abdcd89518c558e4c38df077e17aaa39f40fb33b69649ec5d03c4e0803454f91

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/09/2026, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
Size 1.4MB
Sample260917-27f8msxvas
SHA256 abdcd89518c558e4c38df077e17aaa39f40fb33b69649ec5d03c4e0803454f91
MD5 006b23655b70450d8a62f0891ccea5a8
SHA1 9abf5d891c56d0cfcb567540518a483bc234d558
SHA512 680f9f6dae6c038f727fc1030afbff47534ede4a5cc6cb37dfc17ef931c90dc470100cf18f453891cd26d09d78a3d1e26b2162b215cec23860424a474b05ac61
SSDEEP 24576:Cjt1K4xWWBGeBfPs8w9dvcW4yZs4oo2oTWAuwC04Bhk5OdCN/j2GLl3iFSE33b9b:CRkCT57wxcuZThu24Bhk5RN/j2U4FH
TLSH
T10565CF10B6429137F47311B28EBC6AEE853CE960073939CBA3C85A7E5A785D27E33517
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4720	elevation_service.exe
1496	elevation_service.exe
4776	maintenanceservice.exe
4612	OSE.EXE
4952	PerceptionSimulationService.exe
472	perfhost.exe
5680	ReFsDedupSvc.exe
6140	SensorDataService.exe
2324	ssh-agent.exe
4568	AgentService.exe
1508	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7616ea0d9600bb.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaws.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaw.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006642c56bfa46dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001422f26bfa46dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000783edf6cfa46dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a71cb27fa46dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
4720	elevation_service.exe
4720	elevation_service.exe
4720	elevation_service.exe
4720	elevation_service.exe
4720	elevation_service.exe
4720	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
Token: SeBackupPrivilege	5680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5680	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4568	AgentService.exe
Token: 33	1508	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1508	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1508	SearchIndexer.exe
Token: SeDebugPrivilege	3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
Token: SeDebugPrivilege	3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
Token: SeDebugPrivilege	3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
Token: SeDebugPrivilege	3976	2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
Token: SeDebugPrivilege	4720	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 4608	1508	SearchIndexer.exe	101
PID 1508 wrote to memory of 2668	1508	SearchIndexer.exe	102
PID 1508 wrote to memory of 2288	1508	SearchIndexer.exe	103
PID 1508 wrote to memory of 5624	1508	SearchIndexer.exe	104
PID 1508 wrote to memory of 4676	1508	SearchIndexer.exe	106
PID 1508 wrote to memory of 5580	1508	SearchIndexer.exe	107
PID 1508 wrote to memory of 1240	1508	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-17_006b23655b70450d8a62f0891ccea5a8_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1496

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4776

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4952

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:472

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5680

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2324

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4568

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5624
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2864 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c1d85f813d5c1f7411ec2f814b0acb41dd541e3489bcb7ec4dcaea6eb5b99ce1
MD5 70db2b1de3d04a5926033c70331dc616
SHA1 fdcbbb87a184b4e26f271e56f76f35215c12b73e
SHA512 2cd1e70dd5ca56a68c0543514de9d447efbb4ffd4bda16e1d2fa2351de84c0372f7e3be84a7a5031ed4a68449d0804d7e3293b31e9a7ed8367167ce5e78f19a4
SSDEEP 49152:Jb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnwN/j2U4FH:f3q6mjBJj2jF
TLSH
T110D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 d4e0a2d3550b8315309ed18702004fc7a073e40ee91ac1148db80f50eb5177dc
MD5 4d0e75e79d4410bd76131bf0d4d4bb91
SHA1 093cc2e2a184367034a457c0de1e4a1d30167d79
SHA512 2c9351a1c193a5c2a247d4b3d4d02a73734a10558b7dff92f258892c9a564f0a27c18e614cb6e2a91a89010789338ea5a2a3bf47c2c030fc17ac6d460132ae3c
SSDEEP 12288:V1XLsswWkxy2lRq2czAoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7XYfDtczAIdCN/j2GLl3iFSE33b9
TLSH
T1DA85F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 4c1309d9e5e7b236c7bb3b759ec663effc0f4424a77f4613d88934022ff19e75
MD5 b577e32c6c5698111135ba692daab6fe
SHA1 a1b6d5e196c6758f84858b826cbba2c7eea6382a
SHA512 c27aaf7c427e2deacef22cc34b2bc3f759be56606ccbc7180bcb829588ccdda3467455cf688000aa869c5158347a101eb6c781b7a5110181ccbf62b7999930ca
SSDEEP 24576:u0Le5ji0hmxhrM7dCN/j2GLl3iFSE33b9:uPji0AzlN/j2U4FH
TLSH
T1C0A5AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 32d8a1c3560826f97d4aea20178885322a35be1e8d095c4bc5cd28e202671345
MD5 e80d09369b6a3c447f0dfb0b76f40ca5
SHA1 e9d44f679c1d9f6e035bbc6b4c07c35a7ddcd978
SHA512 3fb7c8c50e6bb5fb0c37f528649df7bf1b9c11495bef91f1d0df560ed5668232c8035bd0fc753d88e13f466b84e7446ca015965261070162fcb7f0d52c361ceb
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWj6q8wyuxdCN/j2GLl3iFSE33b9:H/ezSC6vUzPv+HjyBN/j2U4FH
TLSH
T139755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 af14156d259dc06178182c996e43a60179dcd9166a2801ff7cd4de89bfcd2496
MD5 8cde1a0502e560f6d7f30ab32b7d5992
SHA1 56080a1cca5d02f8c69d7380ea713a3771a9724b
SHA512 fe2cefe62d8735ab43a9ee6824e287a1dac65f478c385a6a8261e8a218c9fff536800c1bb61a08d4c94429bec94d507968e8050256a49247077cb85c28efc97e
SSDEEP 24576:bVbqPb88hv/l+B8dCN/j2GLl3iFSE33b9:bVO88hXl+FN/j2U4FH
TLSH
T173559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 ba25ff1fdab96e335774d54283687840da7c670ad1cc5193815e78fa4758b503
MD5 7a517856725e0aa5e00815d7d7621778
SHA1 336ba87c953cc6ec1ccbb52f822a4658705962f0
SHA512 fbbe1dbf5646e43a46ec431c62b032989fe3cec68f3d34f88f27c7cdc3886248658e601b2f443b27aa551eef156a0f067e33ce32e4a652412a2c718a2df79b9c
SSDEEP 12288:hG/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH4:hGvdCN/j2GLl3iFSE33b9d
TLSH
T105652364DAA4B565F6AF837903ADDE615200FEE8E525884786917BEF117CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 59c5b08f972e7b3f47db5796a5cf3f723e248d9d3f015b293c9f91fade37a8a5
MD5 6da091aa3353bbeb5ab375f420956e25
SHA1 bebfc5b1ce77214574db34b754a719693dcf04da
SHA512 51e4e2731455c34890ea4f4a8d4c22497f742e6d92c16e1a4eaf3a089b744fc1e3fabf33295be57c126aea98a7294acb9f2ca9175bfa25bcf4178a3158b3911a
SSDEEP 12288:ReBNUbTVO86UsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RJIUEdCN/j2GLl3iFSE33b9
TLSH
T18E85CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8955061b8a797a02e93f42170cdbde10179b8525ce5e1cbe3f7802955628477c
MD5 c288457ee6f7b2be328abffbd1ca4faa
SHA1 c36376bd0c536a82efdcf5838fa08b97554a6099
SHA512 3950c4bd18deebb8debcc092aebc148e89df01ef60f5225007eab8f3421669c77673a0b61a89418f20f9835c671fa6b9a780819d7accb3767ca41b244a2e09ed
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THO:/QvGAdlCEL8c/WRNw5Cuj2jF
TLSH
T106267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 e1dc5748d1a94c33009f250a92715ad03b2f7f347628eef5ff77e38ad1cdf3fe
MD5 bff9229723d1193c74b3bb03f08ea68c
SHA1 b4bce84722921203113ee364289c9ea9c67eb305
SHA512 d40188a449eb5ae00de78422c42dd77bd06b59f5247e7832a6ef23a2362c132125ee80d1cd8c8742052df8fab219da057975a46a4598f5e9bee8a40dd8a43aa7
SSDEEP 12288:3AwSfxL/2Dc3mDLLmt0LDQewsAjeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9i:QfewsAjSdCN/j2GLl3iFSE33b9i
TLSH
T1B995E031FE74E436C2BF0DB61B36C716142CBA608B6119C3E3E84E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c62f5e0f4235efcbae5412772e881279d71abc69a03168a6083c822420519cc7
MD5 73379d00599704a0c68a6220a084c341
SHA1 73afef1e7621052389b51cc81a7b5f161ff1572e
SHA512 dc8948a1421b01793d38e75367acfdb8a5509b67e9addb2bc23e96ccaea5a29bd49d8954fd6770c3d47cf079fbd0d5c5ce6b747d934b30b6d9002e0b24bb19ba
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHD8F:zUEtQevvqc2W1cpV20I32D
TLSH
T10E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ca9e7172fd7971532b2d140d96873ae9a1fc58610f85cd55617b5280e9fdbc99
MD5 0495a07365bba4e9522c581acf737d0d
SHA1 ef9c0f7847be97eb1895f4ffe30ccd896c87551e
SHA512 b8bea3d7321f33a52dfb1c3406e22f35d3300a097c4a634b3bf13b41ce13a2169c5591051fa55e49fc87c7feeb8ec3872ce3a56cac24aba9a76214507e1e2b04
SSDEEP 49152:CCbRquA/m2yL5zTfFiV+XenmE3/z1N/j2U4FH:HoquVjnmyj2jF
TLSH
T1ECD58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4c47dd2714b9ad4c2b713c06b9d9b544eaead41a5e5efb6dc440bf4aed59d0e3
MD5 3afc1f4f1af0a6180aa9b2d82b8e1e4d
SHA1 3953ee484560613b3a959dd354b2c42699a0615e
SHA512 fcb23faac126a9af88c65d2b509ec8813a02e9609075e3a183f01945358d4c71a543631109a2ddbeac4b40ead60a623fc04760377dda7b79b4939d243bd9782e
SSDEEP 24576:6AhGL6IFoiwtA5l7S53tdCN/j2GLl3iFSE33b9:6AM5Foiq5SN/j2U4FH
TLSH
T19135AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d23d7a63947ece62612d97497a324414ccfc58084e5dbfd309291bc515a0e57e
MD5 a2889c891527eaa5b846cd5b7901d5ab
SHA1 4465e26a99623070c3e1236899b57a48af196c4c
SHA512 6dcdd04634bcf2d6ecd6b9bdd5f17b579190efdfd5bc9a6c390c739fad292a9a3bf6e70ceb193f63767c8272e10751ee31210a74fc4d12a848de09bcada30aea
SSDEEP 12288:Kmw5HEjsChNEBFgl0WDm+C1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DwuROWedCN/j2GLl3iFSE33b9
TLSH
T1D685F14576E41CF9E96782398697C536F7B2BC512A21CB0F0360C79B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 f0fc4861be07e5fb8b785587ec0d8c8abaf8f0191a6e75b0658ab6acf66a6a9d
MD5 883eb25d325aa3f63d78f66565b30798
SHA1 fd69f28227226a06165d5d884aaa68b1f7919e26
SHA512 a6264dbbcaae6a46073c99e085270d1a024174f76aadc7af9a1f67de0def2413ed6794b958008ca1c46f8b5438bdcabad129c6d03a4f93f0ad07aa186351691a
SSDEEP 12288:AyZ1IyuJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FZujdCN/j2GLl3iFSE33b9
TLSH
T14775125933E471F9E1A7823C8AE59A05D321B8A5A73243CF026146EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 49824c848a4353d9c9b3c3fcd6766bf115ec31b67ab80a018a4d7e6cde3eaeab
MD5 97952f1715213e721a3d788fc50b4f28
SHA1 b8c3263987abc7908ea83c7fa6cee1d3791f8bc0
SHA512 7dc3d486c0b8a88cf268ddaa6cefcf9fd7f2f70efc1386741fac3f9858e690dae1fc0fb438f1c38b7757994ee88ee11573af36173ae3f31c4a740a7e75f75210
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UK:FQRQyi36YOcPDLvw2gAf+PN3Vj2jF
TLSH
T11D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c94f5a03a2d143f472700fa563221e763d0ab61be40a5a0dd1286bb64d181aef
MD5 9ca99792b4c72f706c2799067a8aa1ff
SHA1 d56f8a0ca22a9415940f41249c7a0d970bccefb2
SHA512 fa0ea1d0389c214ac4913d3454eab1ef5d21e62cb830d199ba4c4f4185ce96ef08851ec7858455abee8d0b3bb591e1a4b0229ed8f7cc7689d277950b2a66e724
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UK:ZQRQyi36YOcPDLvw2gAf+PN3Vj2jF
TLSH
T1BF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2c1dc1c2c2263057d24a7aabe350ad0c2e395b7382ba2506bd68c938639818d0
MD5 a022859bedc3a4297616a7ee865ac55a
SHA1 0dff9293a83a4b65a743aa5c7b1d5fca97637194
SHA512 e70503db49766c41dec726a4a0962d11df13753fd9e3d89e98524f905a8d702e4a1434261e05dd3d36f2bc39791dbc1be2ca24e90bbeaeb654d6e9f759d9c429
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0zdCN/j2GLl3iFS+:o68Qg55nhkeWu7PNU3/lN/j2U4FH
TLSH
T13AB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fad81861d860a1bd296d236272ec30336c76833a0af5175ed64870f01f2e9510
MD5 381b38618ab40ff7b64352392f35d411
SHA1 5c8102e81dc1f8df31bb1fb787ddb259a4f9d72b
SHA512 f3fd3f6b971e119f9e802c34aec875b66fd8f21e8201a5c2cc2bf0aec4af65e12418f9286b1d797c2ae180742b129b3def2380202e58a4dfb8878e7a104ee177
SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk998:ky5112gYy5azzVvU69nLKnhZwj2jF
TLSH
T198168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 edab7cb22d9958ead50df41467e0fef56effea168e8aefecdce6e00eb399077e
MD5 6d7b443ea8d7832e1e399a8a43585452
SHA1 2373d6cc717e3ed64791cb9dbcb67ed1ba9982b0
SHA512 9ebdb3a0813528c77f14c470381b747e23d54b87ac05db5713b48bc4c7a3470db808925fb27c2b959f13947b6c292c5b75f6eb02aef5c8097800322cbc74ffd3
SSDEEP 49152:HB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glDN/j2U4FH:Ju6JmIxd2dNj2jF
TLSH
T1E9D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8ddfe2d130f6778b27916cf61a7f14d3a3d23273e5bf42eea7b4f14a347767ac
MD5 170fd8f57b3fca7c99c7612e82c1f050
SHA1 31f4ebed256fb4592b21d25ac66f0b24eea44a27
SHA512 910136f647f8f4654086e699bc610d768654264655787c4732a194a7fd7abcdc32d3fe1fd0a617d0eebf761a27237fcfe04006984286dc2ca045625c26f3b199
SSDEEP 49152:K1hpsNoJpF1A67U44CwH7R4xPN/j2U4FH:KmifPqRyj2jF
TLSH
T171B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 45fd097a5a81d7579c356bf54d029c2c5fd9861407abee90b393eaf04a809dcf
MD5 2595019173bb275daba4c6cba92fc729
SHA1 d897282bac6ef3d296d6c530d532cda8229ec01b
SHA512 8ab58af00f26d7349d37d4860ae83f5da88559acb5726d62cfab88bd0b336ae73e855a3cc5374c2927af5bd8ffe8c64dae88260e7508682d5cff85a171c26899
SSDEEP 49152:2SuZQIY0Be2KkRVtOnks6NMHqgN/j2U4FH:Y5dKqi61cj2jF
TLSH
T18DC5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cb8fd54aa5e4f413973175a13f860a83fe834538e23e75ae08ad210b06321b4b
MD5 308a89fea349a2a721b314eca9857b9d
SHA1 531ce260a4211d82938e4c9bf3b89212575a7c99
SHA512 09dbf9ec8ad75559adca9057830d368e14754b978f8cc9313b034244a2d0a25303ec786147025e5031ee8ce5402ab0a7b8688cd71a53f314b348495e16ee688b
SSDEEP 49152:6htSn8EApI0figjgiDn0AP5wzN/j2U4FH:7X2iWphWj2jF
TLSH
T12795BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 bcb2c3ca1e575b6fa49089ec30646cc54bdcc53c51415be321c39f82f84d7901
MD5 b0e0290f74faf9beea0acc3e9ec85476
SHA1 8846b7a3b662e8b07739fd6fc78b02155c72ca2f
SHA512 def184a23af60fd76419265a0a33c19b0baabcecb0329d23c48234552c94553f509245af26d7c7e9be4140a236211b30b2c145e8c103aea88b5c75dc328867e1
SSDEEP 12288:H3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:HXdCN/j2GLl3iFSE33b9
TLSH
T185652364E9E5B669F15BC37943A9DF515100FEE8F626448786C166EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 d57dce682a604f046432bfdca186c4cde2d208f3eee427b9aebcbac2883fb00e
MD5 a1d471b71c055f29df7bf18b4f6612f5
SHA1 e3c7161f604c41726c1e419e00180cead5716d48
SHA512 626308ed95a7f8da5b52873190f68fb1ddaac881a05af2bce184b60cc8281e9cdc399511183bce57735cdfd9f35fd7aff2936bbbbe66706ae58d0afa6866fe54
SSDEEP 12288:cKJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:c2dCN/j2GLl3iFSE33b9
TLSH
T13B652364E9E6B669F15AC37943A9DF515100FEE8F626448786C156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 803032a18a5e6b705e216b6cf33b21af3b51232d45b5c5c9ca6d400b0e84289f
MD5 f128d3094df1116946775b362bd5e2b7
SHA1 925348c8165f4a22d2b544d8c8121217c759842b
SHA512 acfd5711a4e0c56a87b6fc1716815cfe337598a58d62af94a61f3387f8eddbde9d976e1f267a7e043f0641592903ab3b70583fdbc41c8665857dcd277c5366a7
SSDEEP 12288:kkJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kMdCN/j2GLl3iFSE33b9
TLSH
T19B652364E9E6B659F15AC37943A9DF515100FEE8F626448786C166EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 cc33b2875965fab44b84916b33d4c9ceb1a0c876f207cce34bac406f5032e9c0
MD5 af710707a7b847593a250bfcb4beb716
SHA1 4f856df05b837d985fe3c1409ad87a4d6d731d3f
SHA512 3273f8bc345b16cecb6ae4c936a893f469c331e8f60f9d0612ef43afd1f6014779852eeda34a9cffb4d6e235ed72319ecdb6dc9e5fd422d0c9047fb5534d2248
SSDEEP 12288:0VJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:QdCN/j2GLl3iFSE33b9
TLSH
T148752360A7F561D5E46BC37C83B5DA21E220FDE8F732458F87410AEB1B74BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 fdd34c17f57a8f88a517fee800d6333fb2d66074d1d788bc4e9edb6b5bc9b80a
MD5 46df5c4df50a6e69da3a1e84a5c18add
SHA1 4103ce6ea0321c80f93d026c89b14fd77fd642d9
SHA512 7c17e8f8f0f5f295d2b43ba75f6d2905664b15d55b1a7989d06d5a04292917b58b186646feb560fc330060584a161ad76b16dbd164d1b8fb707439ea3c9731d0
SSDEEP 12288:IRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:IldCN/j2GLl3iFSE33b9
TLSH
T102652364E9E6B659F15AC37943A9DF515100FEE8F626448786C166EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 bd9e56e8e12c84053cde756676aa22db90e69b0674a5493ab226add9e34904f2
MD5 6c623937f0edd43c7e61cd937a70ad40
SHA1 2f84aef6e51e2bd07525947860b1dcabda5ac8c9
SHA512 6c60dddf84e4b9dbafde3e2d12f0feb2bcf0f8dda72bac41919d4f628d2ffc43198b5ac618c7f4fe9d91f92422a2a42ba9c59dd0dc53d72cc464dcc72b6911bd
SSDEEP 12288:h2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:h6dCN/j2GLl3iFSE33b9
TLSH
T1CB652364E9E6B669F15BC37943A9DF515100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 f4904f2cc39a89b914bea8c162f6e760b7eef5a019d9b8b2baec6c47d9678158
MD5 f9291d5cbefce55d4d7435d1c755e14d
SHA1 fca2d4cd4e72de59e4cc0456f4b464c45348d774
SHA512 836b38dd2483010990b67e194db782005601b17e08424433fa58726dff71bfeaf15d1b90631b8f4de83570660ea5d41e561abfe1f60d2bb78e6f3c3ac8df51dc
SSDEEP 12288:ayJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:audCN/j2GLl3iFSE33b9
TLSH
T1C9652364E9E5B669F11BC37943A8DF655100FEECF6264487868156EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 2f5b3a5918bc0ff2c12801432da7f81cbfb5f9af730df7fb2ada0cb29690d789
MD5 7ea3849cfa2fcbe71abcaa8ab7afec55
SHA1 d4d5860ff841529ec94f1b11f3f8594963b0c619
SHA512 395dce6a767ec5ec3e0baba94ff4c6ffe45d6e82f2314b60656aba7fce66e643f33b11194f01149b88ff1626c6833a8334d139e60e4ec84525bbb942a3405639
SSDEEP 12288:NiZwbDzzFEoS2cPvyqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:QZM3zFVSOWdCN/j2GLl3iFSE33b9
TLSH
T1678502A4B39018F8EC67823EC9658916D2B1BC595770C60F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 3097bbb26de34e31ba6f9338218ee6786f8d5077ea3f0b97f44b9ec4152b593c
MD5 c8eefe5d13d4f900b81dc4845f25ac83
SHA1 c71ecb0ec66007d3ae917a8fb6b42b0c68bed621
SHA512 621025ef1afdaf7c62651d759440d650e8b10920e806e080ec132efeec4a9bee8592bdb8334a56d159c1a1eac531bf42941202ab4bc06addc1321706467a70ad
SSDEEP 12288:ILJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ITdCN/j2GLl3iFSE33b9
TLSH
T12B652364E9E5B669F15AC37D43A9DF515100FEECF6264487868256EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 e5aa446b57fb1be08cdf1631631553e21f9c6cbe86e381bb3fa88b3ac79510fe
MD5 02598c98c00dab48e32e29dad7249915
SHA1 eacd9ad8afb9d9e33f12c1751da0977f7d490326
SHA512 e2078b4980666f777deba5959fe8e716876d5a9ebe165284c1a655aa57469aecf058d902f12d3194b79930623f7b6e099ff54bcc0f13afb879808a42b920bddd
SSDEEP 12288:jPJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jfdCN/j2GLl3iFSE33b9
TLSH
T197652364E9E5B669F11BC37943A9DF655100FEE8F6224487868156EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 6276660b53220818371b18f455321ffd20fa43e875416463458ad9ebb2bf355e
MD5 f1d63f9a9e422b358896a2a2b29d95d7
SHA1 f9cc4f34143ab1d2e2c26300e5df1be583fd7bf3
SHA512 944726b5a80c25f040311d6d3d5f35a10f0cd93b2fc250e2fb4f81c6815b9832285294f0d64b01cf24bcdadc7c1c21225009539dbc3217c08bd4a0de967a35c3
SSDEEP 12288:DyPz5L8uJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:uzyCdCN/j2GLl3iFSE33b9
TLSH
T194750217B3A131F9D177823889A55A11F331B87597208A9F43A007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 3c12ff393430a16ec11a71699fd830672c3fbc8484268bef9c5edab11b9fe7ae
MD5 2d167a800461efae55dcd18d15ff4981
SHA1 fe27c16b69ad4d11081966a2da8d707d0dfe2264
SHA512 c1b0dedb1905f023d93e3df135685678515171c56ae6254645d210b92c9c80e5a9545c0b6ef5502b222c54eeb660ce14c23cb9461bfdf51e1f9d18b3645cc1e8
SSDEEP 12288:WLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WTdCN/j2GLl3iFSE33b9
TLSH
T1FD652364E9E5B669F15AC37D43A9DF615100FEE8F6224487868156EB637CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 c37311568fa6295b8096f71c593d1bef8ac02bb340b94f66ceeb21010599a748
MD5 f756696e40c53cf54e15c1ba7e202e4f
SHA1 db045e05c273d8f951680513077820ef9bb5331e
SHA512 04b2a2cf0a9ef732eae8d799716dc429c19882cb19fce4ce7b2626e8ab0eff8c9a834726e9eba3cb755bf166c63dc30978bea635ba03d2496a6e7b65ffd520cf
SSDEEP 12288:ZLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZTdCN/j2GLl3iFSE33b9
TLSH
T194652364E9E5B669F15AC37D43A9DF655100FEE8F6224487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 aad6d40dbe35e02888c9cc1bc51e7c45cc28507a013856b5e6f7d7a2f5e30bed
MD5 4ace230c575419d465f6dcaf7cd5f81f
SHA1 94cabc7b3f0b409a107b3a1ba5d7e794de78711e
SHA512 6590574c8d8ccfc1c3eb0e2c9f537a65f9ba3c7c29fa92d0fb9c36fe8adf709ec4dc76571aee55c745e63acea6a064c6b93078a3dfb4e5a69898408abffa1899
SSDEEP 12288:PyPz5L8uJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:izyCdCN/j2GLl3iFSE33b9
TLSH
T1A2750217B3A131F9D177823889A55A11F331B87597208A9F43A007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 9ba62aaaff8ace78680242da2405becc07018c35872afbf1be95119a7a7a0a2a
MD5 8add82cd0c77ab60dc2105fc635fbe60
SHA1 978f57232925c1c61f870a90b6445d6227cd366d
SHA512 2a442c472f1767c2aa8ab6430e6c8805ecefc2122bf422af80a78251d8dc80daee20036ba0e925cbfd0b6c0f33580562ca963eef4e755f27956f6334aa92a15d
SSDEEP 12288:5Cd91WYoaLHF3z0z04PDvhUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kT8aLl3z0zDcdCN/j2GLl3iFSE33b9
TLSH
T1B48502A4B39018F8EC67823EC9658916D271BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 7fb729c65b6b42f9b86ad2599976c07ce6020f7be8c5e5a542caee2db7f87005
MD5 2204d4d7704a30379ae1e11824c4cc45
SHA1 1babdb3e78b0c183238e42a794def87fbe887513
SHA512 c0aba82d4d5800a59b0ab2cbc05f48225f82d9d3b161cc44727e89d9b6c275e7f85edb5f4f29a75f23ac096bb73420b5e97de2fcc1611161bf07a6d8af32d1c8
SSDEEP 12288:1i4e7+RdTfgwCHKy7GLbbdIvdJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:13rd9CHKy7GZwdCN/j2GLl3iFSE33b9
TLSH
T15D95CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 c2c9ceaed565aaeebbcc78b0fc47b299f5bb019cd49e191a2a93062c99366d85
MD5 1d9bc4da1edb1f0d6e0af7ef04e1efa6
SHA1 4ce38948538ea1242472abd404e43f0d3dd8a46b
SHA512 71e07cd09c1e49e2641b8b5488ba0c5cf0482167b2d4ebf2d085e5188e101f0546e33085a180e76265fa8fa40ae8ef4d01f7f0771be8ace32bbb3803ce17eb76
SSDEEP 12288:REJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RsdCN/j2GLl3iFSE33b9
TLSH
T10C652364E9E6B669F15AC37943A9DF515100FEE8F626448786C156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 f0ec4854a544211620a69016cca2357791bebc476ed32182573a7968c0eacc63
MD5 8fd5941162ebde91751811fd64eb5b3d
SHA1 a1511dd32e62528ca659c0f22a2fb65c6839f448
SHA512 fdaea2669061314833e8e1ec13480d959983a76b553d3b94ca6570c32a9c5001451f88db8afc94151b363c6e37e496d0926f226f6348816af85ebdfe36b92f5f
SSDEEP 12288:qOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:qidCN/j2GLl3iFSE33b9
TLSH
T1E8652364E9E5B669F15EC3B943A9DF515200FEE8F626448786C156EB237CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 a040bf6108a59baa105d8160d340733f19070512ddcd46990b38f91f9e97ee44
MD5 8acb46b9c77cd541b9b0d633466beea0
SHA1 98bd4ae495d2fd110ead9c005d7283755f90d88c
SHA512 b619ef267efa8e38d1abf72ef49b4ecdc2e7a8fa525ae22505cb05f895b2d74201dd1791514a6121da14f49ec386d09dd962f44bd7279b0dbbbac505e57e0800
SSDEEP 12288:4dJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4JdCN/j2GLl3iFSE33b9
TLSH
T15E652364E9E5B659F15AC37D43A9DF555100FEE8F6224487868256EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 3c873d531530273b186fa7de4e1cef09834f23d5011319da7aa17b7357aac091
MD5 057302b3ee6762008516cf70b7f5e112
SHA1 3348d0404a4c45f3ac24a73cfe6c6dcad205674f
SHA512 b3966e4088834cbb3ffb5f796e9a514e67798f1c9a4f356ce65480c7a9f64c09397c44497d6e51f67ab11a7049fb817af49017982ce706cb8e87d988cabdf5b2
SSDEEP 12288:QLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:QTdCN/j2GLl3iFSE33b9
TLSH
T16D652364E9E5B669F15AC37D43A9DF615100FEE8F626448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 a06601a49a64dcba2d546203e789694ef2171527347505328bc2105abe7dbb6a
MD5 59be4fea1ddbb5a266763c99296f41ab
SHA1 11d8aaa366960b422732eb3738f47e1d7736647a
SHA512 50f4a25385edbbfc0be3d5e1931d8385c1f0feecda16d1c9d7c4ca3acd1b4e7213bb492aab12323029e84e7c701e38c4cb93790fe43b53d8011f50d313787c50
SSDEEP 12288:YEJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YsdCN/j2GLl3iFSE33b9
TLSH
T1A5652364E9F6B659F15AC37943A9DF615100FEE8F626448786C156EB237CFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 7582697da8128288012b6a4da3b4f5d5a32dc379b633b1c84e0d44f8fc4cdfb3
MD5 183d3e6240140441c30d17a45410a925
SHA1 dafcafcfece2c526d530c6115b4f47e6219eb00e
SHA512 056687b89b9094d0b58e9d6b11923218fd19248ecfd53810470f75b3abc0dbc9f5fcd4143181d71820d1d00a391be7d6a14c32a772182280118f8ae77ba208c7
SSDEEP 12288:mzJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mLdCN/j2GLl3iFSE33b9
TLSH
T102652364E9E5B669F15AC37D43A9DF615100FEE8F6264487868156EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 57f918a11a0800d8f8a5eff08e4fde6f74982ef3b03bc196a5389a50a4bb0def
MD5 311258e968eb9bfd1f05268a0398f354
SHA1 3d7b7a4993b3ced64dfa806e872cb951fd6fac5a
SHA512 31684014fa5b0b586352920e397ec3d6e746b54e0ec5ed111b945eb179a70744a561b10ec9ddeb00a69fb4481f32fe886ba7482379920dda41a4757d6c3f5757
SSDEEP 12288:gRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:gldCN/j2GLl3iFSE33b9
TLSH
T16D652364E9E5B669F15AC37943A9DF615100FEE8F626448786C156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 fa2b627d49b63d0d566f10ee3f22b55be49b5cff11a51c0e5edce0f9805faac5
MD5 34113d76997cbd7dcb08d80e09f798fb
SHA1 569b4544bf300003e7296cad242d2b2aa352e248
SHA512 4c3d63c318941e54d98b4cd094f744f895a2a17b40a8d9265a7c1b1bc55a651887c1b1274b0c34cb496502641ed838a5f9f9ee14c931f379f63797c6d44b168d
SSDEEP 24576:Jfwvzk9RX6wkyAIPdCN/j2GLl3iFSE33b9:oMnYIcN/j2U4FH
TLSH
T16D95D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3e64b695c95b6fb31576fd4445cd67018069150c160a2d8a817a5b34199fce04
MD5 39e21b5ae2f7154d7daa39482667f911
SHA1 68af16cb71f90b54c799b3e04a748fad65c1d16b
SHA512 6b7d6db77ee60a6ee8d4cf269d871d63729dc45362ea5a2704ae4a00ac3e129b5fb2e0c4a408dd1dd66075084589bb485353efeb8ff5460f88b0244c6f633246
SSDEEP 49152:vYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0TN/j2U4FH:SySzP1j2jF
TLSH
T11B067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 61bf812e98f5ae76f98cb4a5e40c031aad2d6716ef58fd48b129f3c4efd189e4
MD5 4be43921e46c260f8bdb198bba156d94
SHA1 f585f97278ee9be3347be2ed5998f987d0339ebd
SHA512 559a498038acb4a2d139e05a22e028bbf0c9667f8675e662ddb942793232d489e844796b4223d2ab38b4aa4d77cdd83a175afd42907d3c415f3a8c370f5a0ce0
SSDEEP 24576:z47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYGdCN/j2GLl3iFSE33b9:z47JUQjqirIhCnDHUPfF/DN/j2U4FH
TLSH
T16665AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 1e11f3b44eb8c4c2fadbc3d98c4c3050b249c41c6e62bbc776027d5722561dcb
MD5 ab9e6ad3c9a3d02fd7efc183ea7b2d93
SHA1 fa263601b0b3595f41b2fcd45347060f0d5387bd
SHA512 97b3ffbe4a4cdd2a19b599a383407e8864204e7b99ede2d75fa2b3cd7ff4ccebcdfcc42672e663dcbe7ecee89d156fdaae75320afbf1e5d54b8567c5086f56a3
SSDEEP 12288:Rpsf7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CjdCN/j2GLl3iFSE33b9
TLSH
T1BB750119D29412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 2d1ade40020093635e4c744b3120a1bead4b86cc0da95b75c6f05ee95d493cf6
MD5 75752da75f3340076dbccc78bfc31b1a
SHA1 782f1becffd7d2663d32cf1bf0a1be574c7d92f4
SHA512 44b396f9d0109b142d01a50ae5727832f12a1301c53561d80981e704d9089003313bbfd613123fbc9141c5ac2823e7b71f1c50f2025593947850f4e7b5d00d6b
SSDEEP 12288:celCk4U3fDEq8Pr49MlMsy9bFMLG1jmJ7zxFAZqdbE:celCVUP47CCLG1CJ7zxFOqd
TLSH
T17F3517007626DB4FC6A940322E76D6CCAB707D12EE099F1772C9473FC576658BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.7MB
SHA256 e53e39d277772e6039f11fa030a099e653448a21b9adf1a50478518214d4bfec
MD5 6932120dbc67ada03b3d8ae4a5512cd8
SHA1 dd9ea8dee6fc58c207e79b27ec84ba2049f591c0
SHA512 7064c214479af4c8611814612cf1a53b8a4f06e0ac4c103a8f451b281d95409892983887f3866de2621e7a1d5bd5b5d16e2a207d2a612a27f35804feb59423de
SSDEEP 12288:V8ZLjsL34UcZyK0Gqg1q4pF11CxSVVhCYfU8b:V8ZLjsbb6zlXNpF1UxSVHhf5b
TLSH
T181854B015577EB4FC9BE4033433296CCABB4AC16FB492F05738989399866A1EB5F23D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 afaa0b6069db0b2c8430855413a2d98a5df3c8806e2fe31b0e67718e06f77aa3
MD5 56593c41370d5c91db3d752f56436146
SHA1 7eb019f983c022ce36a51e9f1ea4864b22a4025e
SHA512 9b41db5f0fdc03082f472d261aa4c982bb0b594985dbbe971e013bf866d71919a18627d5bccecc7927a0f5655ad8d64c94fb1256bead985c1b53d677ba50683a
SSDEEP 12288:907jJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHh:2bdCN/j2GLl3iFSE33b9E
TLSH
T11C652360D7E9BA55F47A837803ADDA216200FEF8EB1184C7C54167EB6278FD8D832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9b91fd1b56675992626bf3d1964f6fadf6b7f3e326ecc3a22bb01880fcd8565f
MD5 b3de610c264d61e9073cf18774510b2e
SHA1 236e23d54091a09c7f967ffa02fe1c30d941b598
SHA512 c0dcec6b0d5dab4fbcbdbe72be990250fbcc2ca72773f8b9f609e075f6f25ba6a007d64d709aad017734f9e41163f65e04e592f402546b317013f2f2970605fe
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYxdCN/j2GLl3iFSE33b9:1gb4mBIBhGFJN/j2U4FH
TLSH
T16B65AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 2ab21d7fcbffd0bc430895b2c31aa9b4901c30f3c2bc7b37062c2dbd748e3bc0
MD5 7ac2b8215a57beb42152053edc11ccbf
SHA1 746ab65ec44e12d08e4045e5f6312d1eead0639d
SHA512 2a20dc95087bba990edb3721662e43112523ecd3f4c6c6cac80f3bc661947fa289b6becbcd18737f33a13d74afb2e1c3c282df4d65ae42ad41622d9c55134965
SSDEEP 24576:kG88u8FpJqH1vzria7/mWdCN/j2GLl3iFSE33b9:X7ZFPqVya7/+N/j2U4FH
TLSH
T1FBA5F16576E101F0D47BD1388A864663F671B8251364EFDF07A88B961F23BE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d310b466f369ecf1efeea76634765cc98d5b389aaba3c9cbb536015236b57550
MD5 b8af6eac56f9d40586989de1a832c9a9
SHA1 80917586ab9d32e3dfa965d95a680ea606947dcc
SHA512 da179a8fb2731125d05614fe571689f8fa79f8fe7ca36b8eb6a48bc07489ae3208857390abda27c3fde8b010f40dbbcd1883cbdce3fda54d46b64447c945ae31
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdN/j2U4FH:hG05lO43bYj2jF
TLSH
T192D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3ef6b7d3c19a652440e4eeb9501ffcd56aa91d2b85288146b9238e92ad252e5d
MD5 22f33c64bf8bc4fa49a5684110666994
SHA1 7f35acc856400f1f5168912acb8be65574a082d3
SHA512 10481d923594478bfbb79c6ebe152ff5b947709dd971b001885f2fe91acaf593e46c8450d0729268efaf7016f748473d28dc76aff4ee3cd90d6e0f3e11b28682
SSDEEP 24576:qfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnodCN/j2GLl3iFSE33b9:ia5POZ3lJt2pasx2+mlN/j2U4FH
TLSH
T1EC65BF5DA6FC01D5D179D17DC6838A1AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1c676997502d6b229db6431a166d71f45005c239c6ff37589967a1efd7d11ea9
MD5 540cb184d14914ae1329458a78effef2
SHA1 1b3341ab39d6334145b2291fce33ef56ad383b49
SHA512 cbd828069a917729d1216f6ebd7b011502cea2897e979f6b8a28950c3a03336c160db6565d2d068ff7b978b3a46ddb476d480f3df79eba6ec68201e20e6280b8
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7Fk+dCN/j2GLl3iFSE33b9:WNc/zEOVHFeN/j2U4FH
TLSH
T19F857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c0751e78f2e8e1e64995f3a1e7617de626677d84b9827343f2fdc009bc0933d0
MD5 4c397ac0a40ce484d0f344e72b1ef649
SHA1 8156225ab6370ebef2a734cdca9f7bdda73f513a
SHA512 6abcb9311f1a52c97f4a9f896d5003206e606956109cc6f71093b9b18030e856e248f2442d6083e28904483deb010467582df442c8c2cc4bce097cb36815723d
SSDEEP 24576:AzkNvNnaFeYhJNtmZBm0dCN/j2GLl3iFSE33b9:AzMwBtOmfN/j2U4FH
TLSH
T17655AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 89fa0e0dbcf100ccb5a15b4761a105386f7058b7c7045e573337fe8119dd9e27
MD5 ba1525405cd32c4162508763da388a66
SHA1 bc8539937529bfb6bd06df0765e4d0031eac3398
SHA512 7a4974dba43c8e856522466278ec1c6673752c778729c97ac4bc6f66c5beaa8d3bf327e7705db4c3b54f0cb6cb48e0b57104acb821b3dbe3403c144bb8c07eaa
SSDEEP 12288:2HvUrBFrEjwaQGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2PUr+NQqdCN/j2GLl3iFSE33b9
TLSH
T11F85F22E62E918E5E67AD17D86868719F731B8615312D2CF02D0817E4F77EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 5fd540790b1a243c63c4df4e262b689d111df42d888ca7732687b9487443d496
MD5 23c2990f750a29533f79b86e745cda99
SHA1 4ba25ca17845de41b6726e1adebdc80c4ce5ce2e
SHA512 7714c7cce8889f0ae4ba8bdc4ed1a85bbddeaafea3037f92fb52800b0b7028d76455f2dd0d65b458deba0b2c54672db01389fdbb837acd0256a5974f4c56a835
SSDEEP 24576:zD3FHshBIYQgA3dCN/j2GLl3iFSE33b9:zDVHeBIAAkN/j2U4FH
TLSH
T1FE95E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA1F6BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-263-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/472-77-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/1496-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1496-119-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1496-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1496-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1496-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1508-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1508-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1508-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1508-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2324-108-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2324-114-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2324-107-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/2324-305-0x0000000140000000-0x000000014030B000-memory.dmp

Download

memory/3976-7-0x0000000000B50000-0x0000000000BB7000-memory.dmp

Download

memory/3976-80-0x0000000000400000-0x0000000000574000-memory.dmp

Download

memory/3976-0-0x0000000000400000-0x0000000000574000-memory.dmp

Download

memory/3976-6-0x0000000000B50000-0x0000000000BB7000-memory.dmp

Download

memory/3976-1-0x0000000000B50000-0x0000000000BB7000-memory.dmp

Download

memory/4568-129-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4568-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4568-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4568-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4568-121-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4612-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4612-198-0x0000000140000000-0x000000014029C000-memory.dmp

Download

memory/4612-54-0x0000000140000000-0x000000014029C000-memory.dmp

Download

memory/4612-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4720-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4720-20-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4720-21-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4720-14-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/4720-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4776-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4776-39-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/4776-51-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/4776-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4776-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4952-67-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4952-73-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4952-232-0x0000000140000000-0x0000000140298000-memory.dmp

Download

memory/4952-65-0x0000000140000000-0x0000000140298000-memory.dmp

Download

memory/5680-88-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5680-82-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5680-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5680-276-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5680-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5680-320-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6140-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6140-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6140-95-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/6140-101-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/6140-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6140-306-0x0000000000860000-0x00000000008C0000-memory.dmp

Download