d452da5cac08a04a073a4035885b90b9a7e2674e9ebbdcb0d9f8ab12b33c94d0

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
Size 1.7MB
Sample260730-kwmslsvcjd
SHA256 d452da5cac08a04a073a4035885b90b9a7e2674e9ebbdcb0d9f8ab12b33c94d0
MD5 3d5cb9c2fbebaa605be35f446e86ca43
SHA1 4f45c7348ff7a83ca27061cf4cc6361c1634a508
SHA512 a85a575fb1f76d7899ffe0ec0eb42ecb39b14b986cc3be17cd8485c2faef7f24c218d25ed752683b10e1ec6c58a61f985fd39ea44b794f193911df64510d3d84
SSDEEP 24576:hy3rJD1Ub0co7nQ/tbw/2Mkjy6Fr7g0oP:IdDy5o7Q/lFTjN4
TLSH
T1D385011571D9D832EE63267009E3C335A76B7C139A71478FAB583A0D19FEB930A353A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1072	elevation_service.exe
1232	elevation_service.exe
3272	maintenanceservice.exe
4160	OSE.EXE
5812	PerceptionSimulationService.exe
4104	perfhost.exe
4288	ReFsDedupSvc.exe
5668	SensorDataService.exe
2888	ssh-agent.exe
2680	AgentService.exe
5592	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4ed1163383806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000365836740120dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5f7d5b60120dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000dc430740120dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0dc03730120dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
1072	elevation_service.exe
1072	elevation_service.exe
1072	elevation_service.exe
1072	elevation_service.exe
1072	elevation_service.exe
1072	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
Token: SeBackupPrivilege	4288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4288	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2680	AgentService.exe
Token: 33	5592	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeDebugPrivilege	4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
Token: SeDebugPrivilege	4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
Token: SeDebugPrivilege	4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
Token: SeDebugPrivilege	4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
Token: SeDebugPrivilege	1072	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
4920	2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 2092	5592	SearchIndexer.exe	100
PID 5592 wrote to memory of 4576	5592	SearchIndexer.exe	101
PID 5592 wrote to memory of 2564	5592	SearchIndexer.exe	102
PID 5592 wrote to memory of 2832	5592	SearchIndexer.exe	103
PID 5592 wrote to memory of 2056	5592	SearchIndexer.exe	105
PID 5592 wrote to memory of 4148	5592	SearchIndexer.exe	106
PID 5592 wrote to memory of 1116	5592	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_3d5cb9c2fbebaa605be35f446e86ca43_elex_emotet_remcos_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1232

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3272

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4160

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5812

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4104

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5668

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2888

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bab2e82cc8c3074fe90afdad1e66747a4e751b3bafc20c278574cad539078661
MD5 32850547289ac06c40b1685f5f19175f
SHA1 832410036506381c95d0a8884c26f3cf8c6002f8
SHA512 99a55392242f494dd8552f468a76c94bb607c8984d8c9dc79cd80c714be63e7fd337ef181605419270ec6e211c6ccee82b647ca0b577fd25ca0ce6d2ebdf29ad
SSDEEP 49152:zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxniQ/lFTjN4:R3q6HjBGLm
TLSH
T119D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ba3ffc615b9bd15f03c59d40469477b5effd47f8637a5e5a556861912849d177
MD5 11c14972a0d1402f1157ee60a919dcb7
SHA1 82fe7c1aa63e7f33c38a5e702ad86cd4812f186f
SHA512 f45f3ff098927c161a9a67ce189b8037e25a0f730a80d5a58a480975b3505f4108fc9a73362ab6a9c475590dbd4a6342068f8be511432aa2084f02e6695d2c13
SSDEEP 12288:21XLsswWkxy2lRq2czA1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:0XYfDtczAVnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T19365F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 273ca6b5760a526b47e0a3e205bbe72edf831264b308931a5e5e21dc21852743
MD5 e20b2a027c50096180f267270ab4586d
SHA1 9e16a3a444a915462a559157bf90feed730a1331
SHA512 64907565969ab87a503219efc84288f721fa46f4f6351329c192902b9996eac914512af3362f1fa068df8fbcb99343903dcdaf073962755cbede805f368daa32
SSDEEP 24576:p0Le5ji0hmxLrMKnQ/tbw/2Mkjy6Fr7g0ox:pPji0AlHQ/lFTjN4
TLSH
T1E5859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 191554074743c6482061f7f9e2a39589b76d6811e48af046a70274b01672ecd3
MD5 71d9b3a7f5957a6a13f3ba2b1984f21d
SHA1 6a6f790a8e24d7e82ae78751b817ad33034c1fcf
SHA512 7411144e0d635d3d0ed2a3be021dcb5526a329966c03b1b40657bae173135e16a2beaca80091f27812fc3b4c088a4ca78ce41387f2886ba92f10bb406ce5ba90
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWE6q8wyuQnQ/tbw/2Mkjy6Fr7g0oJ:c/ezSC6vUzPvxHjybQ/lFTjN4
TLSH
T122755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0e57cff4b951971353918085ce3ef775a9e973c9e6ee7e20744f8c78d863bec9
MD5 5cdc2f9bc5ccfda70868379549f7ab6e
SHA1 d335092ab9625afa30990153f5fe185e1f9f4976
SHA512 b9d28670417a3bd9506c8771238f18956648344dc050a039bf0a19a1b502934f0e94c14b66a675e0fa3f3d1e6a9f0b8382044493181653875f950fda10b6f531
SSDEEP 24576:3VbqPb88hv/l+6xnQ/tbw/2Mkjy6Fr7g0ok:3VO88hXl++Q/lFTjN4
TLSH
T17D559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7e55bd99887f1842fbaf235f794e41f9de5a1de77c19f8f7ec6f312dfe62141f
MD5 5448e132c1caead5e3eb71323485d536
SHA1 c96d9b6d954a1da97ee3393673545743cdd0a49d
SHA512 7abc8b2d96d43ad7de7bbb586a3a32a972361f2319b1d10c32f1cae70316c338691078991c290b5568e372196df928d7671270636fb508396043a13394418798
SSDEEP 12288:Sz2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:SzWnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1DF5523796A24F897FF2B06B15CC284826B3B0EC1BFD4A74E6B44362D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 4dad55c91d76563ee43f2e926c7b76b04b8c3d85c6e8aa43d7095b554f233b85
MD5 bf6ba503101cfcb11038a906c531a2d4
SHA1 fee0c8744e71628cd20f3e8d6f7a48ea371a13a3
SHA512 8f33d545698fe552dcb78893a7d662630e9a7f8ab2d644df462806e85bea048e77b0aadb8fef6a8161c874be16d2fecabbd51e9b076e8afa994de5bd33439ea7
SSDEEP 12288:DeBNUbTVO86UpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:DJIU5nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1DF75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c147510d1e69a6b80f5fc90583e0bb6da54d8d73f188277064017ef16c5c0509
MD5 136a04e6aa744c3a10f3bef7f7c06021
SHA1 79bfc963680c716b11370eadadfa4509cd496a6d
SHA512 cb39f42146a2be3faa6e8bbe8794bf6d1edfd45c961c163e68835b5b4839a06be5fbb53a606dfd860aa6dd8ad1ffdac40093306d012c5be6bdf1c12eec19058d
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THR:rQvGAdlCEL8c/yRNw5CzLm
TLSH
T1F3267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 d936c4afcca21c0c8b57ba1d68a038d79578a20b8aec727868561f7ce9d68ccb
MD5 063430bc8e6ea31b58729d57902865c1
SHA1 a02a8152c3454487e3091766d92d945c9a6fdc98
SHA512 99cbd85b822f10d3b9472277d4a9b35cd34fef3cb1a38a0ebb20017b4668e7eec3045aa2e4dc627c4fe63387ad556e6b02d019b7c331b8d107684de9c9041b2d
SSDEEP 12288:WAwSfxL/2Dc39DLLmt0LDQewsAj3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgq:rQewsAjXnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T11A75E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 75d3c162e6a753e7283602420c6ba5df4d8521a7940f707f67f746bd3e25a7e3
MD5 320e90874c63a523e73286930c957adb
SHA1 65804091bbdd81f22ed3fbcb0a16714b83505f9d
SHA512 28d7a771961f42cb8a4b853f7c842c592d07cad0e25fc482d3019950aa9ee5dfca35ffc58be09cb1e0ad006fb3519e239b60709a0890289217ebca68f8c8ca0f
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHkL:JUEtQevvqc2W1cpV2EI32
TLSH
T1CB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 55391e8de2f7aa16c9e308265924c500430c9d1d7785a15ee7694ac114c65891
MD5 82ca2312a07648aac7a9b358d8db9450
SHA1 167f4c9d4e28383015a174a08262b64526bc18ba
SHA512 4991d4dd86a1919184a3996ff5a5bb5179731f86ca1042c1a2db97af82f77a6d312dd456cd2e34ee453e5e5b076c1bfcd0ac4d2d60d22ae7d5e54411b20ef5b4
SSDEEP 49152:OCbRquA/m2yL5zQfFiV+XenmE3/z3Q/lFTjN4:joqtVjnmnLm
TLSH
T135D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dac698e061546472afc5b3045da0196ae9113d75ecf9f9bd6f8f24a285fcc5d0
MD5 112706d97749c1d187817d7307cb2eeb
SHA1 2f0c96d0ab700549fbd75b714ffc814dc7d348f3
SHA512 3a6d349dc860c2da8df388ee98d5be91ee9744a1dfe4b1c8c17211a9d21544b90bcabfb6f7d08706277e489add3d25551d62343d5906a98379d5751845aaf143
SSDEEP 24576:4AhGLJIFoiwtA5l7S53UnQ/tbw/2Mkjy6Fr7g0o+:4AMyFoiq5EQ/lFTjN4
TLSH
T10535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 fdf16f8f519c48efaf652c80b6565579bd2cf08f3a83d1611841c56ee753d9db
MD5 b10ce84c27fcb022441ed68c430246be
SHA1 83eaab22a5b1f635d5b10090287fab69b0ffea38
SHA512 d88dfe9d8a56ecd47779c8e4be695c3ee9f418863baad95d4ed9c97dc089e6244275be69666535473c4807798ce2ac3f54681109a7ff1b9fb48b8c86ed659b65
SSDEEP 12288:vmw5HEjsChN2BFgl0WDm+CQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMB:OwuHOW7nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T13E65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9b52d10ef4cd9a25f12f19c8b2b82f68957f38a2025a95b0010880cb63d5d5ca
MD5 ced2640ae4b1e06eccde67a17599f362
SHA1 e8af3d53a0e6750761d83e104d99e807ee22133f
SHA512 64add1fafc3bf2aeee9f2d9b10a9cbd2261b426a8ee1d2077419d8e7036e5f8ade14d140205db308885c03244a04a244a165f3fa50bad950749f05057bb1985d
SSDEEP 12288:wXZ1IyHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:4ZuynQ/tbw/2Mkjy6Fr7g0oz
TLSH
T16755126A33A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5a11b41a8e4a9ab8efd8e74ec29a3a8f156aa4df2ef65e888bee9f867df39507
MD5 2424fecf4c7778a3c0178408c88dce28
SHA1 93b2f9f28258a2c340b90b2209fda941b8d2d7f1
SHA512 499869b9c367a78b28b0c58a51342950b88a54ce53aead963ebc134e4da73d6166957fab20d6683c3810b21fbb0393bf45248b0d4c0929ba44c2c05e3e9e9ee8
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ul:xQRQyi36YOcPQLvw2gAf+PN3yLm
TLSH
T16A666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ef4b3c25c20ebfeafe571b3fdcc82c7d7b6787ec10187d49059be1c02c1f9522
MD5 65e724a61eedcbfaac410cc64a927dcc
SHA1 4a5a9a9f5012660927a93d28d993b16ed54d8840
SHA512 42761fa07395e99402ee93a74f875ecb4c119fa12862912c8da4d214a93a9140a3d911b44929ad243ce84ef865c6b69ab3e5eb8820e58526b0b8c65c991aa93a
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ul:qQRQyi36YOcPQLvw2gAf+PN3yLm
TLSH
T1A8666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 603b7eafe91779bd0ab6b80c60b902370a239d14149f30e8001e2b1868daa3d6
MD5 998fe7688478b96cf26658ab5bb8719d
SHA1 be4a343530d069c8e07ebb6842883968f75b1542
SHA512 96afc177513914c832715ee6d1810a140164aac71749ca8c6b718064f1bb34edc779d0b773d1dd73c2ec146f44f655b3367274d659889471a6bbd5a625746eed
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0inQ/tbw/2Mkjy6k:g68Qg55nhheWu7PNU3/HQ/lFTjN4
TLSH
T158B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4efe08ed18c6cc8e9921f6ac26d40ac1d3e07959e24c6ce319681544aa54f449
MD5 95bef42a8a5e5d9e091228eada982aa5
SHA1 975b7955400f53f2e9fd470d12b49e9267136bf8
SHA512 a9550e63cf6e2ec45de45ffede9e845d62f5665a18ecaf567d7fbf6305dce7a12b332e42f24782fe30b58e1955acdf5076724609ee5f94400fdc5b26a2320808
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99/:Dy5112gYy5azzVvL69nLKnhZhLm
TLSH
T158167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 094ffe1d30e1a6355ddac44689390e506a68b098d02006194b97bdc7afcf7862
MD5 87f75bf0bb3fe8b1d9c6687432342456
SHA1 58488ec148a159a30b2f8d9a8159904e3977726f
SHA512 9c341a2899a9a7dcb0f726d52ac438cf8da10e913a5d722d663da14f1ebe7333046a8ffc27c71b2297cf904c602a8f7d15363afa009e94c27b0c09d0a3695c88
SSDEEP 49152:RB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glFQ/lFTjN4:Hu6JmVxd2dqLm
TLSH
T153D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d430312a25b4a8ee78e38cf53a755ca9c136da7953492b293e3bbac29da0a49d
MD5 6de005573726f66ef62d32c692a4dd09
SHA1 66236d0b8e30107036cbcefddb938d5d1a65fb83
SHA512 1d2b41b7488b49fe912e3863404bf493b0b71ce81f6d0a363ea5eaa2a7a6287ba8b17eb376d9e89e57fae8bb5d877506ae6c77c21365d7bcda26daa8ffe3d08f
SSDEEP 49152:r1hpsNoJpF1A6UU44CwH7R4xZQ/lFTjN4:rmifPbRnLm
TLSH
T122B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8ac474bed559eeba2aaaef342d1ba816b322ff0a53ad1836055a3af445d70647
MD5 a5d3e3f337b13cf8c1bace220d597b5a
SHA1 4b4f5874f238d9e7b46bc472da59bebb49321355
SHA512 3e0395a7c6f1c290d9bc9e4e7b62bef3d8c73622f02ae78eaa6de9eafd02de010778c3cf0e10390ea62b87ab0c11a127a982e241518df177840ed0045ce91ef4
SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHqyQ/lFTjN4:x5dKTi619Lm
TLSH
T11BC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c452dbd9d4910d3a5174bade4b77dd332dbf5e6a889f9754ab4fc562b559d8f4
MD5 4726b6a76a0dce33a01395ad2880132c
SHA1 147935b6cf7ceda406433bc3145bffa6350e83d1
SHA512 bdd3881e0d845db9196905094eb8b20930bff9823aecec7242fb37cdb4ce411d2f7113a0185607de22a9ec01f1217ea75b55f942af0f56c6cdb5cfbd0035abd2
SSDEEP 49152:UhtSn8EApI0figngiDn0AP5wVQ/lFTjN4:1X2iyph7Lm
TLSH
T17C95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 51717ba4cf1d8b29c1a565804924afee90c6fd1f32d036eb6938663dc86b92d6
MD5 472bed5de16de45d393130e101e3830e
SHA1 a69df4afb01b6bdc2d36f84cd2af6ab184e3e3ae
SHA512 4fde3bba8ac3b8b2e275419956b5202ec01b612ca0690ed51ff1ddb1837a06753add9af12f03521ebb5d6db642681e27ef225ebec7b65f37d0b86403ce36b1c4
SSDEEP 12288:W+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:W+nQ/tbw/2Mkjy6Fr7g0om
TLSH
T1A45523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f8103abf87149f37dfa9ef1c20f87387915cd52e5fe642962b7cb7e2b96944af
MD5 f66ac623f33586fa18b25407b79b55c1
SHA1 c907d08140285c4b03bc0c8cd82016c7ea066b2a
SHA512 e7302cb34c5c46be75f5d47bfdb2cf7ebc98628213aa6f0b407d49b10e3e6643c0ce525658afa9c118c4961623f94a2a2b5288ecf2aed42db380e61353987385
SSDEEP 12288:ODGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:OznQ/tbw/2Mkjy6Fr7g0oE
TLSH
T14F5523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 aa66c5ea1ea67fc94e5cdebe248ae59511e44f704cf21a9d161921b7f5e64f53
MD5 b94350a0deeb38a6decd074f010cd734
SHA1 b033d8466959eae2498673d1460caed035b03351
SHA512 8fd9d8d99f04bd412723d30583bdb9059dc6b5e41a181556996c3f9a31bd753028524bc596c9ded58459e0fddc1ba9a09ba1c5f5a5e2e6f2c6c9d7c5120ee8b1
SSDEEP 12288:IRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:IhnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1325523697965F98BFA1706F14C8381829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 376862bd872a87f9ae0eaffb0d997ed9efef2e7236b51c8a07dc00fde6bef4db
MD5 c7dcb0b9c743759c91e7872b2d6e1f6e
SHA1 638e3e6ecb9c51e7bd3fed2889cd58aa24e6f744
SHA512 cf566ffe0482deb48affe349be657738d0b941f2ed854bf8d06e22d09fe63a469438a34552068781189ab85dba1c4fae634aa550d274f4f6d5ce45a00f286b39
SSDEEP 12288:PVUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:GnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1435523693A69F4C7FD2742B4CC928142E77B3DC5BBA1A38F6B04111D4E793D41AA5B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 328e536addb8f177fd042c02423b3cb139c4ba7ee5951c8d8efa2b1fadb446ed
MD5 4f224bd359a1e894de26d952a06b58f7
SHA1 22e9cff93950c5eebd34f1405a342ab1dcfb204e
SHA512 04c3ae85d2561eb8405be963585536d2738f9bf5e27c9ee3827283651fd814f5bbaaca14eeabc032ca73561c9f6e1edfba776e22640756f3f2a0a20fd9512f07
SSDEEP 12288:FsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:FsnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1E35523697965F98BFA1706F14C8381829B3F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7d797426841ff4bf0413f952753e10400a417cad6d8b7b4a9d7cd2a65f7e94a7
MD5 9740239bfdf9acd8cf9b4a9167ffa450
SHA1 98570017127240a2385969949488f652505524e2
SHA512 686a25e34a4de6287776b99b8f2273779178a5fd3d2de4cf4353a88b7061ef9264d3b79538f774cc457b0033fe611eed4877c5080266b987cecfd93ecbc0d5ea
SSDEEP 12288:DfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:D/nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T15D5523697965F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4eea6e70905094fcbf98c97446360d9ae8ba4417a4745313c73d50807209b545
MD5 da6e179d00fa94ea7ef024ae9420a265
SHA1 48dc0670e1ea6706deb669ebde12cf01648955e8
SHA512 d2874a584c4ea1642d4340ba55620782cce581a581e9dc85a1db74795f9b14464c390105a3cf433d2eef8629e8c517e9611448c1e97e103adbd9eb9570d81afe
SSDEEP 12288:B7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:BrnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1D05523697925F98BFA2706F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3e070b1dbd2b33c064c6c87155f456068d6c023db8ecc9a38a043e8326ff8934
MD5 17ca39e616661f6923fb864d8d22f211
SHA1 c4296a5fa6970faed3aab02d64b394306e862f59
SHA512 7753915b9741c6ec49c5fe6282e0666d67f63ff80ccf0f7460487dbc726a1f85d0f2c05f893c92e9ea46b1e46ee9515dd1da385f60b2997fcaaea4793c12fe20
SSDEEP 12288:JiZwbDzzFEoS2cPvyjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:MZM3zFVSOTnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1FE7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cbdda5941b151c4b33c628225c5a63849c82c22e865fb05756d48eb203ebe127
MD5 3a99a9ef2c0ebcf4db0f2fccf7e2c91d
SHA1 4511e2670ac99a56a410a965b767ccac171f98db
SHA512 7fae7493c6f7787e4f67e121898067cb59757876aa9a6bf5ea5ea06c9e698cba6b1dfc685706e3dcbc91536a8fccc877ea95dcc0fbb8d594e86a6865deb3e699
SSDEEP 12288:XCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:XCnQ/tbw/2Mkjy6Fr7g0of
TLSH
T13D5523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4948cfbb1c32ff330b2061d12b7e6780bcb031820f2671576583d760249dc4a0
MD5 7e5f40805bb8700568ad5e6e58e806ce
SHA1 23fb07f2369454a5f032b197af6b05898d23d2d6
SHA512 fa12a6b7c542823eafecd9f50c7c27d174fc50fecfc8bb296d44c0c46785c175f655b57ed8faf3ae85491b6c51afc9e5683d91a1478804c1238aaa1e15ed2029
SSDEEP 12288:6GGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:6mnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1A05523697965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 35e307d03036b8a2e440134f76e1e6222acae4b2269a3109dc6c6ee5b2e0740f
MD5 0088d213627c36d85df19341dda2d95b
SHA1 821aab424cf90141c0f2ddd0ad8b9a56e1a6c0c4
SHA512 e5f6e1edea13e18963f6a7c26ab248708cc2cc123ffca77f4ed22f069ea8eaa0994fe930e43be1c29e0b68215d37e8940f7faaf5bf514be9d0209b2b1f548743
SSDEEP 12288:zyPz5L8HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:+zynnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T16865021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fa7624b7b1dc89db0d64e654e9736b9b6d766485e2941e88c02a1843da7facb3
MD5 ba7d8d1b9aa04d17efbf668aaa8d61a3
SHA1 23845e3ba4876d64ede761f2be6389ba83734392
SHA512 920cd3f5735aa4f40f4f57490fd9a3e6635e9ac4b9a85c6298593cd0e8b51161bbcad7c272e0e767df299ceac91ec52f64f2d36f67ace8e6ce10975215d2f441
SSDEEP 12288:dCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:dCnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1E55523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f0fe1ebbddfc170bd927977628fb30fe73cb38a5c4275b058b117ac75478c195
MD5 678ebad23dc29e5965d9cd826872b863
SHA1 cf4db5ab8ca14c58591523b4d6ae37e99c45e08f
SHA512 9677ff572ebb982a74a2be999df4c4e97eb7ee4a425b31ef57b226acd2dd3d7604adc19bf6f4378f8eac360407b9022978826444ad0fe3e93ee06d83d9a70151
SSDEEP 12288:cCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:cCnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1205523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 49417335baecb7ee1bab2bbf30c9d89eafe4ea1a57debc1f1411d4c61f76a34f
MD5 0db266bfabac3ce71dadef73e58e956c
SHA1 26819565b2e54ea28f4ad9e2c40c0f2e0974f573
SHA512 18f24d34958292dee9624c196e2f99c3982f6e18b900a76a22b6278361b4930f49302a28d54849012dc7361885eebcb62b76ffd26c4fbb59aefb0489ecd7c29f
SSDEEP 12288:AyPz5L8HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:xzynnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T19865021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 28aa55836d40252ee605a5357ca24b606bd8a070b75d75a44a5bdf8a0034a020
MD5 2dd1db708a1221ec55e1f327f9b21ec0
SHA1 60f9e453df0e45d8498e717eda3dae891cb325a2
SHA512 32c17a279aae80bf613cede521f139b801f72b94e11cd64b012086ea148fd578da7dd20c5f5063866fdaa79fb08792cf7628b31fc925635951c78b7e907329f4
SSDEEP 24576:gT0aLl3z0zDRnQ/tbw/2Mkjy6Fr7g0os:gTDLljQQ/lFTjN4
TLSH
T1797501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 2f1f55ee27e9455617cf37fdb61550c0e7641fff44feffe2c658f328d3579eb9
MD5 165b37c83a37556077e25735a74ec91b
SHA1 c606c452b182e20f31d8e7ee783c3595df4aa192
SHA512 9d3ad5e0cd40ad04ab764b8b36233d621190a89fb659a1879e5afbd2de3bf29d0e25252a930868138624ac1b6a7a11bb7592187a183812507684a2e46fa75d01
SSDEEP 24576:D31d9CHKy7GZdnQ/tbw/2Mkjy6Fr7g0o2:j1d9CHKyaPQ/lFTjN4
TLSH
T13E85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fafb6b50026136d0bfbf0034101e4f14d4fde6072b995fa7ea50af9d401678e5
MD5 05580972740062b138b02f647f441e1e
SHA1 f23d805add6d007b9cf7c9a7db52cf0b41133a8d
SHA512 dd06537aa8512114f18df1c6a83a1dfde54d7ad8fc7628f928baf6b2787f49cfae7cb86e584190e068e481c1139bd1c3f6459417f1e63c790eb7e790ba34b0da
SSDEEP 12288:3xGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:3BnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T19A5523697965F98BFA1706F14C8381829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 642bc0c992c67b087798725baa92b319e01cc40989ce21434e3390fbcd57a074
MD5 6eb4059d72b3742660ab392070cec67b
SHA1 5338cad1fb4e9d8eca9aac087d713d551d9ab138
SHA512 68ceeb7819076bc24ead5944070e1671e2d180759701f835e71038ce215db3c42ed220d362fa875891fd26a652620e6d6e1da4d54c4796357384942d560017a3
SSDEEP 12288:MnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:MHnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1395523797964F99BFA1B06F14C8281829B3F0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6a64a236ecaadb1e07d80416580c003ded7c7eaa0216c7b79aad4b4dbca4a884
MD5 141c0fe19e1865ad00f1e30195a5fea3
SHA1 ed3fb1c36cf674012c0775b05c7021fc25e517a8
SHA512 82d98d334db21bb5b3d6701a8cdfc39101cdbf318c27abcd8bafe1a37f7329e23eaed5c424cc646118a0a17211ed521198eb0d87191fd18b0935d89284be3c28
SSDEEP 12288:2oGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:2onQ/tbw/2Mkjy6Fr7g0oG
TLSH
T10C5523697925F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b8bd5098ab467d249399c67c89a8f240312cfab6eff33e79470ed5bae4ba8e1f
MD5 c01e6fd6752d4b91ec14d846f9450482
SHA1 e1d1e8d53b6f0fe9443fa3ad714a1addafd741b3
SHA512 c82697ffda7d7d930b20321def060705fd930807a35ac3c4f5bd90aa0fadd5dcb1be25bac1bfaceda62c838957aea417033d976b4d076f6ab5d9240047fc036e
SSDEEP 12288:+CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:+CnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1F15523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 27606cb9c7dd8e3e3ca26ee3d59eecc352870348b4f2c108e462028ce3c20aba
MD5 924c66d7cba5fc6cfee995cf1053a29e
SHA1 4637665c1290e3a5d0fe001f7ca35c93c17b6f62
SHA512 fad9e8db5e23771beef3b58914a6bafe4b6a52e5f3c93b2b4dc59297212d749897d762d6a066eb46d19be17f8282cacf3595395f03bca477484ae5384aa24b9a
SSDEEP 12288:MxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:MBnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T15C5523697925F98BFA1706F14C8381829B7F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 87c9dd0599046cf96fee8e19dc93959fb5efeccf6e4551cb6d6e4a96a3dd45a8
MD5 4a12fb0b1311d3fd83261f79f93b8b2b
SHA1 475136db14f3d87c235925f2658b6931bf96f459
SHA512 d24c05c0a0f131320038b0c015f74ae29a8504847ec3c92ef8a3a5db115679e8922f57b04fa63519add52e9d5da810eb0b1359ba14e4e5695912c26e912502e2
SSDEEP 12288:W6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:W6nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1385523697965F98BFB1706F14C8281829B3F0EC6BFD2938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 303dfe88b6fc3d1379c047277d7364e60b2b05977974f5a089c974958ab31521
MD5 af950930bf4d69b7099efb5b7da5d754
SHA1 b171dc48a07e72c7795e717e2e6627f0447484eb
SHA512 f703bf49237ac6f0063cd7f4e826769114d53e26b404eea4922ddcb2a65d7f3c83ca7206c5eea256f8919023b2d4eda14596cc6c22a2e662df44fd1cb3ec3a60
SSDEEP 12288:OsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:OsnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1055523697925F98BFA1706F14C8381829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 c8b28b6be6a32a913eaaeafc5c40f1614dbd3f5ebaf5b394a3e59f19836d6102
MD5 74c97b56c38aed8d8a5a713505fc60bb
SHA1 f5bce66aaf2156becde9a01b14aa9de729e2ad48
SHA512 8fcae9e2dc84f9e82a7bef4f12fafb1906ef03330465c597fb2be9bf70952d6c42e3e2872dfebdc0cf202ce3912bdbc8b24f4f9d66793c6426a6c2f20b25d40b
SSDEEP 24576:Kfwv/k9RX6wkyAI2nQ/tbw/2Mkjy6Fr7g0om:hMnYI2Q/lFTjN4
TLSH
T14985DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 36c52df7afecea75a54c77d6ffa239430483e1faf2364d7d1e2f8c1e988f3416
MD5 38b97ffc6d7b5872b4da26bcf9c6b74e
SHA1 12a55b474443854969c6b67f6832dae487ae8d46
SHA512 f337a66a3d2251f2f5c8cde654cd2057917603d97f4c7e65bf154d8f5602135cbd53219bb0519df6b34addb691676601255608f4affb94a2328edea61e8f3d77
SSDEEP 49152:dYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01Q/lFTjN4:dySzPSLm
TLSH
T120066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f777f3b3f5552f7cd6c4a2a2313c421593cc13bf9f7864715fb5508792daf8dd
MD5 523c863c572f14cc673640ed8a2113de
SHA1 92563bbe772ae20c74dca466c9a2e4d17a5bc849
SHA512 b217f4a0971b3b4ef48d7f09cc610b2c8a0ab817a1aa1b16872547e924314354f5f3dc4bc2909de98fae5c7b7055db83a95f3de610780f0e93bc46c42a8517bf
SSDEEP 24576:r47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYjnQ/tbw/2Mkjy6Fr7g0ov:r47JUQj1irIhCnDHUPfF/FQ/lFTjN4
TLSH
T15B65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ebd590c6d3bd67acbbc5a21823045c0901640e38538eef2adeecb105dc3ed168
MD5 05abe8ce03d9cb8fcafff2e79782d415
SHA1 54d56925f83bf0788574c8015673f15faf9ac072
SHA512 b3616106bb4039d0f0596618439f0bbe48ab350e435da706b00693b0501d16faa18270c0e59f13549cba502729920a977fa38ac60a7c30b6fc7bdaa4154cc105
SSDEEP 12288:TssfyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:/ynQ/tbw/2Mkjy6Fr7g0of
TLSH
T16765F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 b703b2e5bea83fca9d2421bff20b6a75eb24aba1d6ccd933f43476806c6e5970
MD5 158f2451247450f02d166244c880b070
SHA1 4bfcc5c22c534d18cc33531b7e64f8d948a60844
SHA512 cf84ddddedfe2d967f8cd9b43890941483dfadce7b41cad8261d26c429c56e223018544ca88219a8a4f4fb70599fdd70558dbc7c3ca0a1ec62c3e2945fb086de
SSDEEP 12288:F2qXU3fS/6MnUfrQtZ3JzdYorraW1CmelkjYqqku4JfoI:F2oUPS13JzlXaWBelk0qHutI
TLSH
T1ED251850766AC75FC6AD40321E32D1CCAB707D01EE45AB0372C98B3FD576568BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 8ae0f75b9488d86f113b82a1291c70650eb05e71cb5640a0d3557f10499fa1d7
MD5 24165cedc62c106cf8e81d856f3a6082
SHA1 35fd50c588532715ea151d42fde8fc43fb76c9d5
SHA512 a8f0eab47b20d998bc60b86495c08878ecee2fa0056aa645c4241fdfe71dfe963d756ff6cea5fd7596cb6efd8433d53d3306389fff5100f8a5aa28e5f7ce0102
SSDEEP 6144:n4yjT1RYV0w6JV7/YxZuFxua3ZzcbVtMxkcbVtMxm5X9p27SatdMpcPwZ:FJV7/YxZuPJZbatdMpc4Z
TLSH
T1E565C6416437A38FD1FA6032072A6B8CAB64EC0377456F2673C4493AD827B65A4F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 74ec03a1002926166d927db040ac3d80ac19bf8d65c07454e914e9915a2d1b94
MD5 96d0b714f8597c7024ac8cc285512038
SHA1 4f172408a92be8054bf8d6ee6c5f5676ea996130
SHA512 b720a90f0825b00cbd86ab8fafc55a987e6538b658ce0821376a8299ad8f12a95a88e6308c1683fa8cc008e442fa51b89a72f4979aa59499626bca136cdfdc31
SSDEEP 12288:s67qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:HqnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1685523696668F94BFA3B06F058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d5d049c669bd9dd8307676bdc49561d61100b7029c011728144697115b4c9e7d
MD5 3b0b7cd6f062358bc2aa1f63d6159693
SHA1 68528230e70aa8df6c538338576e9da1181cf7c2
SHA512 b0748274bc06c8f9844fa6e9ebc93efb61b4efd01977ae61b5cdc9a1ab67167eccd20d79ed89c76c1527a772006f9eaca3aac1dd12a846e1b7cdfbc6054cbb78
SSDEEP 24576:ggb6bmBIi49WNNFpg1rSvFv7bYQnQ/tbw/2Mkjy6Fr7g0oG:ggb4mBIBhGFjQ/lFTjN4
TLSH
T15B65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 1a51c251062fc407bb0588b4d6907a533deb84c845b3c58af2f7c53f7b18a947
MD5 2bbb6b17bac6e550cd693651a80f458a
SHA1 8505936b76b7f3c197884e40fb14caa1141aad40
SHA512 592dcdf6cdccdebf8fad1fc3ba83d9ac0687e05d8b9f8f7d8f65ed3ce55f0235a8b969aabc6399119a8f33d41ad0356e6a95c47564d168cc05c0f8729f2d5685
SSDEEP 24576:pG88u8FpJqH1Qzria7/mTnQ/tbw/2Mkjy6Fr7g0o2:87ZFPqVva7/IQ/lFTjN4
TLSH
T12F85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 12863b2e577d29cd8a57adb1fae14b813aa167f04a21d23caeff157af1fedb93
MD5 6b6a972f7ccac68eb3178728a4b64a19
SHA1 bc85ee8b2104f139f08a16a31f388e45e673c1cf
SHA512 811bad36723f25e3d8d13a26be9b71c06e4e58a56dce523a1a5f3badb89fd1746356733826dcf7f4b48f2b875abcd2605518d4bdab488adca4b57ae236d7638f
SSDEEP 12288:7HvUrBFrEjwaQvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:7PUr+NQPnQ/tbw/2Mkjy6Fr7g0op
TLSH
T14B65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f719e7922913136d5f665e2d87ab2ca437b3dce3fe635e6f96322017920aff13
MD5 a34d5af3784b039ba4723f49bf03f105
SHA1 c59ff0da964351306fed49e0d03f7971000000a7
SHA512 98ff60f52691c259554becdbd76b986ef3a852330f7c3d26e9c8f898a1077e3c0ea0f579e7a9e304f735b17daee11a8d977f5ebe9d622c9b7ed707393b131e4a
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/Q/lFTjN4:0G05lO43bpLm
TLSH
T14AD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b03a2ec81b1b7344fe1a2e2d21fda4ebffaa6b83e9b79b903c771d75ebb41e6a
MD5 68a76b070ddadd719406e9a6ddd6e80f
SHA1 92cc807b081a70b925356eadae989c4700d9e6c6
SHA512 62bb0fb5dc0ea99d15f4c8e943e27cf8392514c29ddfe4e6722dd7df3879a9083920a12586dfd06633f30b578f5eaa4731aa5fd690217ea2ad9fa934f485f681
SSDEEP 24576:Jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn1nQ/tbw/2Mkjy6Fr7g0oQ:Za5POZ3+Jt2pasx2+mHQ/lFTjN4
TLSH
T17E65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 51fae3a40aed1b397c9b1dd6870f0380ccdf639c660f0937bf8446b6857d3164
MD5 c4b80e655e7d8bb1b5c14c614dfaf841
SHA1 f87c6c5b3164e0d80c6ada312df7c3f431c3db05
SHA512 d02c1d112a7226129e6eb3b7111d7d93a3111f65867c9b13b3dd93e2878b52d6716dbdc4ca3268ea66d49034bfafb2b85ce819811d7fd93dfbb6011acd370368
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FkbnQ/tbw/2Mkjy6Fr7g0oW:hNc/zEOVHFoQ/lFTjN4
TLSH
T107858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7cb7ba0c25a5871d8b0ae8a9465f13a48cee959ea70cc0e01fac4b2c3df6d6b3
MD5 acc397f637c76694157bf2aa56df3115
SHA1 77bd369094e1e4f7c24f932bad546221924fc771
SHA512 8c1c52c3b843b98070a00f3c2253e5b090d54d9c82800a8e17d070b61895dc064ea2ec0dfa63a6a4a0aaecfaaf8b616e9b6c8103dcd0d2077b86aa171a9a1c3c
SSDEEP 24576:/8kNvNnaFeYhJNtmZBmJnQ/tbw/2Mkjy6Fr7g0of:/8MwBtOmJQ/lFTjN4
TLSH
T1F055AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5e5e278abed36f95f9467904856710d12f51018982ea8f2b3d8340254f740ae3
MD5 bcc27e04e94b14bfb7857f27e0ee2b0b
SHA1 11e54149c5e32d548dea52622eb04f31830ea1f9
SHA512 30e513ba01b2de38fbfd095ac2a1f82c5b313bbccc23115666f7a71c7f094fc7d1b5c406b80a40bd2c04971600344d40d247075cc2d1071779ecdaf25c03b0ed
SSDEEP 24576:uD3FHshBIYQgAenQ/tbw/2Mkjy6Fr7g0oI:uDVHeBIAAeQ/lFTjN4
TLSH
T1ED75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-13-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1072-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1072-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1072-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1072-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1232-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1232-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1232-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1232-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1232-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2680-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2680-132-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2680-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2680-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2680-125-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2888-311-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2888-112-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2888-120-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2888-114-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3272-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3272-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3272-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3272-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3272-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4104-82-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/4104-76-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4104-77-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/4104-308-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4160-292-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4160-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4160-53-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4160-59-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4288-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4288-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4288-94-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4288-326-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4288-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4288-88-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4920-0-0x0000000000400000-0x00000000005C3000-memory.dmp

Download

memory/4920-2-0x00000000024B0000-0x0000000002516000-memory.dmp

Download

memory/4920-8-0x00000000024B0000-0x0000000002516000-memory.dmp

Download

memory/4920-86-0x0000000000400000-0x00000000005C3000-memory.dmp

Download

memory/5592-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5592-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5592-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5592-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5668-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5668-101-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5668-312-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5668-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5668-107-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5668-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5812-66-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5812-72-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5812-65-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5812-307-0x0000000140000000-0x0000000140176000-memory.dmp

Download