Analysis
- max time kernel
145s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 07:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe
- Size 890KB
- Sample260804-hz7abatemd
- SHA256 6a007b8161eaaf5f000fdf59f2eb498ba4286dcd0750ef5933c9d79f5c2653db
- MD5 5a1b1e161b0cc17318b5c276f9adfb3c
- SHA1 09d01da52318f4aeff2a0ced27c8ad8f101fcb1d
- SHA512 52f3889dbe79b5922cec79c87d346e561517901ee68aecbbbc5256c18d1c0b1fdac8125d15780af9137f797d7428d82987558fb3fd2472f3f5512a3701eff720
- SSDEEP 24576:nFUtETPQEfzEw2g8S0FjgqmvWUkqggmo++q/JIXAkBRZtju:FjxfwwPAtUkRgj++0JjkBH
- TLSH T1861502213B4294B3C57302324F28AAAD50AE7A511E35967B63D8571CEE702C2EE35F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 3200 alg.exe 3944 GameInputSvc.exe 4932 GameInputSvc.exe 6204 elevation_service.exe 5972 elevation_service.exe 2656 maintenanceservice.exe 3424 msdtc.exe 2984 OSE.EXE 4344 PerceptionSimulationService.exe 7136 perfhost.exe 6816 ReFsDedupSvc.exe 4568 locator.exe 4412 SensorDataService.exe 2280 snmptrap.exe 3508 ssh-agent.exe 4268 TieringEngineService.exe 1708 AgentService.exe 3432 vds.exe 3928 vssvc.exe 1084 wbengine.exe 1848 WmiApSrv.exe 2372 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe - Drops file in System32 directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\26fa761e957eebe4.bin alg.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GameInputSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters GameInputSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd647194e023dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8abd1cfe023dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3b61798e023dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad128897e023dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GameInputSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GameInputSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 4932 GameInputSvc.exe 4932 GameInputSvc.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe Token: SeTcbPrivilege 3944 GameInputSvc.exe Token: SeBackupPrivilege 6816 ReFsDedupSvc.exe Token: SeRestorePrivilege 6816 ReFsDedupSvc.exe Token: SeBackupPrivilege 6816 ReFsDedupSvc.exe Token: SeRestorePrivilege 6816 ReFsDedupSvc.exe Token: SeBackupPrivilege 6816 ReFsDedupSvc.exe Token: SeRestorePrivilege 6816 ReFsDedupSvc.exe Token: SeBackupPrivilege 6816 ReFsDedupSvc.exe Token: SeRestorePrivilege 6816 ReFsDedupSvc.exe Token: SeBackupPrivilege 6816 ReFsDedupSvc.exe Token: SeRestorePrivilege 6816 ReFsDedupSvc.exe Token: SeRestorePrivilege 4268 TieringEngineService.exe Token: SeManageVolumePrivilege 4268 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 1708 AgentService.exe Token: SeBackupPrivilege 3928 vssvc.exe Token: SeRestorePrivilege 3928 vssvc.exe Token: SeAuditPrivilege 3928 vssvc.exe Token: SeBackupPrivilege 1084 wbengine.exe Token: SeRestorePrivilege 1084 wbengine.exe Token: SeSecurityPrivilege 1084 wbengine.exe Token: 33 2372 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2372 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2372 SearchIndexer.exe Token: SeDebugPrivilege 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe Token: SeDebugPrivilege 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe Token: SeDebugPrivilege 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe Token: SeDebugPrivilege 6664 2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3944 wrote to memory of 4932 3944 GameInputSvc.exe 92 PID 2372 wrote to memory of 6164 2372 SearchIndexer.exe 113 PID 2372 wrote to memory of 6080 2372 SearchIndexer.exe 114 PID 2372 wrote to memory of 5932 2372 SearchIndexer.exe 116 PID 2372 wrote to memory of 5984 2372 SearchIndexer.exe 117 PID 2372 wrote to memory of 3780 2372 SearchIndexer.exe 118 PID 2372 wrote to memory of 6068 2372 SearchIndexer.exe 119 PID 2372 wrote to memory of 6084 2372 SearchIndexer.exe 120 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_5a1b1e161b0cc17318b5c276f9adfb3c_elex_luca-stealer_medusalocker_mespinoza_njrat.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6664
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3200
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4932
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:6204
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5972
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2656
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3424
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2984
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4344
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7136
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6816
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4568
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4412
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2280
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3508
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3432
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1848
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:6164
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:6080
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3052 3048 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5932
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3008 1684 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5984
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3780
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3008 1684 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:6068
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3052 3048 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:6084
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 cca717acb7ce6ae99e707f3f543d424876d056974d900ab963a69be358218c76
- MD5 930e0381de29dd8ed1951bddc12e6182
- SHA1 297865a8b41f7246b428ea4e50a7ac2c34991c31
- SHA512 37a24c812c0dad8082e2f4f554f9fdb3eab2bd813b452a849696a17c6392ef849e068b98aa2e23dda6be9897cd59dccbd9f0c6e3faf8bea8489ca241b6e635cd
- SSDEEP 49152:W4lR632BuPkFKRrdE6oh7stBhuXjfS4LWxnXUkRgj++0JjkBH:S3q6gjBMTR0X09
- TLSH T146D59C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 849KB
- SHA256 aaa5230872098bccefed1d01e11c32eae4863ddce06f2ed7dc18fdf45f5a8e95
- MD5 47690e3edf29037506742fc33b3d3044
- SHA1 c939d9b00ab9c458d440b58c0dece7505e11c8a2
- SHA512 dabf6cb8a05f863934e7a1f38650282981b0d44a03fd4e0ab1664ed4c10c8177cfb724219aa07ce871d2f95a9c4deedae8632f07ee204074459a31d1a216f7b7
- SSDEEP 24576:xXYumbczAXvWUkqggmo++q/JIXAkBRZtju:+bczUkRgj++0JjkBH
- TLSH T17105012477D009F9EC67823CC8A28506E673BC968760E74B03B4D6691F237C95E3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 b772a7a7bf52c0aa85ebb7930d18738ede25f7e5a912d67a82bed24c5c8dbd9e
- MD5 43c376d13f654c92f04b66ad850ed35e
- SHA1 f4fdca2cf1b18fde5b432a1112f826031c4c8205
- SHA512 418be58c4f6b24a9a20f98e965ae0d640230889e6625ed746e672b3ec3607cbe339371b44d185e6f5979cc93e94260ede6b5367ec968576cfc80a1b65b6fa79b
- SSDEEP 24576:Q0mevjf0OGxOrMYGUOlEywcQExlZNpmTN7Ik5sQLHY1:Q2jf0BoZv7MZOMVQbY1
- TLSH T15545AE16F6788335D073C0B9C5D2A69AE97230865B3089CB0286D77C7F677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 98b22539ed45f6666c859b7cac818d7109ec60db109c7f8c617f6e34e20167b0
- MD5 c889eecf84bef86920fb318dafa3581f
- SHA1 c1c376b27ae132746852ffdf9e6efd644573af44
- SHA512 cfd0ac0c12f425d61f044f0ae1624658885c8d547ddc5f9bd4a4a906b582a290b3ac1e8b06e10d75f0ff54f0bf8d84176851ff25b2301f206704c7cc246b1d43
- SSDEEP 24576:7bo/ezSC6vUyD/aqgrvW/6q8wyupGUOlEywcQExlZNpmTN7Ik5sQLHY1:4/ezSC6vUzPvuHjyMv7MZOMVQbY1
- TLSH T1D4755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.3MB
- SHA256 bf0801bee697b3a8180b2e8cb7a390cf62380e10b99429705835498ad526e653
- MD5 01e4662f307822e828b0af6a3d2cdc7d
- SHA1 9355a89cef1849499622edd13bda182dd0133026
- SHA512 a58243aa4c861bd0140a9b685e25a532a0bc40e8bc27197452d01711d6a6dc8797fa9dee2860bc5cc2f722aa08e29a357ba564f9f9c7b4a25437a0f22b6cbe5d
- SSDEEP 24576:4abIPj88av/l+djGUOlEywcQExlZNpmTN7Ik5sQLHY1:4aY88aXl+5v7MZOMVQbY1
- TLSH T174559E66F5B48335D073C0BAC4D3AA9AEE3234424B318ACB1246D76C2E677D6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 603KB
- SHA256 7f0943889d4d2175d954ecad46dd6a5c7dfc1153851e1f6e0475cac21b687b46
- MD5 53d09bed665a955eb15f391f6373818c
- SHA1 c90a436e6cf8c5c2e701d97489a9174958bb62ae
- SHA512 9f0c82352369ef917e813f9135ee7e50db8c8c1407a765a5d9a5f62b27276dee5343e712f064d4c517e70cef22ec08de22d5d4f21f7d830ec285a9eb53421ddd
- SSDEEP 12288:AF0GM86j64WmJyfYcQENw/4lZNp0mwTzZ7IMXVCKEdgpLHiuTst1:AF0GUOlEywcQExlZNpmTN7Ik5sQLHY1
- TLSH T128D42396FDEE13BCD1DE0974843F5971D1B66F1D88DB840A234A7E12CE3A389D929324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 863KB
- SHA256 a05591ba9a5e30328beda4326bf582e1e6ffad4c4523d2678781fad63066fe17
- MD5 91556988fc1b202b1d8f57ab5fe98378
- SHA1 bc23838a534b18144dc5531676c2da144aa21457
- SHA512 50cd024fda05a8fc24155f60a5f829ca0b4b59f87908eccd5f5b4b42d7f329dbfaeb354ecd12cb66afdcb928f882c38dfbba8ba543b3092fa7ccebaddc1fcee8
- SSDEEP 24576:+JIUKGUOlEywcQExlZNpmTN7Ik5sQLHY1:+JIUkv7MZOMVQbY1
- TLSH T19915CF7BEE28FCE2C27E4DB85A528600D77278304B6293CBD165830EDE236D15E79D25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 2.4MB
- SHA256 3428f4e29fc66ef751bbb8f68cce81f113e1a48253f1c6a3bfd931a43820eaa6
- MD5 ea552b4a0091e55f9bc030fdc2ef86b0
- SHA1 3f5b3234c334a775dbcba08208f2f59ee398ba41
- SHA512 dfcc57be76b511169d114d08a8697b5b7d53e61abbf22a1ca0ea671f9c0e90c71d9e4aa735a7bc0271eb0ebd6319e7183c9032f3344a543f7a6dd4c432d1513b
- SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJS9DNb:nQvGAdlCEL8c/SRNb
- TLSH T19FC56C9657B840F9E56FE098CA6AD973F7B138060134778B07A1CB673F77A601A2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 932KB
- SHA256 1e221cd2779ba4d2eaa5ffe193060278c619313ba109c9d09ce73d6f7e1e9218
- MD5 1bcda3cf921d740ce76611dfdf3e3949
- SHA1 dc4ec065562cc4142e4e44ff4aed02de2ad62445
- SHA512 6815a7569f51966fef15b9e4218fbea0cd96ced943efc5416eaabffe0a3e9c4833adcc067dda04cffb705c409992c346d211d06cbb5ea5da17c940489aa7e1d2
- SSDEEP 24576:4mewsAjXGUOlEywcQExlZNpmTN7Ik5sQLHY1:rlj7v7MZOMVQbY1
- TLSH T17F15E031FE75E036C2BF0DB21B36C716547D7A204B9219C3E3A85E9E99302C26776B16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 2.2MB
- SHA256 b75a3bd08fb60e98b4682e4bff434746263efe251d35e1bb90c723bfe2aa6009
- MD5 02739f7874f3d4f8ecad5c0ea291cd75
- SHA1 12ec695172a11704ea899e1e6b0172eec241ac24
- SHA512 dd1ba2430d72b3dbdb46171a591b516d150fd3c09d90c4a7d273f229dd18a1987546c5738161acea068e529e7e83a8436da99abfb6610d7185945c0c9598b61f
- SSDEEP 49152:SYVCPaBGkaXESCMBB7bu+zQ6zFZcDYObMOpTKd6zo:JVJ3MB
- TLSH T1AAB56C9657B801FAC57BE088C79A8577FBF0780505346B9B87B2C75B2F3BA60592E700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.6MB
- SHA256 89f086a3ac748164d3503fb34ea0b8f2ec4d90d1d99cb4833f05489cf613d430
- MD5 3481d4a758c279fefa8946c64d765f55
- SHA1 7f91bcaa80990c6b37fd412ced47de26c95c85e4
- SHA512 516a74ff160aa6815beee3acb5f1a01228248ed225a36138050ef51720048167dc765625d00cfbe31b29f81bff73c7e759bb5c0112f9ec33947777e154ddb7ca
- SSDEEP 49152:0bbRquA/m2yL5zMfFiV+XenmE3/zJv7MZOMVQbo:aoq1VjnmATMZ/Vj
- TLSH T192D58D0976B882E4D1F6C77886A2C647F37178154B3197EF4266461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 1166fef1a9cc1f7d32ce5019a3a15e511dda7c8af0c481bf0498fad367732d37
- MD5 22d6c3600d98ad6804b9aa4439ea6884
- SHA1 3b7a6cbe67a862f89abcac9cf4f7c09f92562ed9
- SHA512 6a1de9d8cf45ce8d14482d68a7b06024e5c6b44bdabe540ba87917d3c677ca6c616a098698c445c73a34eb3d9bf814c5bca6a78492ffad394fb0c62e4e76e6cf
- SSDEEP 24576:RAhGLvPFoiwtA5l7S53JGUOlEywcQExlZNpmTN7Ik5sQLHY1:RAMjFoiq5xv7MZOMVQbY1
- TLSH T1D445AD81EBF915D4F5F79AB899B68570EA76BCAA5E31C20F2150D11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 830KB
- SHA256 54e69b85ce63e09119229fa38133486cc01c68cdac1e18b01bf06af4598e58cf
- MD5 2e0b2a1e8137e5fdc46efeb53fb1c7c9
- SHA1 ae090234578a8296fc836e7c0dd9f8d0df993908
- SHA512 e1f02fde0155c832cd5aa715eb27ec831858dd467f599368e2437011cc304e037727ba01c1c8a71d48744c985e20c9240bd98c362c88fd75b630dd56e826ed83
- SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+CtSCWch2tqggApgGRo++q46rljbIXAkONy9XZRtr/65:QwuuOW6vWUkqggmo++q/JIXAkBRZtju
- TLSH T1EB05F14636E41CF9E9A752388597C536E7F6BC422A31D71F0360C75A6F33352AE29B20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 679KB
- SHA256 861b833f12362fe1595764d1641d636754a6a124c141509a1a0807b92f208476
- MD5 ce3fae8987919bb509f43933267b85f7
- SHA1 281e998d4b88ff61aa6fd5e4eb922eb8e4c2e0ff
- SHA512 ac4ca26a994c43e7e7617359f5454835103ef30e606e8a60bf4c53d0b161fc2415ceb9f5c88ab26a7df82dfaa48858f0d1d169acaa92aeb6f31617a39c136d7f
- SSDEEP 12288:anK1ICMgGM86j64WmJyfYcQENw/4lZNp0mwTzZ7IMXVCKEdgpLHiuTst1:qKu3gGUOlEywcQExlZNpmTN7Ik5sQLHI
- TLSH T134E4129A36E922F9D0DB027CC8BB4A15D372741A43B783CF225546269F23BC69D39731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 1.8MB
- SHA256 817a4df5fc0556eaea4171cc10be85bcde863bf6196539ff2a00c18a106dc34f
- MD5 cf2ed3cd291cebc3e92a511637bc8e1c
- SHA1 3cf6b417304e35fdff9008b541b69d333e997083
- SHA512 ce65f41310ec41a5d8b79711648e6900e5afbc6ca93cd49230841044a8b5d10b82b5089f14def4445701c8bc5fd1adf5dae84ffc922d329b8e45e842dd956d44
- SSDEEP 24576:bj8eZAA4v7Je3GHt3pB6jLp3DwQf5SUYL7:bj8dh0WHt5BUp3DJf5SUYL7
- TLSH T11695F8E6A36112B9980FCCA45B3D68625428748F5334D3EF09ED4A760672ECD6B3DF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 1.7MB
- SHA256 a6b8cc3a99154b7d8d5f33b2c2ad1ae1edf81489b1e0a110b76c3dd710bc0bb8
- MD5 bf5ccaf8c5e330c6394276a5d80af8e9
- SHA1 1a564420eaccb4b1261ee81a3e472a71f05b2d81
- SHA512 83a90549de46be09232004408b485052919ebfa8429fe617f7872c47f6b98c17438fa5e20c906d9ea2d4284f697281ca8adf17e868499844da09c08dfc8c7742
- SSDEEP 24576:bj8eZAA4v7Je3GHt3pB6jLp3DwQf5SUYH:bj8dh0WHt5BUp3DJf5SUYH
- TLSH T14785E8E6A36112B9980FCCA45A3D6862542C708F5335D3EF09ED4A760672ECD6B3DF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 1.9MB
- SHA256 ab57c7cff4ba78b3fe2271a2d583c5068c75e81fea258f0da513b244989ddcd7
- MD5 fd992e29f9d72c1850dc841253ac3f63
- SHA1 f71fc32da5562a46f2f34daba9d101c11e65878d
- SHA512 6208a4b1bc3226cd163f26dbb819f7a6e5cd87e41bcfc441b19f9991fa4cb939e2354341d49b70d5d7b8995e95e9377f02361e9fb9436a53d8e89655f866d2b6
- SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0YGUOlEywcQExlb:Y68Qg55nhMeWu7PNU3/Bv7Mb
- TLSH T17E951733B2F600A9C44DE1769F4A973196D27C758FE0E3DB851172061BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 1.9MB
- SHA256 2d36dc39743e75b33c4a31aee0a31a06a67a2ad6a12a1a4c163abb1b822d0048
- MD5 c352caae0c5132c7e6d8c2864d38e82a
- SHA1 e83858a6389be1f573bd1bf95ca72a59763d9060
- SHA512 ad80ed812d33b20ed8d9b22bdf4125eb760ad1105a97c55b69f9b7b7857c53458afce00ffe2ddc165d065f437b501b5ac060db48f07607a4c237f90356b5e2d9
- SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWNN:7y5112gYy5azzVva
- TLSH T1AB957B13F2D910E8D05DD179978AA233F972B8494B35B6DF0A9087622F6BEE0673D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 b5946af0273dfcda860efeea503a2e61df511dae1cd0ddf7f58e9b455e2b7842
- MD5 c1f078924bb3e934d9528615814eacb2
- SHA1 319659128b671698576dcab576a1249441dc1c80
- SHA512 4a49ad6cd9460628d187dd9cdc13ab4136c6a0b0c23ee32308a53340a7b3315def709c084f28d619d74b09b44f7ba43914b617143ed024926b883cb171643333
- SSDEEP 49152:3U+taZ3usBWOBr4tEGp0bqx0z+n217aau1glvUkRgj++0JjkBH:Au6JmTxd2dvTR0X09
- TLSH T15CD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073552E77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 1.6MB
- SHA256 0726fa6ef17c07154a12f552f471e8898c5b0510ec067507d7235e4f3a92c2d9
- MD5 d962d19e875e80567ad903663b9d3db9
- SHA1 57135aef5e706091e8fff588e3b2f76ccbaee77e
- SHA512 f50328835d3bcd86b6646948b871a205c6dd7362e21943ca611c0b09cacac44cbafdca7374e237f1f753c7bc42a32967b7ff8da2bb156c0c0ea0012e3a141749
- SSDEEP 24576:ghv8E1hps0+ogd2z615uCMVF1Agz6LUQ1zNOgLLwH7ReaQXx3I:81hpsNoJpF1A6UU44CwH7R4xY
- TLSH T125758C13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 1.6MB
- SHA256 c4f53e072eea7dc82122b4fb34c1722c39b9b60346ff90442547d71bbe6b5253
- MD5 dcb2eed4645130990ca9dadcb0346a27
- SHA1 a2af0866d3b0b2a8f5daf58e7fcd7c1dd470dd50
- SHA512 06c8e666eec32b95e4c8979202a7a87fdcdaccefef2cf3ba3aa1e211c31a62e1bff92e618971fa584c5899c21021c161448f5993eaebb95e12f229b1e33b3230
- SSDEEP 24576:94BvWw7fuwWQsBZFAfPSPa/0BeHWxE6lR04FxGgVG2Onks6xt4bSS:TSuZQIY0Be2K6RVtOnks6NS
- TLSH T1F6758D13F2D901E8D06ED078875A9236EA72B8050B34B6DF0A9097961F77EE46B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 1.6MB
- SHA256 e535770cba0f7bbae9cd7048f85cad285f33ddfaa3e45b125b35a9433a0a4d4a
- MD5 d56807eefcc88c50998358aa26df71ce
- SHA1 8d74d4c3d6e8befe5980fe004f52da0f9aff108c
- SHA512 12591b2d930a6a9dc4d49caf8cb6923c136d1ce72a904b62944babab4bd76bf81e94d109e87e082ca76d364ca0cfc06c3b974a54ca5c6a9538643d3c0597e4af
- SSDEEP 24576:wjiavrPSLT8EARn+FgyUgd0fJY6BTi3iy9CTn0AP5+2QLpGUOlEywcQET:wjtSn8EApI0figTgiDn0AP5w9v7c
- TLSH T1DF759D13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 602KB
- SHA256 f94fc525a1199fe93c19944a155fccc9554a0911b1bdd0c26019b8958bfc0564
- MD5 7f12c12af8db91f5fae52d172637ad7c
- SHA1 0a1fa5f285a9c78bc896a9e1e4c5bc0c5a087cb9
- SHA512 8b958db9ae9d860e26bf79a2d76d1ff2f34afb6c7c0f7c8b7f97c8f5aaf3426fd43003f64afc7e5471d33b23af41caf7f39004dcf1327d5af7145eccd50d1b79
- SSDEEP 12288:9MGM86j64WmJyfYcQENw/4lZNp0mwTzZ7IMXVCKEdgpLHiuTst1:9MGUOlEywcQExlZNpmTN7Ik5sQLHY1
- TLSH T1CAD42396FCEF13BDD0CD09B4C42F5A74D1B52B1E85DB800E334A6A12DF66389D929728
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 602KB
- SHA256 47a18c83cbb13f4824dce10e828be534ca446d4bc22a37eb465fb5570b92e404
- MD5 4f0e87593364402733d0bd2bebc8a87f
- SHA1 3b2db3b0ad8ec4818e75bf4f9de332f564cb0bf5
- SHA512 b164481a623e9dc18fc8e9bca3f938846e95c33a26c82577797eb9af67f1695a71cffd9ad3d33dfda3cedbd92bfafccf5c3fe47b6c0323f6ac888cf5c6b02f07
- SSDEEP 12288:nuGM86j64WmJyfYcQENw/4lZNp0mwTzZ7IMXVCKEdgpLHiuTst1:nuGUOlEywcQExlZNpmTN7Ik5sQLHY1
- TLSH T18DD423A6FCEF03BDD0CD09B4842F59B4D1B56B1E85DB800E334A7912DF66389D929728
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 602KB
- SHA256 5b902723c537cf121ee67208391f1dfa1a8e240a88922a2d71fd4f137c874da5
- MD5 1f4383a085c4494601474074e11f69e6
- SHA1 a28a1d3c55ecbd741d8e9984e328dcbaa5e72b62
- SHA512 dd3848d9989ad64e8d4100a13535ed0ba85dacd049176d9159a4b8cd4b2c30d1a8083d31cfb4637ff8d9e640ee04c5dec4475b4b2084cc10c8f40164c2b5d1ed
- SSDEEP 12288:xlGM86j64WmJyfYcQENw/4lZNp0mwTzZ7IMXVCKEdgpLHiuTst1:xlGUOlEywcQExlZNpmTN7Ik5sQLHY1
- TLSH T10AD42396FCEF13BDD0CC09B5C42F5AB4D1B52B1E85DB800E334A6A12DF66389D529728
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 623KB
- SHA256 46455731c25fe66bdc4224d4402617fa800ce3ab608e54942ba80d6a06e0c3c9
- MD5 c982e99c9e4d6ecc1086151436b03e4e
- SHA1 34261db4fd83376cbab7093df4a922e3c12160f9
- SHA512 c16dafa6ed954a48171dba92c7060ddf7890d86c901871401beb85f4955657a05a51a0cdff7e3ce0d15349df4b85fb476575e0a472620bd221248c2747c9a14c
- SSDEEP 12288:hgl4GM86j64WmJyfYcQENw/4lZNp0mwTzZ7IMXVCKEdgpLHiuTst1:PGUOlEywcQExlZNpmTN7Ik5sQLHY1
- TLSH T106D42296BDEF03E9D0DE0678C83B5975D2B67A1D85F7810F23452A12CF72349E928B24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 602KB
- SHA256 4814365e24e04d2c64256da6824e2eaf8f9bcd4be3e84dd1f87abd1af849a984
- MD5 58ca5ff4c75162196865ac659a497b64
- SHA1 ea0b4e88e313bdf9500e075ecace6ac0db62fe23
- SHA512 cbeb20004a67f6be164b847d94d69359c6faa7135b1008d77cf9e5d32ea1a8f75a21a4fc183ad75528f317bcd21a4d89e058c7963c394f247df5a5148b34098f
- SSDEEP 12288:gdGM86j64WmJyfYcQENw/4lZNp0mwTzZ7IMXVCKEdgpLHiuTst1:gdGUOlEywcQExlZNpmTN7Ik5sQLHY1
- TLSH T1C6D42396FCEF137DD0CD09B4843F5AB4D1B52B1E85DB800E334A6912DF6A389D929724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 602KB
- SHA256 dc97be297cc85e300d412ebf51dedce0f918bfd2f67daf7bcb9006c1e2e468b0
- MD5 307b159bb82239079a59def4e6984d9c
- SHA1 9afb7001ea2d4323bfffa0f1c7fe5281f7aa05df
- SHA512 509a845953a5585e8de916e08938f3e7faae117a9ae7c13a53c6916d8c9dbabadc8443aecc277fe6f9ffc33fc17188a13ee4f16de0edf8f60d3387d6cb43c18f
- SSDEEP 12288:DsdGM86j64WmJyfYcQENw/4lZNp0mwTzZ7IMXVCKEdgpLHiuTst1:D0GUOlEywcQExlZNpmTN7Ik5sQLHY1
- TLSH T1F4D42396FCEF037DD0CD09B4843F59B5D1B92B1E85DB800E334A6A12DF66389D929728
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 602KB
- SHA256 1dc2e1dd54df4ca065483773c685fcdfbfe4e113b0d34a8b49ff7291d5524e6c
- MD5 3f730a5047d7b9dba0465551f0f7c467
- SHA1 660c687a4939b27d662c263c80b68b7c2a141338
- SHA512 f9c0d5f0fd88414fb8ee780e3444deb1d3c224e18f1e7f1b6dd9bc28f6258f134de1dae24183d7aa1cd8e5f3160d23fa6c74e5b3b041e5dfdafc0908b0528126
- SSDEEP 12288:MYdGM86j64WmJyfYcQENw/4lZNp0mwTzZ7IMXVCKEdgpLHiuTst1:MAGUOlEywcQExlZNpmTN7Ik5sQLHY1
- TLSH T122D42396FCEF037DD0CD05B4C42F5A74D1B92B1E85DB800E334A6A12DF66389D929728
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 864KB
- SHA256 34f754923443787af4347ee80d4df8cbee37d77fa65107203b3127e4aede331e
- MD5 621d8f8069b7279c7e14777a47efbcb7
- SHA1 005860c6b4a2a4485b8cb2098438a7298e8c70c4
- SHA512 e2a4f53f2ae5582d8472c945582fc2fd6fe2d2561cf284a40ad814ef255f27b241f849219776428f2210f7d2694fc0e720ab6c908417344d98b4d766ab18836a
- SSDEEP 24576:RZMFz+mSpXGUOlEywcQExlZNpmTN7Ik5sQLHY1:RZMFzv8v7MZOMVQbY1
- TLSH T1B7150295B39519F8ECA7413EC8268916D2B27C1A4AB0C60F13E836279F333915D3EF65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 602KB
- SHA256 4ca9be972063e56af1bd4cb52397cc6145cc12a37c1961a43d5ace61da5fd878
- MD5 a8984ee6bb46e84e95cee02fc3ae996b
- SHA1 88eb2fb203c7d32e2ed6711cc614a206609e876b
- SHA512 9996f187967ea06664ceff84da150ee8da253e17570a07b48631a902e5ff3c20a2ec9a68d518d9f11349c311fc4802fff53ea47acd08351adfbc86592b8034f2
- SSDEEP 12288:DgxGM86j64WmJyfYcQENw/4lZNp0mwTzZ7IMXVCKEdgpLHiuTst1:DgxGUOlEywcQExlZNpmTN7Ik5sQLHY1
- TLSH T1C0D42396FCEF13BDD0CC05B4842F5AB4D1B52B1E85D7800E334A6A12DF6638AD929728
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 602KB
- SHA256 18df2108ad7bfb353229176b650d8dc726feba0ca646f714fae449cb7d8e1d6f
- MD5 7312689cec5e69d9c219c0fe0628e52c
- SHA1 50c1ce978ad8649b5db75f51299c62fd0bf86b73
- SHA512 12235df25ec58e170a2f79af170ede4359817e1bdc89455a6a29e84bd254fb260fdeb3f76afb3f3a49c4543519c526a7646abc575a388b6ce49eb9ec3ec5f520
- SSDEEP 12288:x2GM86j64WmJyfYcQENw/4lZNp0mwTzZ7IMXVCKEdgpLHiuTst1:x2GUOlEywcQExlZNpmTN7Ik5sQLHY1
- TLSH T1D9D42396FCEF03BDD0CD05B4842F5AB4D1B56B1E85DB800E334E6A12DF66389D929728
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.1MB
- SHA256 df17317f5dfcdbd8eb9cb02b23965be1f3236ab0c2ad1c8c709d242da347931d
- MD5 c93e4d264504018c1c7652ca6c2438eb
- SHA1 d38958733b2f7467cf5462cd59cb798a09b72532
- SHA512 e40a14aefbd672776ae960fe9f0d949a14c6dee4f18a06eab54881260c37e726bf3724edfbfda54d110c48657d329f1b94d1201066d30db12fa82d34af187a9c
- SSDEEP 24576:k+wvtk9RX6wkyAImGUOlEywcQExlZNpmTN7Ik5sQLHY1:eMnYIQv7MZOMVQbY1
- TLSH T16A35DF29EBDC05E5E1B7923C89B7460AF2B178191B71C2CF129A536E0E37ED49D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.4MB
- SHA256 88838e3422c80e9e5e2f4d3e00f6100f765ad47f53dffdf3202a2e5774b15a54
- MD5 ed840b5ac35689c785378f1b9552e9cc
- SHA1 b8d9020cee8ba4ee8b73e483dad2aa460a2bf84d
- SHA512 3a5013a98dfdea90f4422c238deca65ce8d72e8c06ec109304c7f17500fcf5298e0f0915bbc7181ada074990ff478ea93b2c1f89539466ad3597403d5e940f43
- SSDEEP 49152:WYmCNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+v7MZOMVQX:pySzPWTMZ/Vk
- TLSH T1EAF56C96A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 384ed3a19162fd5b01c40556e330b4697a7c4a2fdbea0530fa5f41fb8ca865ef
- MD5 9698f35d0a69b9de3e7762558e4d4a5c
- SHA1 86ecefe2d844bded44f501f6e8d099e31b865be2
- SHA512 e1ffdeb13e06df960f7bdf4edadcd76afc2347eb791e2923fd2423832f73149ca13702e3d6168603bdaadde6b526115e80042bb739a8a59ef0141e7ae46174a7
- SSDEEP 24576:uv7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYNrGUOlEywcQExlZNpmTN7Ik5sQLHY1:uv7JUQjXirIhCnDHUPfF/Xfv7MZOMVQM
- TLSH T19365AE1EA3EC01E5E1BA827885154A5AEA71742E5F32CACF1270437D6F23ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 722KB
- SHA256 c39fc83202e18572d4a070c077bba6b5cf5da6180dbb1bcd1d40554b32a2a5cd
- MD5 acc17ecc5097f40aa220bfc4ea9f493b
- SHA1 fab117e3780f53d71453c3f4afe2fa342249c706
- SHA512 68aa5fd1f818b501207df9014f4f9b342be4b81ed26bda4b979d39fd59f3ce9911bb204e3c4e104d96470d32e4ba1d15c196419bac408a3c0779378c87105a1c
- SSDEEP 12288:jYdffKGM86j64WmJyfYcQENw/4lZNp0mwTzZ7IMXVCKEdgpLHiuTst1:0fKGUOlEywcQExlZNpmTN7Ik5sQLHY1
- TLSH T12FF4015AE29902E8C09E1179C75A4A51F3737D2987E2D28F23C0F93E4F366849DE9713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 792cc0fed36d64828b37bca900c00a16f5f15aaf52aa21506035263e7fc1b8b5
- MD5 f7e3f73d87b502cfd4177de413c452dc
- SHA1 2f55be2ca25399b7af9e974edaf7e0be93d73c01
- SHA512 95827ec7e30f3f2226c0e0532e8cc4e0bfe13fdae9069be624c334aaad92228740bc1fd1d477e8d74cef7cd385538ffb1a9ee7ef2bf0a85d0b7725f785c46ed8
- SSDEEP 12288:rQ0BCMU3fUxlaLm3ZzIfaNqB9rVbV2At4MzPXb/HRsFuDj8nDcY:rQ08MUPg0GhI7BhlVrDr/HRsFuD4cY
- TLSH T1B8452941766AC74FC6A940325E32D1CCAB707D41EE056F0773C89B3FD576668BAE2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.5MB
- SHA256 bcfe02827857276f5cfb2f697e1f4e4bba8d4463f73f1356af394994b45d5502
- MD5 dc4a13561bbb9ae6d440a52dc6166fae
- SHA1 277b4871f19226cb708d254827f777c530a455e0
- SHA512 749ab1781c68796de0c84d45abb48554f2a82c9816758e62c2d52373cec7fedeee59b5e6c27de63602e512f58c70bca5fbb855dedac6ff518c58cb7ddbb1514b
- SSDEEP 12288:tUe5rKLXR25N3n4nKCe0aJppr+EIqFa+wAT:tUe5rWXRXe0a7pr+EIqIAT
- TLSH T13A6509415537E38FD1FB607207295B4CB7A4EC46B7096F26B388453AD82A625A0FE3C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 611KB
- SHA256 dac04bdd8bda49cfa2392a561c390cab1f4b7ca169adc1834aec706ce6775a7a
- MD5 e9f432adb4e94463a3dd0297799d2f72
- SHA1 a09127e04eb69040998c6c255cb813f0a1abbd01
- SHA512 18454320273f1fde1db2e22619c306a328720b48a7a898b5db6853ff2bdccb0b21083d0b938c16662f57556c22aa911f8217ffbcf2218fe9e18044dc01644b1c
- SSDEEP 12288:Id77SCWch2tqggApgGRo++q46rljbIXAkONy9XZRtr/6AK8tY3Gu:47vWUkqggmo++q/JIXAkBRZtju
- TLSH T10CD423612D805FADF8B7117465EB4598801D4ED7CB31D28BA316E38C1CA2BCB9EB095E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 6cf04e164e17911ca7ba67f17d61146fed9f866734eb0ce36090edf38f5bf940
- MD5 e6cb4b37366307b5126b7228feb8dcc5
- SHA1 5366b956b459b90e837099d1d393e52a2b5b6945
- SHA512 ec437279b952a1338b8426edf077c9d61407fe341173ba79ebe4275c347b1bc05874f592881ea68c41f59d1acddb7ba6fee9d2e6a7711d946aa3bcc6f1467d56
- SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYqGUOlEywcQExlZNpmTN7Ik5sQLHY1:Wgb4mBIBhGFJv7MZOMVQbY1
- TLSH T1AC659E1E22EC02F5E0F9D2B8DDAB4417D6B278164732D2DF125142292F3BEE89D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 664KB
- SHA256 f85c425cbc1351da4eb70407a68c377f45e4d0fe26f729eb13147ba6ea393fd1
- MD5 573db9c58a8e795db28da32a411bd3a0
- SHA1 8000b2b512b0f5dcc41bd132ce4576154aea971b
- SHA512 75b97ecd6fbe4508fc68fd7f5e23cd2f61584747440178ec35efe1b5134d673c538f830ce31c0b7230844c430311a7230bee0667a9f14b5f163ac9dcc0d0e2f4
- SSDEEP 12288:pOGrSCWch2tqggApgGRo++q46rljbIXAkONy9XZRtr/6AK8tY3Gu:QGrvWUkqggmo++q/JIXAkBRZtju
- TLSH T12AE4237538D17AECE877423894B64496F07839928B3162EF03A1E2784F92BC67678C5D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 628KB
- SHA256 a37197ea70fbd3005eb3f369b9e1b10971df40b6b7e41b7842a64d0c6e8c5ddf
- MD5 d1efcf6314e77dc682e9e1edb6cec5b6
- SHA1 2ab6174b93038f4ad95d43b20a0cac97002e735c
- SHA512 186d85d7b0334ec0d4137bd1d736601e54b5dc0afa102df529df52b54a8bd2409bf455df7f79fa895ee7307a0610e1276fd29421c8ec12f266e97697ff6389a3
- SSDEEP 12288:nJGM86j64WmJyfYcQENw/4lZNp0mwTzZ7IMXVCKEdgpLHiuTst1:nJGUOlEywcQExlZNpmTN7Ik5sQLHY1
- TLSH T163D42396B8DF13ADD0DD09B4842F4970D175671D87DB80CB324A7A12CF6A3CADA39B24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 5161d2ef087b4c1bb3ec9191738391bc62426846a3dd29918fb67e7ffdcd4bc7
- MD5 43731dfaef4e4a3c0af727c3a1c941ef
- SHA1 63c4bc7d2abd1dc953e0d8fb656cd470bd02f53e
- SHA512 26d5c24364e76ad5e82d1cf2a237d1823e739a1a6dbeac54e239b001db67e9b00548e521d3545a8a8f6715f66b12e7ac26d4c2974f2f83092c99412fea062663
- SSDEEP 24576:Imp8G8paJqH1Mzria7/mHGUOlEywcQExlZNpmTN7Ik5sQLHY1:DOxp2qVra7/ev7MZOMVQbY1
- TLSH T10135F165B6E502F4D0BBD13889474663F6B2B4250365EBDF03A88B521F23BD54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.7MB
- SHA256 9753fe5a09966877b194afed5cbfc40058668534d7c771ccc338960fec947d34
- MD5 fe83ceca85ce2382d50e401d679927e3
- SHA1 511215c214cbbc14e90c10d7bfc50fc6a41094e3
- SHA512 fac9a4d97e9a3cb49f35b4f2f61691d81a4411bb756f52e77422b521964117d45bcfcdeb00fa57ffd587ad589acc1253a4c41a82c20224719f0527640ef72100
- SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgUkRgj++0JjkBH:FG05lO43bFTR0X09
- TLSH T1FED5C06A62EC11F9D0BBD17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.5MB
- SHA256 8cc8930379077443ae361b29be20d5c10fbff31216488ff6ba204f47f48b2600
- MD5 8196d7b77ef9098a189a4ae27411a7dd
- SHA1 d49d1d6f535ea3be0b25880a0120d2aba3b06ab2
- SHA512 5537083fc99a66050cc288cd3ee17f60465c3b8f5e399ce408298011d01b1fda1027349f284c3780abf3398c185766f69aa11fdde49875fe7c6d4bc1dcbd298d
- SSDEEP 24576:lRa5POZ3dpbWVM50JicR2hG0lasx2+47eidnLGUOlEywcQExlZNpmTN7Ik5sQLHI:ba5POZ3wJt2pasx2+mhv7MZOMVQbY1
- TLSH T19F65BF5EA6FC01D5D1B9D17CC583461AF5B1342653329ACF122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 6147a67931d4199e38e9d9ebfae1fe7b34ded6e6db967b1ef71a57be2a29f387
- MD5 e81207c20e27523274fc31fc17d0dc19
- SHA1 8e8f215ebf21103b13160017734d47be2fb6bbf7
- SHA512 9693fe6b8cc4995869b60e6649080da3345c9a9d0a438c4c06c3d3f7711215e368eca0baacfc8bcc594b8689f45aae6e0638468017923fd02f9f4ede0a28376a
- SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FkvGUOlEywcQExlZNpmTN7Ik5sQLHY1:cNc/zEOVHFWv7MZOMVQbY1
- TLSH T1F8858C1623E901E4F1BBE1BE897B9546FAB17869533086CF0291851B1E73BF45C3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 936KB
- SHA256 6fee6436dc30d09ec265f46f455e0b57a7b9191177de1c7558d06962bbd533f7
- MD5 5625205bd176762ae0b325e83c221b66
- SHA1 cbd20920e9574a78b2430ff68fe1ba19cb6359da
- SHA512 8f352ed46cb707eaf0fe9179eaff939830793459f2ddcc4dddce6d9b77a5d333edda249f6cef726288864c6c994b6f07da84fb9d54c546ebb30b6cad8583522d
- SSDEEP 24576:VJnJPbzB4SwGUOlEywcQExlZNpmTN7Ik5sQLHY1:VJnJv6Smv7MZOMVQbY1
- TLSH T12815D03DD2A810E8D4B7C2B4811A1B69FE71382D2F2669CB25B4D5357F12FD0A939F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 66dac83fcd9306a073ad90537492068f16a0a43caffabb16ccf14bab60f15d3d
- MD5 c9b0842896654d5fc5899ab1f54201a5
- SHA1 2fc4908d6dfdb15551a41a835a6b2e68a4b15b69
- SHA512 0354120c65b1aa8eedc907d1458b922fef2c82fcf375d8aa47740fe1eccab7e2cf73fb9500f4338388542522e7ad751e4bfea171d646a30ceb849743b90cdbb1
- SSDEEP 24576:+CLHGL0MoeVtFumTijCmlKQWDkTGUOlEywcQExlZNpmTN7Ik5sQLHY1:+CLHGeeV5ijCmlDWDkHv7MZOMVQbY1
- TLSH T1DAA56B05F7EB4188E8F3CAF5C92694169A327C549B34F7DF4A80CA6A1E32BD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 780KB
- SHA256 c751ffed027c481e6f4c0716f49eb84873a662aec95482ab5a2e0e17c52954bb
- MD5 46780d2db9b44019bdc5b75e020f8fa6
- SHA1 4613ad19361667d779a4e40e8e664c99b9d4d713
- SHA512 bf282a5dbb7cc4d6d7a14ff6db5cc1cb1389e5e8c3771ed4009b7a6aa31685433d54dc5ea77a95bf382a045266957598bd1e958b4df13cca66d82f090e1d09b6
- SSDEEP 12288:F1HCkOJ5ZI7DSCWch2tqggApgGRo++q46rljbIXAkONy9XZRtr/6AK8tY3Gu:3OZIXvWUkqggmo++q/JIXAkBRZtju
- TLSH T16A05015C37A611F9E0BB903C96830546D1B6B5B2C72266DF07A4C1BD4EA3FC9B938E41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 764KB
- SHA256 1a552ab1aa55b11f9f997643e99258d4fd9cb294c8c2680d78f0cca5bf4d3478
- MD5 aa235e73c495b93d8301b506f634ee4e
- SHA1 0c532e0f7deab1d5912ed5e93560dfebcd551f22
- SHA512 80d2e5f652118977c092020b6abd633d2f2d3089f1338d93db17487615aba371bb584ced60edce9d235a52d7b80bd3ca2520762796f3955b08c75d65571c3f29
- SSDEEP 12288:XG6kyTSCWch2tqggApgGRo++q46rljbIXAkONy9XZRtr/6AK8tY3Gu:WtyTvWUkqggmo++q/JIXAkBRZtju
- TLSH T170F41350378465E8F8B612389AB341D5C538BC529B3293DF53A1F32D2F72BC5A970B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 636KB
- SHA256 1d182f65cdf9909a20d5c70a0a6a04152d4f0561610f6b5856b79482d82897fa
- MD5 c1beb04288db35ce5635574e8847b3c1
- SHA1 01e801d72ca98191268c3dba5eeb65fabf7e2b3d
- SHA512 4f27607279ec9c4cd9ad7619c592a52810f9a4cc43b954159e4922e85773e6c82435f2a41ff5d426e9adaa18b07d83497d2ff9de936cd254a45a474e31f042ec
- SSDEEP 12288:bQkGM86j64WmJyfYcQENw/4lZNp0mwTzZ7IMXVCKEdgpLHiuTst1:8kGUOlEywcQExlZNpmTN7Ik5sQLHY1
- TLSH T10BD42399B9EE23ADD0CD09B8802F5A71D175762D4BD740CF3289AA32CF2A3C5D935B14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.2MB
- SHA256 ed054ae743bb392df25bdf031122d6f3a0d76c88b7079b7dda4838888f698c9f
- MD5 505983fe104a22fa00449ec49ee61fea
- SHA1 4593ddc3d5416f7fb6d70fa08f1263409bd154ce
- SHA512 470cdb1436c2cd2f55e582760598fd625b3875948606c9152befe3dc08bd88191d6045b666de870e0e5076072f9f0bb6a7c08e0c6850922c12b1a9d2d7a6e95c
- SSDEEP 24576:qlgmloTfaidZaGUOlEywcQExlZNpmTN7Ik5sQLHY1:2g7TrZ0v7MZOMVQbY1
- TLSH T106558C1D67EA05DAE2B2D675D8231493D633B4315772C6CF2448C03A8DABED8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 796KB
- SHA256 31d779505eda15fdf31d1b24a126d2209d1acc04d16a44b5c02da6967618b00a
- MD5 10a6eabeb8b589b48be55df4239d31af
- SHA1 49ee04a8ba53954ab5c903dadec150f8250ce0ad
- SHA512 fe7d9a4d4d8b61ec027d11f1ac6be7b7594b855bcd3dc41a08b00bdaad57325dd52f4bc3fcc6531fe78e78b79a0b567180cf98ea070d62a569e63dcae328a334
- SSDEEP 24576:frcmRmGUOlEywcQExlZNpmTN7Ik5sQLHY1:DcmRQv7MZOMVQbY1
- TLSH T11C05F15EB6AE00F9E1BB817CC8464615E2B37034575257CF12A1C73E8E67AE9BD38B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 e3903f879e0805d5e2c10aaf3da6c9f5b3d9b4ceac85fa9dfed6c824064fbe92
- MD5 69c1aa2cae0a36071603ea6a15b828fd
- SHA1 1bc5487c352ed69d8eae38e3cc28a8f7ea7b73d0
- SHA512 1d92a5f8ebc3178ccfbd4ed722220068dc87aa289a848d6f8f59df57d7ebe2e8445a22df8c7770b901e86069f64cf8d7f053acfcf9802478a13676b5163b3aba
- SSDEEP 49152:RDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3gv7MZOMVQbY1:i3Upow8sBXTMZ/V
- TLSH T13EA58C3DA2E810A8C9AAC379C54213A6EA71742D3F3055DB0174C578BF1BEF19A39F19
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 512KB
- SHA256 e8b0ddc7149a76e6dc51c49d5a16a9fb837d90cc520d51617b49e24d1c2499a7
- MD5 7b019b8cf15abb68e2c106aa14530201
- SHA1 db9e61e68520acf6b1d7df9288978f8de03c760f
- SHA512 1b4ad16b21ebf4bd2dce55ab93027166020b19ef9d6c6245b29e39a0ade2d4c6b0e90c8299cd9120dc92eccd2a74c32d0d4f4322d48b092237f655b1c25242f0
- SSDEEP 12288:pQFSBnnoUq8KJfMahDnaFeUnn/rVJNGJymYkDkGNUbTd:pTkNvNnaFeYhJNtmZm
- TLSH T126B42A7E696812E4C1FDD5B8CE038517E6B27425033266CB83A1C17B9F1F9E49D7AE20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 832KB
- SHA256 80af5de146a77e73402b02b4fd793f5dc954326dc96543fe784710a46b86491b
- MD5 e74606f1f8dda865ed9241481d140759
- SHA1 5568ded1aab4733f41d8175fb8de00970218cf73
- SHA512 c85b54f8402b5185b4c7296c99f6f161b4da2483d6c484f25b582fb4360f8b3b69b241bfc2bcad2b64df1c50281f19d400c32f75efb0b1f4dc8e9c57613d5fec
- SSDEEP 24576:ZPUr+NQyvWUkqggmo++q/JIXAkBRZtju:ZJQvUkRgj++0JjkBH
- TLSH T1C605F12F26D91CE9F576A17C8586870DE271B8634712D2CF03A1817E1E63ED8BD39B24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 992KB
- SHA256 ed6cfd79bdd992ff134731381ff333ccee043b743e96b1bb117e848f52dddc88
- MD5 3f8e9d0300e3ae4de8906f17170d8c41
- SHA1 fb4b36b2c1df06d004504ff728d7a870caa8e649
- SHA512 d7439578b0e9b40932833f85f8de98e7392b9d23faeb181b7d665cad85cbd03964001b39c3249610ff1ba1ee0d0276087a389223390e65715ae4dd53b6f698d3
- SSDEEP 24576:7D3FHshBIYQgAIGUOlEywcQExlZNpmTN7Ik5sQLHY1:7DVHeBIAA+v7MZOMVQbY1
- TLSH T17925E17EEA9D04E4E47AC1BCC6638A06E37138AD036255CB12D481B65F6BFE46D39F10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 772KB
- SHA256 e1f260ac6de3570e1cc49d38c939a6714a08a829f33c7b6344f803c7362d48b1
- MD5 1d01a7e27b657c3a41df0642708977bb
- SHA1 42467d7d695155f709a455fddf5acdddccace419
- SHA512 4f7445a0034f7c4a489116eb1666b6f11eb5bdbd8935343f99f2f9716523a42358051628098f25cddabbfe236f3e1f6e06e56b9238e3d4be0f31d0ee94311a69
- SSDEEP 24576:B6UqjpsEvWUkqggmo++q/JIXAkBRZtju:B6Uz9UkRgj++0JjkBH
- TLSH T1C8F412592AC069F8F4760134E9A681698078BC734732A2EF33D9D27D4F32FC5953AE25
- MD5 SHA1 SHA512 SSDEEP TLSH