6BERIk1k7c+vDqGJAAg:mMnYIvIk8x77AA
TLSH
T14875CF29EBDC04E5E1B7927C99E7460AF6B178691B31C2CF025A536E0E33ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ae3b3894033020cf781562c18729fc0a917371c62cd2c879393a8a76d65d81d4
MD5 24efb6778ea67102bbdaafd25d4c4a0f
SHA1 06f0645ed5a6f5a833bb4e1862d2191b4ba82338
SHA512 e51745bdbc281f886660d84c842484701b7978f647a3c34d7ac19546b8a58d46bb370d5ce21ddc9cf66ea3d4f709d27e894ccfab63224bfd433ddb6a946ab57e
SSDEEP 49152:SYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0GIk8x77AA:uySzP3kk
TLSH
T16A066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9b066fda1374b45ef88d2bfde78b73c50a0922f9e195d65ffe740357536a6bbd
MD5 89a3aafcc76f7d4a3ffb2c1d058f8084
SHA1 c3b421f3b85808a5ad532d9ce378e0cfe088789e
SHA512 ef81fc6c995877fd6db071e7038d75bf754295af03adfee813dd7e6ce654e535cf50d0f72f58afff4323ea6e443ab663b6aabdd0f1cdc7d78272bb97ab42b06c
SSDEEP 24576:p47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY1BERIk1k7c+vDqGJAAg:p47JUQj4irIhCnDHUPfF/WIk8x77AA
TLSH
T10D65AE1DA3EC01E5E1BA927885554A5AEA71742E1F31CACF1270837D6F23ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 42adaec9ff974fb70745aa6495da5f38621f43e24e3320f808dc3521acdf56b9
MD5 e2f69889c5a1f33d3b02030f21e367d0
SHA1 01e4b9682bc0c5ec25e374ed2bc93ff8c4d75b35
SHA512 ba4f39379bdcd91fce49bed5ee333a86817d23630eb36469bcb794e9c86e67e5e7e7237c6854866e909907d64b013fe6564fc4541ca03d4a610e7eac257da2c2
SSDEEP 12288:xRsfOBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:OOBERIk1k7c+vDqGJAAg
TLSH
T10D55F109C29801E8C16EA1B8C7895A41B7237C6997D1E3CB17C0F63E1F766D48CEA793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 f74572bbe36be2188fb778857e1a5a42f39aa9fbe0a89c04ec9f11003c179fbc
MD5 9d0419cceb8c6e27852ac069f104d404
SHA1 72e3beb5393886718eb199d2c62c4bd2d23e9823
SHA512 cd0ccaaa09a47733988af425d503af5fcf288e83aff609023ea9716aae5be5d24a99fe62a2dcb1d200cbe48021bf616ed65fb1c245e9e0e14ca4a903adbde984
SSDEEP 12288:HX0QU3fzykU/YSwXVCp/vkdSgxN0cc266pLd:HX5UPehXNk0KNrc26oR
TLSH
T1E33529417626C74FC66D80321E32D1CCABB07C11EE45AF0773C8973F9576A58BAE6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 30abe95663f02ce051bcf42879228f7ca116e8c7d53822ea7f30e764d01f8a88
MD5 bb7de1bb8ec5a99a8cf0c3e02121eb40
SHA1 fcd7b540a9fddefd2b2b2a763a6227fe9bbc17ac
SHA512 ea3fc222e3cb964b230fdf4b12d48b615663a483d21dd2f5f94f983d432619bba6af2b11a4f9a3207b87f6a56affd7de0bb1fcdb45d6b4a73915e95345de2826
SSDEEP 6144:cJ5ZHfdm0Nw3SZGHad16A7q1qWmjoTqPf94azhMlSqtMxXSqtMx0JoBG1T9pCTyZ:Sfdm0N/ZG66A/WSoTa9zhM69iMn
TLSH
T1F965E9415137E3CFD1B76032072A5B8D77A4EC03BB096F26B388453AD86AB55A1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 ce7ee5112d4238bcaa013139669a0d5f9cc790ec26f2f20d51a49921bc53c4a6
MD5 cdc3ca8ec0306f952ad3a6102b5ff01f
SHA1 c52077e7a33020daffe704f9d255e6f7e8a901a9
SHA512 a3532b84b9f64af39ebae6d6f8b58e373484940eaffd49887dcc91df9d9e8ba0495003463802a80e4f4c7b0ade589136d1e375108048eca596a1dae01b9a375a
SSDEEP 12288:ib7mBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:4mBERIk1k7c+vDqGJAAg
TLSH
T1074523010A5E1CA5E66399F4C3CDA6597D12BD6C6F81A0E36A04772F18724D8CCF93EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 908b7273b6c8ddc7b5ebe0106e50549f0b7597386152b2c55d717ab4e36c2aad
MD5 78282e333ab4d5f6e4b795d500bed8be
SHA1 15412dbd89575fe66f10b1dbd448b6972a98de4f
SHA512 1fabd1f925efa7ca39e6184aa21b9e6ec82999240b955942491d8a96ad5cb0d53d1995aeb4798973005a8deb91cdb06772a3dafc0d247b4459704ec85e754a3c
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYgBERIk1k7c+vDqGJAAg:Tgb4mBIBhGF4Ik8x77AA
TLSH
T1B565AE1E22EC02F5E0F6D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 66752d7a67b0f1b0a770ffec4467011f2dc26b38d8432982aa9297364d9e6d9e
MD5 ab5f5d95e7aad4c2f5c5453ed17f7070
SHA1 6075f03e6219a6a6c257c9359a029827873aef94
SHA512 463a8f8874a58f8e35ee9ede0b8cc741e260e079b84c5086e94aeda7a79fcf098bc61a48c3cd3d08fe6ad2752d562f530021d5b25ab1e511e644bc1f6ef32c3d
SSDEEP 24576:kG88u8FpJqH1vzria7/mFBERIk1k7c+vDqGJAAg:X7ZFPqVya7/FIk8x77AA
TLSH
T18285016567E501F0D477D138CA864663F6B2B8250360EBDF07A88B561F33AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 a6e32372bf84a53b657ea99753eb813c8e2baefde61ff2363d046a9d1b6e487e
MD5 5b05f1e019eb79497dabd193c35a0469
SHA1 de85f5b6d4731c089c547a1ef2dd144847f3f61e
SHA512 3a033e86d628e06b123c0cc9a028fc57715f509b7004dfeef616cd523f34e485f8211961704dca92ae38026a92dbb044e51d67ce3de59aa7d4fe0e2ce381acdf
SSDEEP 12288:RHvUrBFrEjwaQZBEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgV:RPUr+NQZBERIk1k7c+vDqGJAAg7
TLSH
T10755E11F26AD18E5E676E17CC6868709F771B4661742D2DF0290817E0E73DE8AC3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c619f75ee9165d179dfb6685604f8bed2b75331396651617a7a37daeb1bb7728
MD5 2a4c8d0902305c3f0fe128c156f4cc70
SHA1 ab216470264b712290f9132a6d275efe6c70001f
SHA512 d3cc1bdaeac182a7c4e01c29b36f4ee99d1bf3fc676451a2d7a66cba36b617934b25e8d717a2fa1609f83c03d050ffa694b934ab207b3c9f10d3b9566f7558e1
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkIk8x77AA:oG05lO43bYkk
TLSH
T109D5C06E62EC11F9D1BBC17CDAC64A0BEBB23415032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b974ebb00af2d52e06797ac54afac2762c913ecefa117a92921cb1b898ed2efa
MD5 f2af7073aedb517dd96127d29bace9ac
SHA1 9f8e93d4d57caf5cd24cf328f8185b755ff2f99a
SHA512 56324902de57bad0cf504eb7d1e1f1864002c40a6c245a684ba10c37a81ecbc8f50c87adcce1ec4d925441ff53d8fd56e88c74273b9b65ca92fe1d7f5a1208fc
SSDEEP 24576:1fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnrBERIk1k7c+vDqGJAAg:Va5POZ39Jt2pasx2+mcIk8x77AA
TLSH
T1E965BF5EA6FC01D5D5B9D17CC583861AF5B1342653329BCB022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8c0175fddbf054ec7aba92a6b9ce3c78b98caacd1a559f7850627e1d231dafd8
MD5 b80867e871abd839b0aecb1dfe2245a1
SHA1 165460c5eda587339604209b646fa84c21cc6268
SHA512 7efff757b1c409b832663bb3bd86d52650f50547ccfe7b4c909054d5fbf2d3b71015d2e749176e4825352e55f8f7ca162dec25293b75eb54706880243fe2c5e7
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7FkNBERIk1k7c+vDqGJAAg:LNc/zEOVHFlIk8x77AA
TLSH
T130858B1623E901E4F5BBE1BE896B9546FA717869133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e6aa93ed25eecf130ef1df35acf77308fe12ed15742dd35da1f35079de0f5c8a
MD5 f68e13ee3ff7641565dded82e0d99cf7
SHA1 92293761c8883eafa7fa856c9f32efe7dd63dd45
SHA512 d7f2254d758407a41fc79be3af2152480c22a1fb27025983a80be787797db3bd7fea2fb38253f85f8e1ef151348d6f91a281acfb09833439b9beb9b90ff09e49
SSDEEP 24576:2tkNvNnaFeYhJNtmZBm7ERIk1k7c+vDqGJAAg:2tMwBtOmAIk8x77AA
TLSH
T1AE55AF6EAAB805E4D1FAC6B4CE238512FA727461173293CB5390C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 477e15f384ae658dc3ae839eebca8f4db3e3d82ef1ffba948bbfa325abb3ea50
MD5 e2a9d86c43621a3a2cbcc752638a3fda
SHA1 d616f1bd43d4f9076bf50863fdba51ec705fc36b
SHA512 07deda54a50bcd5fd351de0bb4611a95c2b71c3c4a99111219b6a705c4ba1c1e168bb01ecfd6ead1cbf1603c3f2ae0802b134530d79026c21ceb3a8ce84a9241
SSDEEP 24576:RD3FHshBIYQgACBERIk1k7c+vDqGJAAgL:RDVHeBIAAnIk8x77AA
TLSH
T1D475E13DDA5C04E4E57BC1BCC6938A06E77138AD032266DB069481BA1F6BEE46D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2236-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2236-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2236-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2236-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2848-83-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/2848-82-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/2848-88-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/2848-307-0x0000000000400000-0x0000000000524000-memory.dmp

Download

memory/2988-44-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2988-51-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2988-42-0x0000000140000000-0x0000000140163000-memory.dmp

Download

memory/2988-53-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2988-55-0x0000000140000000-0x0000000140163000-memory.dmp

Download

memory/3164-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3164-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3164-331-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3164-93-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3164-99-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3164-312-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3264-77-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3264-69-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/3264-290-0x0000000140000000-0x0000000140158000-memory.dmp

Download

memory/3264-71-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3504-315-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3504-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3504-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3504-111-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3504-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3504-105-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4772-58-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/4772-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4772-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4772-270-0x0000000140000000-0x000000014015D000-memory.dmp

Download

memory/4808-0-0x0000000000400000-0x0000000000591000-memory.dmp

Download

memory/4808-8-0x0000000002340000-0x00000000023A7000-memory.dmp

Download

memory/4808-1-0x0000000002340000-0x00000000023A7000-memory.dmp

Download

memory/4808-14-0x0000000000400000-0x0000000000591000-memory.dmp

Download

memory/5104-116-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5104-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5104-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5104-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5236-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5236-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5236-131-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5236-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5236-139-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5944-314-0x0000000140000000-0x00000001401CC000-memory.dmp

Download

memory/5944-125-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/5944-117-0x0000000140000000-0x00000001401CC000-memory.dmp

Download

memory/5944-119-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/6124-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6124-16-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6124-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6124-23-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/6124-24-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download