Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 07:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe
- Size 1.5MB
- Sample260822-hw6vdaee28
- SHA256 c95782355f25e9a829bb0c45bb7243ffba82732f215c4c6d7aa21700bda23f03
- MD5 bae2d6d3c782733aa49a7df35e8a7796
- SHA1 c4a5f9f4ce6de7d6bab77dc7de27264c1915dd65
- SHA512 e2f781ed05f73714528199af8efb768b831c74fd5b5914a2d178f9e53daac97f8976c9a1e85affa3f4ac515d8a71f8a4b57a10af9bd13703b187ebc9a80d9c54
- SSDEEP 12288:UcRj0PR+sW0ZWENh+wCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:UcWPRfLt+w2cQZXNbpInm2cn8cGorz
- TLSH T15365021131C1C8B7C13215310CE4D6B5A17ABDA10B954EBB7BB11B2E4F7C5E2AB24DBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 13 IoCs
pid Process 2352 elevation_service.exe 816 maintenanceservice.exe 956 OSE.EXE 4228 PerceptionSimulationService.exe 3184 perfhost.exe 4520 lsm.exe 6052 ReFsDedupSvc.exe 2272 SensorDataService.exe 3300 ssh-agent.exe 5736 AgentService.exe 2472 SearchIndexer.exe 2908 lsm.exe 5108 lsm.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\system32\locator.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ae626d3cc618523d.bin elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\java.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsm.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051aa89050532dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000033481ac20432dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e69be0040532dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000509361050532dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b50f4c10432dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e67c3040532dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000068fbcc10432dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4916 schtasks.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 2352 elevation_service.exe 2352 elevation_service.exe 2352 elevation_service.exe 2352 elevation_service.exe 2352 elevation_service.exe 2352 elevation_service.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 808 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe Token: SeBackupPrivilege 6052 ReFsDedupSvc.exe Token: SeRestorePrivilege 6052 ReFsDedupSvc.exe Token: SeBackupPrivilege 6052 ReFsDedupSvc.exe Token: SeRestorePrivilege 6052 ReFsDedupSvc.exe Token: SeBackupPrivilege 6052 ReFsDedupSvc.exe Token: SeRestorePrivilege 6052 ReFsDedupSvc.exe Token: SeBackupPrivilege 6052 ReFsDedupSvc.exe Token: SeRestorePrivilege 6052 ReFsDedupSvc.exe Token: SeBackupPrivilege 6052 ReFsDedupSvc.exe Token: SeRestorePrivilege 6052 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 5736 AgentService.exe Token: 33 2472 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2472 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2472 SearchIndexer.exe Token: SeDebugPrivilege 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe Token: SeDebugPrivilege 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe Token: SeDebugPrivilege 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe Token: SeDebugPrivilege 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe Token: SeDebugPrivilege 2352 elevation_service.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1088 wrote to memory of 4916 1088 2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe 92 PID 2472 wrote to memory of 5264 2472 SearchIndexer.exe 104 PID 2472 wrote to memory of 1212 2472 SearchIndexer.exe 105 PID 2472 wrote to memory of 4388 2472 SearchIndexer.exe 106 PID 2472 wrote to memory of 4372 2472 SearchIndexer.exe 107 PID 2472 wrote to memory of 4872 2472 SearchIndexer.exe 111 PID 2472 wrote to memory of 556 2472 SearchIndexer.exe 112 PID 2472 wrote to memory of 5128 2472 SearchIndexer.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /f /tn "Microsoft LocalManager[ffffffff-ffff-ffff-ffff-ffffffffffff]" /tr "C:\ProgramData\{23129418-2312-2312-231294189572}\lsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:816
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:956
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4228
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3184
-
C:\ProgramData\{23129418-2312-2312-231294189572}\lsm.exeC:\ProgramData\{23129418-2312-2312-231294189572}\lsm.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4520
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6052
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2272
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3300
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5736
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5264
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1212
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3020 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4388
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3036 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4372
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4872
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3020 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:556
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3036 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5128
-
-
C:\ProgramData\{23129418-2312-2312-231294189572}\lsm.exe"C:\ProgramData\{23129418-2312-2312-231294189572}\lsm.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2908
-
C:\ProgramData\{23129418-2312-2312-231294189572}\lsm.exe"C:\ProgramData\{23129418-2312-2312-231294189572}\lsm.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5108
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 17e05c2b7dc0984d322a3128c2c7fd8ef642dfaa6a5f947795069b22b5c76ba0
- MD5 1ad624751128c147d9f00e5bc70ba113
- SHA1 4f5ae94b26d345673515427584a730780443e7bd
- SHA512 2aea0b30802d7581e8d9fd036ef710868a948fe4a902013aaefba2220ec70f7d631e4770cc8f2aa87da713c4cdb4835d8c061f45ea3f27855a422c3d135875b5
- SSDEEP 49152:Bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnocFpIm2cn8Yrz:H3q6HjBGF+m2cnHz
- TLSH T196D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 ef2bd49da1ccf7cefdba2c890bfa484dfb32b54a19261a83e68029bf51c13ed2
- MD5 bafdf1518aa0aabeeff3d1bc0956fa95
- SHA1 57f4f5551aa2f41f2e76402545a742dadc00d4ba
- SHA512 b4ce694e771cdba5f9295ac163f567858b1996f55870cb49c4658c59dc83c36798c768979eb3716805320631127935d8455d534bf0bc8c382d51f3959a170ff4
- SSDEEP 12288:R1XLsswWkxy2lRq2czABCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:fXYfDtczAB2cQZXNbpInm2cn8cGorz
- TLSH T1A775F12463D409FDDC2B8279C9A28505E6737C9547A0E7CB03B4993A1F237D86E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 fb86287069019a57b752af6125482a30f9ff340069dc55a2dfee9d57e526063f
- MD5 254d720868e4e01d5bae13b155924e01
- SHA1 b1c64961ffc9745c5f66f01197fc822d02c49720
- SHA512 931a7b9d6a1332ee673c169a33cb68db4712521e3f25c7635389d349a24b3c7a7e18a4a511fc0789f842b87bcbb913dfe6a4c7a7500b91e88e7a9271b3eba940
- SSDEEP 24576:U0Le5ji0hmx2rMw2cQZXNbpInm2cn8cGorz:UPji0AYXcFpIm2cn8Yrz
- TLSH T178959E16F6748335D073C0B9C5D2A68EE972308617308ACB4296D77C6F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 5e054de75521f49799284773574921300ea12bb6ead70d0ec0960ac99cf5b850
- MD5 4ae2be65ab3b7d27990376178c921183
- SHA1 e68e0c66eaae67319fdf43ac85c8667058d630c4
- SHA512 b940e24061d6e372b62cec85446ddb35c40a3b55bd0c96d532f9c593c42d394fd90f5143357d370d285b974208470f681918473e79fd6df169a49c9f9256df4d
- SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWE6q8wyui2cQZXNbpInm2cn8cGorz:H/ezSC6vUzPvxHjyDcFpIm2cn8Yrz
- TLSH T1CE755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 3866173a9118a1c20378840208e341186b8988de41c0aed35955e7f1b4359342
- MD5 7f37256da88c813a4ef1735f87a43158
- SHA1 29989f4a15359035b653490c219d86adc740dea7
- SHA512 2935f4d4ebd933a77507e018d9886272d84925c71c268b064b97f60ae307350d925b85f61e0d95ea8b699bd25b5fbf30bd520ceddd7db3114925552396635d22
- SSDEEP 24576:DVbqPb88hv/l+612cQZXNbpInm2cn8cGorz:DVO88hXl+scFpIm2cn8Yrz
- TLSH T162559E66F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E67BD6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.3MB
- SHA256 3cea9673f31d55d58b141886b29d0db38e4b6db0e905bd4dd381569870953e22
- MD5 937a385a38bb061e22e0618e4933228c
- SHA1 f78413b56501e556e8517533da7c58bdaf8e10c1
- SHA512 f2380dcacaa444f12b1cfc6f0250a23a540801da68bfdc7e741d6c81534bbaecf554cb439bc8a5b8a563a49a8cea06e7c4eefcd192841c1b0bf219e206cbad44
- SSDEEP 12288:sQECpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:sQE2cQZXNbpInm2cn8cGorz
- TLSH T12B552301034846DFCE3D6172A629D8CAA0933DFC06C45B91AB76BE3B873DA81FD915D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 16a4ed99739a05dc3764c3da143c84c2b0b888f815d0f82713cf0166edb6cd12
- MD5 ba22f76fd30a9bb9d6fa574bba67a0da
- SHA1 c71c48a03db2b341d8c925b52772c86ed26be0fb
- SHA512 09874723856e5efe33681b99fc55dfd2e9f2bf6fe3c0bb7f7d4e4af0573c0f8c5d601d37658df269ea42dd47f2de26e4fa71394b734722e3a3433bc47892a23b
- SSDEEP 12288:QeBNUbTVO86UdCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:QJIUd2cQZXNbpInm2cn8cGorz
- TLSH T17975DF3BAE28ECD2C27E8DB95B91C640E77278704B51A3CBD175820EDE235E05E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 861a5418579783149942e6c97c59ab9ce2c0992ad360eee5e64b602af404a8b1
- MD5 d0158cf4801b64a945483ad51af4484c
- SHA1 976c0b0998d5571c10a821309d2900943a5ce7fe
- SHA512 88bb9da201068e6b07ad9831c2732adc113e75c63f0e750bd70b41aa6a5a64144a21c27bec05cdae886846055490357b1edcf05fa7a0fd6315893e12cc7fa6d7
- SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THa:OQvGAdlCEL8c/yRNw5CtF+m2cnHz
- TLSH T12F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 5bd89954eac4d6e04441ab1e5b9789e6035a97cc09e2621c388d779d0c5bcae3
- MD5 482604f4d3e6abdac899f664dd1d514e
- SHA1 dacacf7a99c26498b18a038c742e4861c39d1ed9
- SHA512 fd8f51688614e021c7cd6e7d55bcf9e48a2daefc7df6a4d144b04b3857f4c81e9d01c7130f02ae214e479bac1ec1c32488750c5a0da4d3ed08fbd9e283843fa6
- SSDEEP 12288:3AwSfxL/2Dc30DLLmt0LDQewsAjnCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGoH:QpewsAjn2cQZXNbpInm2cn8cGorz
- TLSH T16D75E031FA74D036C67F0DB21B36C716146D7A604B911AC3E3F88E9E5A342D22776A1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 768a1167662d8436ad3721109e963f6bec1016f1590b450bc460354a2f4b69d4
- MD5 9f6bbb228da02a8a624fdf0b5128145d
- SHA1 7fd6b8e651c9b043a11b6f114199f4b0747e76e8
- SHA512 169f96b9f2dff459d47794d5cf06092bc7cf974876132ab9b01d84c7bb4891951bbe41d5a415017de752376a8abf60559c979e7029dee04b0e34cd64aa5eeb5d
- SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHkPZHz:QUEtQevvqc2W1cpV2EI32IH
- TLSH T1E6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 515d5c7fd745131a30bc8500e41fa443da24fdb9c084497962c295a3e5349cd4
- MD5 dda1ea2ee0178eceae647cdd52683147
- SHA1 1d54dc7cbc420dc957be592c37e88a8a84c6b7cf
- SHA512 938f1a4522850e9ff02ceac74eb5982389364e5aa741f315a9fb035dc6ff252457023261b4cc89f189fc5d98640996c49dd7de9bc44b7d3dcc05ddc17b802944
- SSDEEP 49152:nCbRquA/m2yL5zQfFiV+XenmE3/zHcFpIm2cn8Yrz:woqtVjnmpF+m2cnHz
- TLSH T14DD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 783389b2a6a7bb9b9e199cf290b7ec0d784eaf63346461f661f8b5eaa5c8b751
- MD5 89f49ef673f793f80ee919249388491b
- SHA1 23fd1f60176e62d095d14a4b55342ba188d670f8
- SHA512 3f721c532ebf9371f297128514cb65632583dc875a72c9c7b86c7e5e1f4e50693ae48abb614a4a7178a106c9bd5e65ddf32708029223bcc997e8ee59d1a687c5
- SSDEEP 24576:zAhGLJIFoiwtA5l7S53e2cQZXNbpInm2cn8cGorz:zAMyFoiq5OcFpIm2cn8Yrz
- TLSH T15135AE81E7F945D4F5B3AA7899B68571EA76BCAA5E30C20F2160D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 824045e46f09a2fb31bc97f3a78d8155b91cc23358021a16facb28c2311ace3c
- MD5 61e418f4588ac1035c00d592e54e060e
- SHA1 6b8a9fb654c8fa02cfc0fea9743d3ebf57f5c5c5
- SHA512 872e79de3bd577aac8a1c220ba9f648202fd5894c02b848a5b80478367d1609dc56fe465e3cf67f727cdd5dc8a2874d994aafa7fc03611d3097c8af41062ac01
- SSDEEP 12288:nmw5HEjsChNWBFgl0WDm+CCCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:mwunOWj2cQZXNbpInm2cn8cGorz
- TLSH T11975F14622A80CFAE96792398657C136F3F27C552A20DB1F1770C62B5F37361BD29B60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 06eba7b1137385130bdee525b0d964bffd08619c9c11aa790b948cb18eff48ba
- MD5 87f86e73a2bc1004437af03754e3db2f
- SHA1 3388fa03a647720e31fe70e1600240ce6264412a
- SHA512 7bc01b362a8930b8ce9572afd95a54a5567ca08cb4a60c76f51706d64e7871bc32596702b0391a1f9c076c9497df3e7a0fd1bd88ab0ce85144b27c1a16975681
- SSDEEP 12288:NWZ1Iy3CpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:sZu42cQZXNbpInm2cn8cGorz
- TLSH T13F65124123D811FEC56B9279C9A18989E3B23CAA137143CF1675462A1F37FC26E39772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 b949ec7a29ff1f2628ff8e06eaa14d4288bcb0f375149a979f1f526139937824
- MD5 f735323a12f22cc2f5f2c26a25834494
- SHA1 aa94b79aa990cfb4b3d3ad3bbd288a17c94013db
- SHA512 b1d0136d0834f18740658c4c2450e6b762a807d8e69b0cf904ad606d0530858fb9dbe4cc0db55b63364515db4f440489d3e5d5a9e9890eaa270dad303e1a24e2
- SSDEEP 98304:dQRQyi36YOcPQLvw2gAf+PN3qF+m2cnHz:UQyiKayX+PNaPZHz
- TLSH T14D667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 9ad69c677658aff33cc5a5bd3f3bcee85901494fd1e226ffeb3026c75c4a5bb9
- MD5 bbedc443c6635f4d9598354a3ad953ba
- SHA1 e6c3c2e94325ae6e52399757a7ffae668a969dbb
- SHA512 a40fbc0eff83a4d4b9ec0478e89c39ab29081792a9d16fafe59c074e31b45c798cd65674c239d547ec79aa24aaa105702b4a4fb8935adc6a9155886bf646f56e
- SSDEEP 98304:CQRQyi36YOcPQLvw2gAf+PN3qF+m2cnHz:ZQyiKayX+PNaPZHz
- TLSH T1FA667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 4874264f92567dcdc7807d03b885817cbff08c03dba60402dc93aa1409d25006
- MD5 3339e0d6dbb8066c6ef224eb6f0218c1
- SHA1 f8d131e54486cdc515e24b16f1e03ade52f91c0e
- SHA512 3abe743303487ebf5885762dcbc57a60b962df3326922a418977219d8f9fdd71ed1fbad9ccfce89d92613af73337aa05a19a308fad8ef143ed4185db1319499d
- SSDEEP 49152:w68Qg55nhheWu7PNU3/XcFpIm2cn8Yrz:qthWRc/MF+m2cnHz
- TLSH T14FB55A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 3a2c5660a7c5e931df446cd54c5b75a1664e2265249ca3d52bf00cceef151269
- MD5 e548f592e3ec48e8ca0dbf1bccf5c430
- SHA1 f98bf1232a2b602b87c5b5ca0020df76782c748c
- SHA512 713aa7a20a60389a9dbddb8dc5501e5bd8f7db61cc017a204da347680f67972e49d9a3914acc3c7aeebe2d9c9d06b6ad73329a844d97c4eb806229ea53a1ba17
- SSDEEP 98304:Ny5112gYy5azzVvL69nLKnhZrF+m2cnHz:wLIHmWhRPZHz
- TLSH T17F167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 a641ca66bd8cefefdf1b0b23a8cb8b8a538bff5e17fc54ecf9701bac8e328844
- MD5 15d85f3f122485614c0f2dd39b395f5c
- SHA1 e4e8c4cd6dd3d121304f0513b6057c5b9588b4a3
- SHA512 09f06aab88ecd46233be33b923abd9e7e197b65913b1ab169f9334d6c82902bcf2c5c605f615d48ea48dd50e066af6a7d9fe09ea78e55903e127100c59079fdd
- SSDEEP 49152:Z1hpsNoJpF1A6UU44CwH7R4x9cFpIm2cn8Yrz:ZmifPbRpF+m2cnHz
- TLSH T1FDB5AE13F29901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BFE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 2bfa30c81764b811e62e5dd986984a92ed78af977256a70ad761cfe9641a2bb0
- MD5 7f1bab2ffc57d3b6b5b36c9e023b77f9
- SHA1 fbedadb43915154c45b8125381d32421482e42fc
- SHA512 848ec9cc49eb6c8ca14e1185f57e9b29aeee020fabf69f550bdf687a31566879e991effeffe9c3f3ed61c8621fc03b43421df426f6d6d8e4b67a3f4d95c51da9
- SSDEEP 49152:JSuZQIY0Be2KRRVtOnks6NMHq4cFpIm2cn8Yrz:H5dKTi61PF+m2cnHz
- TLSH T106C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 616b53069a077b5dfa662e036886e74cfdaaa447d4b3134e88fc38009b2d356a
- MD5 e67917212446a936f261769d7617c9ce
- SHA1 128bbc73a083f462567eb8babd6eb8efc34da6ea
- SHA512 3da22d096b44d7836be81b74a01fae2442238897bc348b285d1d05f22d33d60f4ded7b46fe0678c862aa99007759fa3803854feb9e58c495e3062f91bf7611ae
- SSDEEP 49152:2htSn8EApI0figngiDn0AP5wBcFpIm2cn8Yrz:XX2iyph1F+m2cnHz
- TLSH T1AD95BE13F2D901E8D05ED174C7568632E962BC160B34AAEF0A90B7561F7BBE46B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.3MB
- SHA256 ee51957aac9e7b7792056be51ea5123ee27f761a5c8ab69d6796e256633736d4
- MD5 614bc4b7fd2b3e73d48e10d835f18918
- SHA1 11539acfdeb240371282023d08aa6a8105b0ccd2
- SHA512 68f75dbd66609c872feda51e4fc432545b4e43ed64c6fe49b5f7ade8c06f2bcbdaa1cbae06bc1d52c2124fd92b2c20624a1e5586a1c56b3bd9dc37c6bba9a1e6
- SSDEEP 12288:RsCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:Rs2cQZXNbpInm2cn8cGorz
- TLSH T19F552301014C46DFC92D62B2962684C9A0923EEE57C417D5BB7BA93B973EFC13D918DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.3MB
- SHA256 2f2f8b824996a94bd39d1140bb3f90c2a2b4b6e3f05c3c65abbd3609483adec3
- MD5 c51a96a3aae2156feef8e7b2c9e9e6ab
- SHA1 da16c6388c19e9ae2c4d5b536ddb0715fb46e62d
- SHA512 721f51490864a8958467ec61e72c927855062eadb432369b5f9b31d0f78d8d71e6a8add2385c652dd0332cf38ae9ed74e7aa26d3faf4072368de967a014f2004
- SSDEEP 12288:WbCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:Wb2cQZXNbpInm2cn8cGorz
- TLSH T17A552340014846DFC92DA1B29626C4C9A0923EEE57C417D5BB7BA93B973EFC13D918EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.3MB
- SHA256 57db6de92a63b165d36297fd463364e689fb927a6f6b4e59c88881cbb3493c44
- MD5 24154b189f3c40562fa5fb2883c366d9
- SHA1 ba8c17a959d81aefddf7a60bbcaa0067a0d25bc4
- SHA512 f9f5f28ba422f52652e2bb974d81bd463d96344aad48edff2ff9851c1e92b181ac0d57c305dfa04f35e53fd5013ce96a0f15e671a154c3c621b36866827d9104
- SSDEEP 12288:HlCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:Hl2cQZXNbpInm2cn8cGorz
- TLSH T167552340014C46DFC92C61B2962684C9A0923EEE57C417D5BF7BA93A973EFC13D958EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 14cfa185b5f2209beaee90b2caaba71ad20884873cc2d415c214ee9c45322580
- MD5 d457e11e9d692bdca32afda6d1ced17c
- SHA1 5049ebee19a6ba4a31b07e60035f05d7d59fc99e
- SHA512 0aacb6579a01d0bd5da770a7a5b456b3b4d7e06607e1be58b38667cf0210158c3f5229571d471e81fd78b6960b1204e22f94aac9eaad87ce72ba8800fa97b936
- SSDEEP 12288:sV+CpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:x2cQZXNbpInm2cn8cGorz
- TLSH T117552301039C46DFC839E271CA2684C9E1A23DED575157DFAB32592B4F3ABC07D64AE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.3MB
- SHA256 3bd75a3fecf78e81b8e3e38f8b0350f906b9e596fc4831af2f18d99e7570a6e6
- MD5 fc5982b023646d1a7e69f98d3bafa032
- SHA1 cc6fdfe12a07cddf1c920fc974c0911fa843d6c7
- SHA512 2de7a163100bbbe99a66e4296ab18b7a68b781b46a04c6787a689d6b70be957e40b98098d883d1f2fd61de90d85a92fa4cebc2252a6f0fec3d09cc3dcf21c8cc
- SSDEEP 12288:FWCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:FW2cQZXNbpInm2cn8cGorz
- TLSH T1CE552300024C46DFC92C61B2962684C9A0923EEE57C417D5BB7BB93A973EF813D958EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.3MB
- SHA256 5a27a27697ea44821d62d3fffc70d43f689afd1165ee64130abf57d808df0328
- MD5 50bf032c1ff398e4fecd2d53862f1d6b
- SHA1 739b039cd2159471cf7fdd1725079c79ed877c65
- SHA512 c929de35ce3eefe9c9e113da92b66e9993ff57d157ca2ccee7146769441098de19bb5e55c41a0bdd99b6274f8e37491e3990779bdb0c72fbc7eaa55d9d45070a
- SSDEEP 12288:LvCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:Lv2cQZXNbpInm2cn8cGorz
- TLSH T189552300014C46DFC92DA1B29626C4C9A0923EEE57C417D5BB7BA93B973EF813D958EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.3MB
- SHA256 b491aa2aa0180b463af7f047790ac291b22b63307f3a5256b51d2f011534068a
- MD5 591b85882c764ac1f9a0b46295e01ecd
- SHA1 c3c158c68b1febcdf0987fe21cd0eb8e3ec3ebec
- SHA512 d14a5b600283a61a350cc18bb468de3d4e152386eb0fddbf5899b278471878b755d2d0dec6d2e9b19cce9ea84d51680b314c2fa9e1b3306e48973e28345f0d85
- SSDEEP 12288:dTCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:dT2cQZXNbpInm2cn8cGorz
- TLSH T18255230002484ADFC92D61B29625C4C9A0923EEE57C417D5BF7BA93B973EF913D918EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 436a65586321a57469d742592ab3a37e8d94e04c3a7da43fd48e2d07a20077ff
- MD5 258b1f2933f15c1d1efbd0c1f5b25d22
- SHA1 30ce66f8f310e346cdc589eb0dbacef089008f19
- SHA512 73790c0ea85e6646cfa2823b428032f45ea114e4724934091e0fe5836643cd28e28ec8e3d042b42955fee34d6aada28668696e8f37bbe37cb14bf7cac0a814a8
- SSDEEP 12288:viZwbzzzFEoS2cPvy7CpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:KZMnzFVSO72cQZXNbpInm2cn8cGorz
- TLSH T1FA750191739008F9DC67813EC9258946D2B27C6A07A0C75F17B4362B5F373A12D3EBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.3MB
- SHA256 a437dc5ec9ef948ccb8e6ff688babddc25d78ed85d6d8bf7437b845325c5c9aa
- MD5 3e7236b24e0ad57c69f2171e1a45214c
- SHA1 3d30b645efa7bfbc50af4de96ff241f879a9b3a2
- SHA512 38cc08b697797b1a05a8c273286879edeef35e8cfc42f6496187f1dbc88a45a92887c367f4b36155961333d3bef4fd88d5d474acd4402a3586791c7a69c2344a
- SSDEEP 12288:9ICpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:9I2cQZXNbpInm2cn8cGorz
- TLSH T16C552301024C46DFC92C61B29626C4C9A0923EEE57C417D5BF7BA93A973EF813D918EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.3MB
- SHA256 9f387429bae226754aeed5978ae8fb6b8e98ab92981ca49e7eb1b286c079989b
- MD5 f2760351313ec15a3e08b71ee97c803d
- SHA1 558ee64f39ad641dd3396b7454ab28b39e912dda
- SHA512 33bc51ca7f41d453ea5c190802452103db2b15d584b06c4a95326822046fa7c8528b52fce5f920eddf91cca1a149ed202598195e7fed61454b8484662e6a3355
- SSDEEP 12288:6UCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:6U2cQZXNbpInm2cn8cGorz
- TLSH T1DF552301014846DFC92D61B29615C4C9A0923EEE57C417D6BF7BA93B973EF813D858EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 d77b3602621763e718951a6972283b7352d48c83879d8830dd809011f9575c8e
- MD5 f5897ac4d804897c5061b9886d670668
- SHA1 ba745209654c11643fead038ca5cc081ea2b37b8
- SHA512 4f07b52c076fd668ffda66d27ae8884dc0549e312ebcd9ed773ea0f2507995a5eee1e5a16acaa56efd08d8e72d7eb767b012e64d07e57a63b2c0a2764a26809f
- SSDEEP 12288:oyPz5L83CpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:pzy32cQZXNbpInm2cn8cGorz
- TLSH T12965020323A521FEC53A9235C9625946F3727C7607608BAF57B4463A1F377D06E3ABA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.3MB
- SHA256 117f8a00e4b60f65dcb0dde5270d74e47b0668c0645e96b5f5a075d6afe9bf95
- MD5 9e2280b171fdbba900834d78dda72afe
- SHA1 f274bfa2f8b82992728fc8836d81586e12fa1188
- SHA512 296bf369fac22d4ff917239a4a4c6753b1e8bad6e752dad26e50a147902f34fc85c1c5b6bba9446fd50364414f228cedc93ef1a82c05f2d927dec58017df4c98
- SSDEEP 12288:IICpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:II2cQZXNbpInm2cn8cGorz
- TLSH T1E6552301024C46DFC92C61B29626C4C9A0923EEE57C417D5BF7BA93A973EF813D958EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.3MB
- SHA256 51a0e8270fffabfd98feba6c5ab8bc517f9e200672f47d013b882ceb0ffc1097
- MD5 5032730419dbc102e46a35a5f1b0e692
- SHA1 37bfa7b81f16c6cfe2aa0f9fbbfab7612cb18c65
- SHA512 927800d0940c2e5214e023dfa89cdf0acf64af4c49d156f26f05d3e2c45450a569c7df57163133f45d7e3c2fb1b04e9920862ae2038c8e02ceb8c186b8f904a7
- SSDEEP 12288:fICpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:fI2cQZXNbpInm2cn8cGorz
- TLSH T1A5552341024C46DFC92C61B29626C4C9A0923EFE57C417D5BF7BA93A973EE813D918EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 18c286b098cb205506c9696fb9ce2b56b41725fefe8ee6ac49c699084f35d07f
- MD5 c8ce737b69606145df4841da4b5a2371
- SHA1 653c485a755de72418195612d6c735950d1732b3
- SHA512 df07e53930a89fedf7a63e7d02ba25c67b816a2043223b696871334e54552f9b5bc2844edaef0684b41284d01dfd33f5cc0acca2ce6a0fa690c6b800165b03d3
- SSDEEP 12288:wyPz5L83CpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:Bzy32cQZXNbpInm2cn8cGorz
- TLSH T1D265020323A521FEC53A9235C9625946F3727C7607608BAF57B4463A1F377D06E3ABA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 472c9961fb481d304edae7eb1aa1e346250ac9b3d1d77a0d106b857cd5dcb134
- MD5 720352d0fb92d3786e6252816f6cae45
- SHA1 da74925c6e1dda6d02eceb7eb438719d4c53aa72
- SHA512 20be79a11ae4484f6c842ad2f63a6eb912273b9d0dc33f0104bdb18cba25e0d8d92e7acbcb66a2b0e7b8b19cdf604c07c16555d5dae7934b83468a85f5cf2d70
- SSDEEP 24576:VTkaLl3z0zDV2cQZXNbpInm2cn8cGorz:VTTLljicFpIm2cn8Yrz
- TLSH T10C750290739008F9DC67813EC9258946D2B27C6A07A0C75F17B8362B5F377A12D3EB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 7be0c1ec2b4475b83a71eb8deeea5296d8c17082ddf9ab52cd089846cfe70fdb
- MD5 b746345e2c2708daa4140cd9d80cadef
- SHA1 7e29f5585936f6b936a2803e499fe3db0670fd17
- SHA512 04ab092accffc1331b0fdbaa1473a51fd6ac90503aad14a8184a531917c11d7710226b6383aa6872631791a1f975c0874a21b64bf429ce4e1fd69a6adf72baba
- SSDEEP 24576:N34d9CHKy7GZp2cQZXNbpInm2cn8cGorz:t4d9CHKya/cFpIm2cn8Yrz
- TLSH T1F885CF90F3E414E9F0779A35C9768511DAB67C9A1B60CE8F03A4261A1F33BD19D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.3MB
- SHA256 74f1d7568e51eb0a3be7135e761a07bf9e9021a0a6d0946faf472597046988e3
- MD5 21d2dbad115d577a2457eb36dbc96545
- SHA1 4467673861fdf37981351a4a01e9ae78519efd07
- SHA512 28b30b0382fe80db6f5cedfaf2bddc877c7fb462f53031b1728a9396a3a396e2a4295d0de5c2f196cfa01915adcc7826061afb2c39cc65f563a84d7568ed7407
- SSDEEP 12288:bFCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:bF2cQZXNbpInm2cn8cGorz
- TLSH T132552301014C46DFC92C61B2962684C9A0923EEE57C417D5BB7BB93A973EF813E958EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.3MB
- SHA256 9ec8ad28d22da1c5f7ce0a20447bf58b14ce85a0091f73aa3240bcc4f8882187
- MD5 50ec0049edde078aee980711f0f30fa7
- SHA1 edb386682e94f5b6a0573cb2f665cf6da8f9d416
- SHA512 c35c00c8fdf2c314c6db61efead39542ef39781b95140cd7996160c9977e6828fa30d62a00e58080274ff298dd576bde60809555698035f2030555ae507876cf
- SSDEEP 12288:dXCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:dX2cQZXNbpInm2cn8cGorz
- TLSH T17B552340024846EFC92D61B29626C4C9A0923EFE57C417D5BF7BA93B973EE813D914EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.3MB
- SHA256 781caf8d563ba4bbab0fb969352bca7c08ec446fe2696b34a4ce6e4ed9f595df
- MD5 27b39524b710f83e1bd63518dd8570bc
- SHA1 37941cc5df048a62a4f44e8f71ec5f8a5259879a
- SHA512 7abdce1459aa0057ea05462c43c4ccd912789cf64fa8cfb9472ab60c08baa396b074eb826199e0a5e58a7427ce55fecb60160e0d6115eedb7d7625cb5b92d376
- SSDEEP 12288:O6CpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:O62cQZXNbpInm2cn8cGorz
- TLSH T1E7552301014C4ADFC92C61B29616C4C9A0923EEE57C417D6BF7BA93A973EF813D958EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.3MB
- SHA256 19902e0c46fc3d81cd52c78bad2df3d9b6c9c3f9a53d299eeedf3bca83c7a1cb
- MD5 542104c16477619f6655113689d89929
- SHA1 2f0a772d7bf7cf148d7623992a5bc154827587df
- SHA512 56898e1cef46b5b541e07b0fc8dbfc30e5e826c1e9c5fa771836d09ed32ea429f11138fc282d67b841aadc3f4563d885e2ec24af08d999d5ae375eb8f45fd71b
- SSDEEP 12288:gICpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:gI2cQZXNbpInm2cn8cGorz
- TLSH T1A4552301024C46DFC92C61B29626C4C9A0923EEE57C417D5BF7BA93A973EF813D958EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.3MB
- SHA256 6e0bdb1d5fcef047e4a86353a29830b095e27e353c314f211595c95ebdbe033b
- MD5 c490fc317a5ef52544f2590205bccba4
- SHA1 7d093154f9419e335803efb38fdbb9610a618500
- SHA512 14bb9f8a36eacf0abc464d5e0e2ff24c42c3692b80c996b0ac8da2300b780235252722875992f89b6145aa662e5516a8e90d2e26639f50dfc78c220119dec4d2
- SSDEEP 12288:pFCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:pF2cQZXNbpInm2cn8cGorz
- TLSH T1A6552340014C46DFC92C61B2962684CAA0923EEE57C417D5BF7BB93A973EF813D918EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.3MB
- SHA256 c9cf3bed6c7e44131954a65fc929fcb322a72aba79b1447210f5204acd4e86f1
- MD5 b1110fd7337b374ffffe23a60d39e6f7
- SHA1 569bf2ed3d50d86a8467cf1516944be0145f4668
- SHA512 9dea257627de0321265aae793d957e4fe4c8cd611928772598169eb7254aea961f96b596f10ea6ab687c179fbda79b9e0bbe1bf14f22e7d10a806948afa6ee22
- SSDEEP 12288:7gCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:7g2cQZXNbpInm2cn8cGorz
- TLSH T1F0552340064846DFC92DA1B29616C4C9A0923EEE57C417D5BF7BA93B973EF813D818EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 b878ea7b381270be66b0061e833be09cee3d7cb39c118dce04bd2b143519a126
- MD5 74b3b6794b980460db12b7a60349b922
- SHA1 cfe02c0eea2df499fb6ad22e6e81c61aceed4553
- SHA512 64d121e232c71023661587d12e6fb43aa4c4023ba4b97399307c4cbd33c4176bd23e06b9f73f288b82f443f26fdfaabae86452c3e03b0c0b0883252672703c85
- SSDEEP 24576:4fwv0k9RX6wkyAIk2cQZXNbpInm2cn8cGorz:MMnYIkcFpIm2cn8Yrz
- TLSH T1D385DF29EBDC44E5E177923C89B3460AF2B178691B31C6CF126A536E0E37ED06D39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 43d5ec3ff69a3515a2fc3530db6364535dced10d64350f40832f81388ab1add5
- MD5 12eb3fe3edf3f5c6d8601cbe3a44d6ee
- SHA1 8cc7c2845803645872fe5051bd5e7bfb18016d19
- SHA512 ccc2f3c2aa057a067008698a136630a1f18df76ece4dd8fe234996901892825e415d29ee0d4020926b5052c6551267953ee00f3fbe47cb4facfcaa45906868b0
- SSDEEP 49152:2YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hcFpIm2cn8Yrz:oySzPKF+m2cnHz
- TLSH T15B067C56A16801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 4cb30c731a610975b0367f686e0ad77333e800c126045eb9f486e7b6d72cc926
- MD5 1af67fbce8ce01a42311ea783cbaf9dd
- SHA1 2a538a738b1de7dcd913992bd30fd0ad1cec1b5a
- SHA512 5edbe35c5644f0c7cf3790973e902e5a2e5a84c1120cdedd07dc0a32a1d703e579c5d14b9ca114e78315820a383271334cf804fc74ff781e16e8be0b2fd660bd
- SSDEEP 24576:547Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYL2cQZXNbpInm2cn8cGorz:547JUQj1irIhCnDHUPfF/xcFpIm2cn8Q
- TLSH T12765AE1DA3EC01E5E17A927885158A5AEA71782E1F31CACF2270837D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 19fd534387d372742d8bd4f765f0905f01616a1b1866008a94f9680d3d073ca0
- MD5 79f3d5cccd58538b05b7f8ab9bd08382
- SHA1 9abc3a506e5d0630f79b5e498de96e42dd63dbb1
- SHA512 78ca56926c5c59350d5cac3472ec1c970c52363ea147114df99cb4f3897dffdc2359975e0365d05f3293daee47dd974fbcd016e40edf596e450b712d5bf0ff47
- SSDEEP 12288:z8sf4CpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:P42cQZXNbpInm2cn8cGorz
- TLSH T16565F105C29802E9C02E6175C7568A85F3733CA983E1D3CB67E1F53E1F3A6906DE9A53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 952KB
- SHA256 cb3c7c1ee038fab445e8c3f0f1e9aac918d691a13ee843902f6e84548fd7cf3c
- MD5 d28f565026df58619505ea6be7b12082
- SHA1 3ca1313130c02f3adc21cafe0ea8c5349b5d57a0
- SHA512 58a71f0d6d7dd3ccd64fda505e40f3faa146e130212dd9060de3db0c9d0842eac235008f34b1c4bb5574cdc47bdd93c6bd23e95a87b16bd0d534a791c4ef8f2e
- SSDEEP 12288:9xNzOU3fyP0BmcozI9lFVz1w6mlSl8geiTSOqVsHk:9xNiUPS0BmcozI9vB1qBg3TSSE
- TLSH T1C9251750762BC75FC6A940321E33D2CCAB707D45EE05AB0372C8472FD576669BAF6282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 342KB
- SHA256 c1c647daee953ca22c5992deb05f5ba24c260dd2d01d036ed5c932856c465621
- MD5 8f54f203485f8b43a03f99be91045de2
- SHA1 2ce6e8887f89aec8d41a44c472d7a01d1ec84161
- SHA512 8687870d8ca2b855bd2cf31ffa9489755fb41545c892e9b68c93801f0065c67e58c1aa447b70aa1dd4b66737c6abbc3dd93d9849fb94bcaa3467f2d653671e0f
- SSDEEP 1536:X6To6hvAgYfS1xu+jN/CgLk881C1upK7BOFuDTUdxcnl9:X6k6hvAg2S11Idu8dCl9
- TLSH T1B874D711F718B31AC0B641724972D69F9B7CF912EF13530237C81A59DCB22AB76BB681
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\{23129418-2312-2312-231294189572}\lsm.exe
- Size 1.5MB
- SHA256 c95782355f25e9a829bb0c45bb7243ffba82732f215c4c6d7aa21700bda23f03
- MD5 bae2d6d3c782733aa49a7df35e8a7796
- SHA1 c4a5f9f4ce6de7d6bab77dc7de27264c1915dd65
- SHA512 e2f781ed05f73714528199af8efb768b831c74fd5b5914a2d178f9e53daac97f8976c9a1e85affa3f4ac515d8a71f8a4b57a10af9bd13703b187ebc9a80d9c54
- SSDEEP 12288:UcRj0PR+sW0ZWENh+wCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:UcWPRfLt+w2cQZXNbpInm2cn8cGorz
- TLSH T15365021131C1C8B7C13215310CE4D6B5A17ABDA10B954EBB7BB11B2E4F7C5E2AB24DBA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.3MB
- SHA256 b23c87ff7465c1d812ddb9f2aba8a48806511f916340da6758af2414d40fa31c
- MD5 5520fc3b3ffe1810bddfad8a9c295757
- SHA1 469fca9702226d328a5762b8eef0645d76e45778
- SHA512 9cb5d970cf074bd7d9d52eb84665c02837f92166777541debd7a240d99c7ae98dd5f41af47d9b2cbc2fa211a3354b54c1213c03d6b7a6d81868c48d713e5a349
- SSDEEP 12288:Dp7QCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:VQ2cQZXNbpInm2cn8cGorz
- TLSH T1E3552301038C4A9FC83D62B1552AC4A970573EFC0B8487D7BA36662A973DEC17DB1ADD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 9f95ca98f74046d199cf15e72657f84f1320fcd222bace89c05c95d48e6ac161
- MD5 c98b11b2e4f8ebf46be64df75514863f
- SHA1 75df3289a4a359b3a885f4a64fb86c24a30c2029
- SHA512 f7fe3b275971a6a4945b559d5f0a19311d1ee4212337130764733d5d5217f594e8dfe5c3a2cd69a181380f9e6f38bc129e9be3c3cdabb59176a5644b935835d5
- SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYi2cQZXNbpInm2cn8cGorz:Ogb4mBIBhGFLcFpIm2cn8Yrz
- TLSH T198659E1E22EC02F5E0F9E2B89DAA4417D6B278161731D2DF1251423D2F3BEE89D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 30b0e0a17197c9b9934e06aa1befcba45f54bf1188e69a8213ef869a508aca94
- MD5 aed5862b51c8737e60483a8a4d5d199f
- SHA1 a5362d385855e24e66982b9726b7f7f1f9831e9b
- SHA512 09a4991f1358b2e6c978bf98bda6d9c91f618cf95d026ab9ded9d4885f2e64e4274f956589b392862ba2adb2116519c0980c16369eed8ba48e6afb98db504791
- SSDEEP 24576:5G88u8FpJqH1wzria7/m72cQZXNbpInm2cn8cGorz:s7ZFPqVPa7/acFpIm2cn8Yrz
- TLSH T17A95F15167E002F5D47BD1388A4646A3F6B2B8250364EFDF07A88B561F23BD11B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 62b25ba49a00065e3282e4fd151552c7aea0fda04497a199676a12839746010a
- MD5 279eac1bc3b9153f8d65dae6bd7147d8
- SHA1 3673f77f4db87fa989c8039e70bc29490b621622
- SHA512 cacf8211d0eee2e9c5ef09f7fd3b661e9718f08cceca8ef70f2caa58ea91c5432d35ccc1d4cc722db91787594e808bb9adf71b4c42ade2dab002b889d8c31fd1
- SSDEEP 12288:/HvUrBFrEjwaQ/CpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:/PUr+NQ/2cQZXNbpInm2cn8cGorz
- TLSH T12775E11B22AC18E9E67AE17D8942864DF3727866075193CF02E1813E4F27ED8BD3DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 a52e98eb2eea91879c90d7109e686bb2ca90a8cbe9523ec7eea4a89540d4041e
- MD5 e1f338a45933ebaf8b6091142079a825
- SHA1 c46ec0e590fdf88b5cb320aff446b4a3f4a10ffc
- SHA512 f04bed377f4e8ff34650ec0e02854302560084bde252887913968daa6ff23fa3d1eff4e90d317f5015f0e6777c420a33e8a87e351a33c8d82eb2d72958da80f9
- SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvcFpIm2cn8Yrz:iG05lO43bTF+m2cnHz
- TLSH T1A9D5C06A62EC01F9D1BBD17CDAC6460BEBB23815033556CF02A486A91F27FF4697E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 f78b830c959b811cc272c4f33a6cd66c517cd7b53b5075bb60ab3f40a86d1f96
- MD5 785305cb18b21b9b2d12d513c6250536
- SHA1 4bb666e07797f631dc9122fd7ef73fe36857a93b
- SHA512 cfea4e5110fa0faad7d01090b4e53e8d722eb57a56b21d98ed40bfad06a9ee7f4c916696b1554be529c67dd1b6e740ae05bb54b250f151f09ccafe853a74e6bc
- SSDEEP 24576:ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnh2cQZXNbpInm2cn8cGorz:qa5POZ3+Jt2pasx2+mXcFpIm2cn8Yrz
- TLSH T1C765BF5EA2FC01D5D579D17DC583861AF5B2342653319BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 76085b1e636c4636ffc5785e68f6e87573c25dc9bed0a8940cca8be2ed0d87bd
- MD5 4cb1f6353390120eb813cc7d5553cf96
- SHA1 35c0474987b70632b66c21b21ce0ce26aae48c10
- SHA512 db7a1e112425d3c3cf738f22dc3a46a882b831890b821c86c7fbe640aca1cfbd767ce60118a456d8fc09b52f6f3e907df9292b27bd669b14099640ab764ed18c
- SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkD2cQZXNbpInm2cn8cGorz:RNc/zEOVHF6cFpIm2cn8Yrz
- TLSH T139857C1623E901E4E5BBE1BE89779546FA71786913308ACF0291851F1E73BF46C3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 4227dbe26b2ff703276a1438780fa27a3e63f398ccea7c2746dba587d4291d7b
- MD5 426c6e08c2d158b284bfe121ca10e257
- SHA1 834c23b9387c5ea9c85802372fd6bbeb992ff780
- SHA512 1e3c6ea97483b0fcd326343468fc31bdd484eaa5d62d58c3c45915c539a5eddad31649e1e01c708e766bea4d56b967c81b1cf1e77cb03d5a2e35f1517fd4cc43
- SSDEEP 24576:Q8kNvNnaFeYhJNtmZBmt2cQZXNbpInm2cn8cGorz:Q8MwBtOmtcFpIm2cn8Yrz
- TLSH T1B355AF6EA6B846E4D1FEC6B5CD238512E6727861073293CB5390C13F0E279D89E79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 088bfa9bece25745df067843950b86366f90ade5944bef98d074011a1f0f62c6
- MD5 3f541b9e8fc52f86d92334265716082a
- SHA1 203b49aaca2b40661489c66e28f97aa34d4a2d73
- SHA512 b2566d404bfc1b74e5a12a0c88cd381e3f00f1b21c029c35c6948214f3095f3b68d1b4ea3d6f1418add93d3c6ca3a480438afbace1177fafb53bf820014d4ba5
- SSDEEP 24576:oD3FHshBIYQgAM2cQZXNbpInm2cn8cGorz:oDVHeBIAAMcFpIm2cn8Yrz
- TLSH T12485E13DE69C04E5D47AD1BCDA638A06E27138AD032156CB16E4C1BA5F2BEE43D39F50
- MD5 SHA1 SHA512 SSDEEP TLSH