78628d5d7c4c3d999b54b18950284abe6a8cc293c0aa09909d9db21aa5cac37d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
Size 1.3MB
Sample260924-dkgnwsce98
SHA256 78628d5d7c4c3d999b54b18950284abe6a8cc293c0aa09909d9db21aa5cac37d
MD5 be02f28310c0b01943a131f98079c802
SHA1 3d709223d2d674a8dc12279eae4ced0fc29c3cc9
SHA512 533354811a81daecfba50a5df2dfd865cf0f3f4fe0f2ce2ceff03e63e046d9f80622722328c064245df247ec0a9eb0f6cde3cb848a686b4486cbcd40914091e9
SSDEEP 24576:l+eTX+7Fro6JjgUexZRcCpLFn0Q13Kc1EyRLBb07vUEypqlMohWG+:lDTOxrgRcCpLLKcGa1qFypq2o4G+
TLSH
T1FD55BE11F691B039E1B325F149B9C1A865A9BC30DB3681CB73843B3D1A759E1AF36327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3632	elevation_service.exe
3492	elevation_service.exe
5872	maintenanceservice.exe
2108	OSE.EXE
1172	PerceptionSimulationService.exe
572	perfhost.exe
3604	ReFsDedupSvc.exe
5416	SensorDataService.exe
5412	ssh-agent.exe
1336	AgentService.exe
5800	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e198c78867fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9bba4a8d14bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000114092e9d14bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d84defa6d14bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022f27da7d14bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\explorer.exe,-22002 = "Disk Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad13aba7d14bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeBackupPrivilege	3604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3604	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1336	AgentService.exe
Token: 33	5800	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5800	SearchIndexer.exe
Token: SeDebugPrivilege	6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
Token: SeDebugPrivilege	3632	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
6036	2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 3796	5800	SearchIndexer.exe	100
PID 5800 wrote to memory of 1888	5800	SearchIndexer.exe	101
PID 5800 wrote to memory of 4484	5800	SearchIndexer.exe	102
PID 5800 wrote to memory of 4916	5800	SearchIndexer.exe	103
PID 5800 wrote to memory of 1532	5800	SearchIndexer.exe	105
PID 5800 wrote to memory of 2340	5800	SearchIndexer.exe	106
PID 5800 wrote to memory of 5032	5800	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_be02f28310c0b01943a131f98079c802_amadey_elex_remcos_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3492

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5872

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2108

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1172

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:572

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5416

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 2908 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2608 2604 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 2908 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2608 2604 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5997b26da7ce7ebfb47558e0c87ca70a4bb390a0f0ff2225fd00163b1bae3a58
MD5 3a7e23535459a541ecbd0aa7e08f7aff
SHA1 f0eca346ae8005ede7b8114bb079c2f9fb74f9e6
SHA512 abdd3ab5e814260000cbeb1d9992f494ac2b86a5fb95a97a42f81da8e6867e03793f728c9dc057432190b7fb97d66654af7a7cfd8034aed3de5b572e957ed2ef
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnoKcGa1qFypq2o4G+:63q6HjB7KcGa1ixb+
TLSH
T189D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 b6241931334d866efabf2cc7abc9ea4ba8336210f87283e9ea986f7749764375
MD5 2954c56687a7d4d44192fb81b035f737
SHA1 aed719f9fd94c9aa250921e32dccc9536c37ad72
SHA512 9427d42e5012923174a03ba9bdcebffa61b0ff362b13e1a287db183e19dbe46b492a612898e3be2ea2b0b330dc0219fd7955d78a9df22f73365f8d1ee6192b55
SSDEEP 24576:3XYfDtczA50Q13Kc1EyRLBb07vUEypqlMohWG+:itcaKcGa1qFypq2o4G+
TLSH
T1A685012967D408F8ED67827CCCA2C511EA32B8954760E7DF03E499291F332D9AD3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 399058dab043f06e431136abfd83aafd6ba1267c536e6fc825ef0c1f0851f96e
MD5 40523ab559d8f36feeff51424c71b619
SHA1 11a20f851fc057ec8e3c9bfc335ff9cd56736ea0
SHA512 05952d028562bdb02f054e971846bf19f8c54e457ff6243e081dae4a9c3cdbad6f06f17984580e199698ebcb374777a295ea259a94c82348931a5eaa85984f10
SSDEEP 24576:A0Le5ji0hmxYrMu0Q13Kc1EyRLBb07vUEypqlMohWG+:APji0A21KcGa1qFypq2o4G+
TLSH
T12D959E26F6748331D073C0B9C5D2A69AE97130855B308ACB4296D77C3F67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dde64dbb313ee90c3008489e52512cc11602b7118ea647f1bc3f4988768fe605
MD5 3fc08b2483ad2729e260c2a269d91a6f
SHA1 e2b9fab9af5e443cccdabd4ac2ff99d47f4f1cc6
SHA512 29814a37edf618cb965107eca3ad4a423427c2ea6cd0f7ceb31e0d2d7fa5667a2eeab3ef735a132624f75e344a5a04124b20b0374dbabd04feb7424baf3cfba6
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyug0Q13Kc1EyRLBb07vUEypqlMohWG+:1/ezSC6vUzPvxHjyJKcGa1qFypq2o4G+
TLSH
T148755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3f9f4931c78064c8d7d650c660bdb54e52ef2774aa3ec68b8299bb543637c8ca
MD5 1c0e4cb24f369f3e2653c7ed5e1b854f
SHA1 09e3fac2045d37d21f67848da4ad4f558530f73f
SHA512 5cd8a6f00dd6ff24a6f2a0ecaceba47afa72ef08ec853eda35b5156a0b28e0e64a9ec10f8e2d291f9188ff1278d85bc06917b4698584087c11d392afdd95cab3
SSDEEP 24576:MVbqPb88hv/l+610Q13Kc1EyRLBb07vUEypqlMohWG+:MVO88hXl+EKcGa1qFypq2o4G+
TLSH
T198559E66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 09a78caaf2ecb2f1efe32ddf53d8ad102dd574ebe9ae493b7a4aa6541c7f541d
MD5 cf80db2f49c751c09258a738127e0946
SHA1 886ffb6e8214fd24568903a537dd12ed233794b6
SHA512 d62431851e64e1199d062e3c465a3249d669f512a0275ed526cefe0261ba5ca11dd2f27a31825d04767c0e5a5b122a38f3f4ef154145389db3781767eab51523
SSDEEP 12288:rSa0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:rSa0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T1D66523668B8400A0C3825BB07DB9D4F5B514EE848A9154FE72717A2D2FBE483F876F71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 b7b6c51ef19c680b9546e1018f4e86d68df3b7bd6f84999de90428c6f93ca2b1
MD5 afd2c197a599d6fd9b7e5e8751bb591a
SHA1 bd3c0509a1540a120c5ee28b362b5b12f3dc349a
SHA512 3f7a41cf58582aebb924743c730d282a175fa0c6669044ec56b021cef8340e0b768b70623527b66d1f76569fe89e3209f040e112954ceef6d1a9f96058ab3873
SSDEEP 24576:aJIU90Q13Kc1EyRLBb07vUEypqlMohWG+:aJIUzKcGa1qFypq2o4G+
TLSH
T17E85D03BEE28ECE1C27A8DB85A91C240E77278704F52A3CBD175830E9E235D15D7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eee42a94586add894a0e90dd476de9a2d9d672649e7dc935b5de7c68922a7ebe
MD5 c185c230a57bfdb7391501e588c4dddd
SHA1 b993a2cb0fd7bbe0d1fe8c5c707c8b5b8f8aebfc
SHA512 784d1ad16483ad62507027035a2099a6d9919dae7259182dc62ae2b9a5c6ca351168ff790cbf12a1588de4a93d4400095b516c6826cd70a5d1b6fee035783339
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:9QvGAdlCEL8c/yRNw5C6KcGa1ixb+
TLSH
T1F4267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 243202904f704e40cde5045bd587fb50940c5076974e72213b730b4f52f24dc1
MD5 92a598323ec17ce10b43dfdcd8fef6cb
SHA1 ebff269efad68877b56cf0c7695e1a8e6108390b
SHA512 c7c6513153a13d7781f58ad8c296df3d75a3c4aa05a1b0a0d0be7220b88525e12a059b2efebb98b3210696767dd8aa5ae73b6d6b3e91dcbf47e21825a15a0d7a
SSDEEP 24576:RqewsAjf0Q13Kc1EyRLBb07vUEypqlMohWG+:UljlKcGa1qFypq2o4G+
TLSH
T1C585E031EE74D036C3BB0DB22B36C716642CBA604B5119C3E3A84E9D5A742D26776F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f8a374e5c80026515857c8cbfc6b210ace757ee9fc57d8572c1e0b3651e4685f
MD5 cab8ba49516d56519f102af378af6de9
SHA1 b8f27b7dfeff92f11fc4fb387a7c18424fe9cf8a
SHA512 63acde0b6d995a0216f357625d1866e163299ef4d618d531b6f1aef05c315d592663e098c3119ae04f265fb6e7fdcff1e5ccc6b2c7e1cd13b130a066806ed08d
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHdKjK:jUEtQevvqc2W1cpV2EI32d4K
TLSH
T1A8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 897e771ca776caaf686298b22ccd015bb1da2f34d1c7cb71a8a8cdc28d69ec81
MD5 1da69c7304547a6eea963e8974c8d3cf
SHA1 9d34459f6ee27b4538640d0011e4f41c28b6ee7d
SHA512 bf4139d90d409631f3cfe0c95c14d265bcd7a6a5d56c68b25ee5c17095b382a01b5d46cb3aad6363daa4387986ec3b23db0e8c9d628fbc4244ae074734899c60
SSDEEP 49152:ACbRquA/m2yL5zTfFiV+XenmE3/zFKcGa1qFypq2o4G+:JoquVjnmeKcGa1ixb+
TLSH
T1F6D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8099a9d065ce74b863fcb53e89c6a7c62809885c15446ceef6313dbfb96c3709
MD5 c1435ec7afc152a341e84353104ea2b9
SHA1 b901d16f540e6ddc0ee564d26818b25fb74bac0f
SHA512 6e79a01216ebd9c1d14d874613c12bcdf2e783af152526cd0c9c1ed2806bb4d56975d5f063932066fb6bec51592c23ad2dec519afd844f23f335d4e13d2aa19b
SSDEEP 24576:jAhGLJIFoiwtA5l7S53U0Q13Kc1EyRLBb07vUEypqlMohWG+:jAMyFoiq5OKcGa1qFypq2o4G+
TLSH
T1A0359D81EBF945D4F5B3AAB899B68171EA76BCA55E31C20F2160D11F1E33A40DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 7f8c34dfa1aeee842b2e54c5c8fb9f32753fa970b4956b07caada6150f242990
MD5 1a6d85865ea8b3b461a2548766100763
SHA1 3e8c8174013363c77217de17a9a1b5b4879c693b
SHA512 a6c474944f880e3c51cd7e99ae1cd7f3d9daa698ae485fb46806c71c8f6e1c235ec5898161e3395b1dac8f9f7c9bf137b403d3ba20873e19001a7cbe030a494b
SSDEEP 24576:ywu1OWz0Q13Kc1EyRLBb07vUEypqlMohWG+:yw6OSKcGa1qFypq2o4G+
TLSH
T1E575F14667E40CF9E6A396388997C136F7B2B8012A21D71F1760C65B6F37251BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 1056d1454fcf05e6036210a0d21029f6539f46cf5c56abdae9182a009e15b656
MD5 ba8e4ffb67955d5bed7e310aa4021af5
SHA1 62f35361a0138cb62879730a9ef203789723b20c
SHA512 8041e373502aeb7789016cf7e812d7ba739fc2c74490c2a4d9eed36c37bba3fc7c72d8d59d8ffbea92b0551ad6317ad3e99000490d0b86870aadc3186c688c3d
SSDEEP 24576:3ZuW0Q13Kc1EyRLBb07vUEypqlMohWG+:VKcGa1qFypq2o4G+
TLSH
T19465125A27D400F4D2939778ECF58595E371B891677243CF2260466A2F77AC2EC3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9615ee81123f4b990524a1ba188453b04c052410cc8240b3af58eb7230e9b02e
MD5 284e620643a276bb22592c4d5968b879
SHA1 857acb5bd9ecf7fc407d64a0aa5218ebed3bf4e2
SHA512 2a1983db31942205aa2c88a5d9cdf31838bcc98eb721cee7ec9a3f4cb52a6eeef3e3f108088014a8561c93354e2bc5929681ad7ce9a25eed1d36265acfd3b3c8
SSDEEP 98304:fQRQyi36YOcPQLvw2gAf+PN33KcGa1ixb+:uQyiKayX+PNHKjK
TLSH
T1EA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d04e13665eefc20b2bd416b893d13f66679f14e8013cdf244765ea3552c45d8c
MD5 6f0f663a820d9f89ca3cbcd85068a3aa
SHA1 684b8dd9ffe53cf9f7780fc9ed0594882f76c819
SHA512 67d094cbb91e6e26c5c4e47979b7faa57f3beb52e5966a6d670c6ab7075cff1a91e5a86b291d2b5dfee2c662fe4d3050dfa28a7cce86682db65968d8b832bc81
SSDEEP 98304:EQRQyi36YOcPQLvw2gAf+PN33KcGa1ixb+:LQyiKayX+PNHKjK
TLSH
T179667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 27fddfcd9bcec2e36618ec6cdd48f5adb9c790597161e5a99756fe038365a196
MD5 a7cef9709e2a0aff2a660859eb887f2c
SHA1 1ac499ae8110db1a36c838cb380c4a66a09d37a0
SHA512 678c9bbec0edbc0e55986cf2743711e8985abbbbc1dacc843df1642412d65dae386a4ae0feda4e4a15f6ce22a23344b23bdee08e43cd45712e428368845dc9cc
SSDEEP 49152:b68Qg55nhheWu7PNU3/1KcGa1qFypq2o4G+:lthWRc/1KcGa1ixb+
TLSH
T140B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e3a7b579cc4aff25d080e74a3e1f0a86a192a145c9d5698f185000c5b06fff30
MD5 95a76ba6f1c5c876f995462588373d30
SHA1 66e8ce03e948c0a8b67020cdae9fc5513292ef88
SHA512 15934df2baa3020c16a54baaf050fc45c7f640f8e83f3588a8a6af95653762c2e4261150f160c27a992541ec1b2676d30e19101f5360fde502475a679d630df6
SSDEEP 98304:my5112gYy5azzVvL69nLKnhZcKcGa1ixb+:XLIHmWh2KjK
TLSH
T181167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5bdfbd14edc02ba2da4befe6c882d0483f555b48a84606b8c233e25855401f24
MD5 4ae7f9682c17cfe43a27d9ef4fd83ec2
SHA1 45add34337b8263a27a11def8a3d12fe0e39b56b
SHA512 5a8d92e501218727c31a36cdfd25bc82b27b9981b04bf8fd480c5d70f573815e3bb36a5e437e9ded3dd7185e4f4e3d678847d003447d66f0dfa77c1c32ee6bda
SSDEEP 49152:oB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl/KcGa1qFypq2o4G+:iu6JmVxd2d/KcGa1ixb+
TLSH
T101D59D13F1D901E8D05AD578974A9233FA62BC490B34B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6a038a5d15304ddceea9473a78cad1a6fd3cd00481bd24b4b19bce0f8d156ae6
MD5 d9849b32fb1ed1c40a8dfe661858850c
SHA1 abd4e244b59ab29d47fe7621c456082700efecf7
SHA512 65a713978786302c05f9795e2fedd2a9311780d335dc3106b2d26068b651faf200fee228206f5575eb00e5a0b8c2abde1a04d188905f18a29e4379fc078ac289
SSDEEP 49152:l1hpsNoJpF1A6UU44CwH7R4xTKcGa1qFypq2o4G+:lmifPbReKcGa1ixb+
TLSH
T105B5BE13F2D900E8D05ED17887569232EA62BC450B35B6DF0A90B7962F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6b55fc9ca1b80be27f6da94f5981335aa4a92956f0565df556e3cb07820b04b8
MD5 bda582e4976791ac081eabb3cb45bcf7
SHA1 69afdb0b1a4dbc33d06395cef3eaa6308077191c
SHA512 77e2ea0cd80e292f9227361bc8a12df51aff7e270ace4eb6074d295d365cc7cd11603b49f5653625971f73c28c40bf7fd04f87738d9ff68c66053982e305a288
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHqYKcGa1qFypq2o4G+:w5dKTi61YKcGa1ixb+
TLSH
T10DC5BF13F2E940E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 24e27bcf573fcf1516c36d6400b668c3cd12419cba454394e9b71c2779ac3d6e
MD5 fb9f00ca40efa76e77271ac2f5031bba
SHA1 2dc7354d71d221cdd21047a492f9e8d8f4a43209
SHA512 037e082b252201e0c39ba49b49fddd33f2d895b8f09e26dbaccded477b84a0a92e13e98b59fb64891343943d583111fc5be2a49f80b0de0a902062695ee7676e
SSDEEP 49152:jhtSn8EApI0figngiDn0AP5wvKcGa1qFypq2o4G+:CX2iyphyKcGa1ixb+
TLSH
T1D695BE13F2D900E8D05ED178C7568632EA62BC050B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 52235944070f4286e8253eded7a827f7e2cb80bd1b162801e74887184eac8c03
MD5 f4c21717170f362437ba7a1b67e7530d
SHA1 bc1e3e8346880f97e7ff377e971215534afe57c4
SHA512 d4ffa733e5c2a036a6ed2270451ca16944c3b02bcf14179130bcf2d2aeec7ce4dda1b70e72bac1297f8cd6646780c72c7e54baacfc71285af7412087d5ad92d4
SSDEEP 12288:ui0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:ui0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T1A46523568B8804A4C3415BF0BDB980E9B514BAC4EB5250FE736515292FBF483F87AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 262820351963f5839cf89e53600c940cd75897bdc8fde9957fdeb320e3a04739
MD5 d8d896939779b1e9ff21c62af9e51729
SHA1 1507c5c36653145b6fc0783e79f7629ab1db73e0
SHA512 22edf3e61832d17e4f742058c36ea4d241af66c334c743f60cf3db052f82587224887d5679e681ab39744f04e3b7a0f04223228651c1469cec1822ba581362db
SSDEEP 12288:vr0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:vr0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T1596523664B8804A0C3415BF0BDB980F8B514AB84EA5250FE736555293FBF583F87AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 9c92a841908931eb88ff5ea29a659f05fa8d242e235172bb24c5fae3c79db19a
MD5 efc67f423e9064493213709940286cb2
SHA1 286a0ae794ec6c67f0968173b9dc47f73666d354
SHA512 b61c1a3418fc6090dc9e0bcc1f955f56e0993fedb23d12f832f58a9f7189a98b2e894d6afb079e1d618db05cff350000234c3252e649faa6ec35a2f6e5654a0e
SSDEEP 12288:El0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:El0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T1AA6523664B8804A4C3415BF0BDB980F8B514AAC4EA5250FE736555293FBF483F87AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 11d0ce590b31619fe29ff8f681d49067b7707a99ba74f0425fc39c73004ca836
MD5 4b341d031c7be7e2afa7e5db42d8bfb2
SHA1 51cd8de7dbd9d96ab1ccfd45434c5c5c6b64e637
SHA512 69b67f85a51b73494bfb626df10d47b8a5a01deea176fed88f98ad390489a8195287e08c3492b32f2b24fa4985956af485c550b0dfee912859c298e6494d0c46
SSDEEP 12288:gV00Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:t0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T1266523564B8800E0C692D7B4EDB680A5F274FAD4D72252EF7761091E1FBB282F875F60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 d7b3ab3520d76ce2da932a77a32272ddb7aad57c1bb37b387fcadbb96caf0518
MD5 9f24d439dfd5605147ec48c9e99c2807
SHA1 38a39833bed76380a36a036eb401b65ebdb8942c
SHA512 7cd0031dfd43bf9da3a871f69c8181909d3c8d1a3f61b9a3882cfe2b840c5c901b08f600110aeaded6faf2b0ebf3e0da35064b2327af5014abc4b3ff98d64c3d
SSDEEP 12288:fs0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:fs0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T1FB6523568B8804A0C3415BF0BDB980F9B514ABC4EA5250FE736515292FBF583F87AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 a27f20eef89525057e101bb06b004a9cb45e547b63d759ad15bb768866631bfe
MD5 6ea94a8343d76122c7d99d0de055262c
SHA1 3dafa3b102abac1b162c34301fecade9d84b4e31
SHA512 35f59d84bb0a3a93c19b2e13cf793261b88e02c796dea981b8f9e52415a9c91b717113e8f0f1f8c56a6803caaa34c9472a44140d232fdb82762b19d40c2a8f1e
SSDEEP 12288:9n0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:9n0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T1586523664B8804A0C3415BF0BDB980F8B514AB84EA5250FE736555293FBF483F87AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 bfb45b79a388619a8735d9e53f0dcec19f566ec5990f937362fae22df25610b6
MD5 e6884b8e68fd226c0f7b59f51507c94f
SHA1 63c8414a0e94d6bce8e36586316af84898c47085
SHA512 94e21abd7c53a00a5cad7789efd1493f264843ea140e4b3c3662142de6e01a529469bae9524f86f01bd97fbaa00fec8c37d886cabab1c0aa883fdb0c4a373d77
SSDEEP 12288:hj0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:hj0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T1D46523668B8404A0C3415BF0BDA990F8B514AB84EA9250FE736555293FBF483F876FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 31ed440e8bfbb1fc85c5d3672d52440900248c04c8e6a66d70422293e4801dee
MD5 143de40334dca0fa4db634c99e77b75c
SHA1 c67df6118f89bcb77e45bc43bbe5e911d0131359
SHA512 47d89a197dead77fe170e44fe0a67afd6a922e28fbe14b17a2cf9d5bf98d9f6915a5bf387680e53a357abd30d26efe80905a260e9b6c5dfea23d080cfa76f6bf
SSDEEP 24576:oZMtzFVSOL0Q13Kc1EyRLBb07vUEypqlMohWG+:oZMtzf9KcGa1qFypq2o4G+
TLSH
T1048501A5B39008F4DD63823ECD658916E2B2BC594B60C65F13B4362A1F373A15C3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 c3f38b3fef743202ff8e59a61bb77e9ff7ead9d6df7b3bb64f11264cc2c12c40
MD5 985b1bc2c8ad6203dac698fe90cca52b
SHA1 1e0a018c08ac99657156095da290e3c6b6adc810
SHA512 2b6884bebd62fcf522888d5f8429ba57ac2a5f27805f1aaae4b3e1137ec58f5e0f57c563770419c6334392ad6303d9307001522abde79b4ed41770793580dc5d
SSDEEP 12288:gm0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:gm0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T1FC65235A4B8804A4C3415BF0BDA980F8B514ABC4EA5250FE7365552D2FBF483F87AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 eaa6c776ba25c481afbe26e4c7d5ce72c62c152e1c96faf6b263ec477e7830ab
MD5 6b25eacf6a83ae0a3baa0d8ec384a246
SHA1 5959827d9088caf754b3c1decceeab75765a9879
SHA512 9fbdb54c1e579754e02cddb1e92a64af206c98484548fa57cfcdf868aa53fda62b8802134b7e9efaaa61f50cebca176914e6c3764338ada6207c457bc3eea698
SSDEEP 12288:oq0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:oq0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T10165236A4B8404A4C3415BF0BDB980F8B514AB84EA5250FE736555293FBF483F87AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 4510b25d5271d17b08fefef44b603f4be17cb7ed8cccf0ba2f8a0aae0cdef564
MD5 ab8badab02872fa98acc40f8d7b39890
SHA1 c53ceeff54348ee9ad141a69d74450cebe68377a
SHA512 04d91e6f084589ffd830516c8be54d0e1a519fa63e1f1fc9ff0c93ce45a014ac7f2d6ad88b7bb866a326c347d7e7b5be7ebaeb3e61d9c4a89aae0c6663255393
SSDEEP 24576:5zyv0Q13Kc1EyRLBb07vUEypqlMohWG+:5yKcGa1qFypq2o4G+
TLSH
T12575021767A520F8D2629274CCA25951F371B87547208AEF23A4077A2F3B6D1ED3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 088177e4eff06029678fed367ce4cd74a23ac5735b6b0a5501833a7ab97b5783
MD5 7ddb1556333d067cd6ff78a6d603c6f1
SHA1 0b124b2568420c4df537714d509605bf30687274
SHA512 6af5af04ed192e8f3d79d1156cb25d485c35fe3fb1d9053c86d1cdf999707dd9874fddcb36c91fd84760bd9e5a0e0541cb337ce377a396c93c1ef926aa8144ad
SSDEEP 12288:Vm0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:Vm0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T13865235A4B8404A4C3415BF0BDA980F8B514BBC4EA5250EE7365552D3FBF483E87AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 cb20665bfa5b89b57a8bfb0f8c51cead1a1aff28f8476c02ddbb468b3ce1541f
MD5 12c8adf1f345ea32cf2a475c9d7d6fed
SHA1 cd85ebe7c05c79a499e237ae396e638d69ddc8a4
SHA512 b9eabcf1ed6c58b0c6cf132f682f095b3abaab1dd4c029a6a0814796c19f18e086fcf809e9ee5c530a28aedbd58dc56eeb13c9178195f35e9aeac4842af0364d
SSDEEP 12288:Gm0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:Gm0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T17A65236A4B8404A0C3415BF0BDA980F9B514ABC4EA5250EE7365152D3FBF483F87AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 5e37bb30ab18280b48ddb66365276d1a83541092c6f588e3ec949114a49f4ac2
MD5 8afeceaee6b12b7bfb0a0595a147ed9e
SHA1 9acb67d79557d8962728b9e51d2b5aa9fa3f8928
SHA512 5287d7087870a0eff8bb9413fab7868122ac055e49414cd34b4d3d459c701b293be86ddbfba171701a89c6d5d696f66ae4f1650c3fee2377a7cf330cffacc5af
SSDEEP 24576:tzyv0Q13Kc1EyRLBb07vUEypqlMohWG+:tyKcGa1qFypq2o4G+
TLSH
T12C75021767A520F8D2629274CCA25951F371B87547208AEF23A4077A2F3B6D1ED3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 34a86093198cf9c628ea4c2f0c1717c5c29f8b7a563d5ecdf3dc9780ca485970
MD5 3e9ce44d13cd4145334aa8a74e3ae98c
SHA1 702329960d5de07d748abbb1f06bc88b4956621b
SHA512 a3b1c9ef9550ef7e250584f68b27293618c05935760a9e5443079749bbd5c06ce8dbf3692df58ae9ca476c3f87ab950fb420c8ffabd34d34f4285fe5cd4b7e62
SSDEEP 24576:OTWaLl3z0zDV0Q13Kc1EyRLBb07vUEypqlMohWG+:OT1LljKKcGa1qFypq2o4G+
TLSH
T1128501A5B39008F8DD63827ECC658956E2B2BC590760C65F13B4362A1F373A15C3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 335c4a60f5ec11443daceff9a5c5f15934ec25f616d98e85117caeff52265eba
MD5 ae7add640814aab3b9dcb6f2a92974df
SHA1 0bf9e0cd2afa201a07f3dffc01c7a2b7b7bb3256
SHA512 1337d00b01b6bee6e50cef91d083648d1c8527971aad6ca395d0bebaedab570b9287aae609fca4c13c056e05b16e92a442ad355c589280437741888b07bf94f1
SSDEEP 24576:63Sd9CHKy7GZh0Q13Kc1EyRLBb07vUEypqlMohWG+:cSd9CHKya9KcGa1qFypq2o4G+
TLSH
T13995CF90F3E400E8F1B39A358D768511DA767C995B31DA8F13A8261A1F33AD19D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 472bc944a1579e44bdcebcea7126f6a06a4742288fe24f0c359a9a6f35f69760
MD5 aaa1b91cbe5717eca4a1ab999a6c1231
SHA1 bd59302f85d0acb2ec4c5dd9f4dad726dde027d3
SHA512 3e4c96f626e64bdae7386966194d10feabc38d8524eafa75bc18ce143f923fd283cb96a0561adb1657c3b7d6365658ce5046f65ed023e4288b031a5ded33ded2
SSDEEP 12288:RF0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:RF0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T1356523668B8804A4C3415BF0BD7980F9B514ABC4EA5250FE736515292FBF483F876FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 0c3e71f4c56bbbfb2ebd63e141a30306c6f4dfca110dd10f3720f3bd132a71d3
MD5 c74fb9529bb3fba61b890bb3bffd0a0e
SHA1 018021c213742a6518f75525f569011cb0b7c95f
SHA512 47c77eaa59c6fcb706bb169af7f7fcfd54b11b927b8d4ad68b29b04ee6c0fc10d4b1476a5b5ab5c02058bfc77900431256f959988febbc69384eb4abf1e60b05
SSDEEP 12288:JP0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:JP0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T1B565236A8B8404A4C3415BF0BDB980F4B514BB84EA5250FE736515292FBF483F876FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 73642d2dec8f9684914b8ca1fdda54290e8db4fda0dc99f27730c47cc3accb07
MD5 24989d11612b7c3b915cb63011f782f4
SHA1 31ce2b79e918a7aeeadda7042c6c04a84d05a78c
SHA512 597dc2f9b9b7184e1b79e148629a43fba5036dad703245494599b50034546b50309842c368c3bd8c295b22738fdb1cde39f6b90bc2bc55381c8d4179e672319f
SSDEEP 12288:XY0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:XY0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T18F6523664B8804A4C3415BF0BDA980F8B514BBC4E69250EE736555293FBF483F87AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 adba2588f1db704e6048541c82eb4eb10c24e3742a7e311aa9cabd31754dc91b
MD5 9bd07c40cc369fc555749f34fecb4401
SHA1 4b1ec4ab5b4a122d66479b662f305164a0e282a4
SHA512 6c411c539d5f0e7df42aa4410e126138c11b4dfba8299ca2c3d779521d4e876b4f9be91db2eae74a04be95e9f81ef72c42051787fbdfbc5134892afac9bc392d
SSDEEP 12288:Xm0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:Xm0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T17165236A4B8404A4C3415BF0BDA980F8B514ABC4EA5250EE7365552D3FBF483F87AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 9dcecc5519f93103111cad175ddae08eb33baa97547199ea87ff51de96c9e570
MD5 241d336c1f0ffd9ac8d56666843cd863
SHA1 f6807bb0f792260c1f67cb568fea871e3a2adf70
SHA512 376b267c989c536abb0aa5abae5219ca865acfade77dbe053a601fcdebd5b94ce8cb629ef28623b1bb343ad2878c0544a26d58052ca29f544470ebe67fc6e988
SSDEEP 12288:PF0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:PF0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T1106523664B8804A4C3415BF0BDB980F9B514AAC4EA5250FE7365152D2FBF483F87AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 aac0eec5dec428846edcda3839e7f37d1522db8050bf6422d8d6e1e08642ce59
MD5 f02f5c0a297cf98670d476bfe1abd162
SHA1 d4e08ece11e932d822a058c961897b45ff23108e
SHA512 6bc793e23f094047d43fecbcfd86b33d2e708a745b4b8a1e260745ea437aa9a076491d21ff0d693703e702db66230d5d7d394e6b9d17837b41a26bfe33ce2496
SSDEEP 12288:re0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:re0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T17E65236A4B8404A4C3415BF0BDA980F4B518BBC4E69250FE7366552D2FBF483E87AF74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 6eab11a31214360864fa5a6b8feda73903db2f5daa5aefa3d780471a98195410
MD5 7736bb3af2b298853ba41b86000aaed6
SHA1 c2353328173b1e5d9da80c95c256ead04f6fe8dd
SHA512 fdaeddd7e235313602cedbd9d0461347521ebc9cfd56ac9cf0deefefbbaaa559741e4e331cc468ba859d29071c5662b908cd670e6334728ff167c2e9bcbc413a
SSDEEP 12288:Ws0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:Ws0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T1436523664B8804A0C3415BF0BDB980F9B514ABC4EA5250FE736555292FBF483F87AFB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 bf7d4579d8327831377a18822f5804c5b61ddb9d568b4d64d36b48509d55ff69
MD5 64d20a071774b2f68bec5bfb668c8a80
SHA1 07c4ce694109f8e7b39b378b040b88c816b5d24f
SHA512 4ca8c45489f525dd003a4bc58f1b2e83216ed878a3e68276debe234b5e8b9d78ddba901fbe28258deaab3eefddfa66f4c0dc5a96090e885b8a7ccb2f22552076
SSDEEP 24576:ifwvuk9RX6wkyAI60Q13Kc1EyRLBb07vUEypqlMohWG+:oMnYI8KcGa1qFypq2o4G+
TLSH
T19995CF29EBDC04E5E1B7923C99B7460AF6B178581B31C2CF125A536D0E37ED4AD3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e40bba82aa01c4dee99a2fdb4ff8c6c07ef44afd3dcaf60e92e98ab3c25d2069
MD5 d68aeb8507048aa8fd711fb1f3920395
SHA1 aecf1a50e0d3ac4ec936376cda0e2153238a87f4
SHA512 02f36a6892c8aee88856c1728993b3c78dec9dde79753d3f0c11a53f8f316e3cb981bcd54a75d55eaa89437491161e1fd70c6600c714565634a85576093195bc
SSDEEP 49152:RYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PKcGa1qFypq25:5ySzPXKcGa1ixb+
TLSH
T149066C56A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 92431aa773df5ae701e7178cca488602907449ebbb12e57298a55d827e66d24c
MD5 ac3da4003a2b6e463a0f2d645c2fddbd
SHA1 4167754f1d59e3c5398eb6c711feafb2328c09d0
SHA512 a25fa939823129a419d4c10193c3515ea2a15ab812f1ad589e0fc800b7787f8efc83d2a812dcae4d1d663cdfd137c834c2a6685385c780f4944af2e22f451a9e
SSDEEP 24576:I47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYb0Q13Kc1EyRLBb07vUEypqlMohWG+:I47JUQj1irIhCnDHUPfF//KcGa1qFypx
TLSH
T1F765AE1EA3EC01E5E1BA927885154A5AEA71742D1F31CACF2270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 881ac31716715fb6f3308377881934d5dd333faab5b2858103fc07905b867623
MD5 ef4b0a7ed5c50d9059741f8c76785c75
SHA1 ece4b66c7b7314ace24d013c3eb619eec1164943
SHA512 fe0e0558287c7951513c50e49c120c6d7f989174aec943af76e0e1bacae385a12ce52b19efdb9148cdf6419fc517b8f2df98c591b0dbcc0aa00f5fd92e8d7cc0
SSDEEP 12288:KusfW0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:6W0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T14775F01AC28801E8C15E6275DB568681B3237C6487E1D3CB63D0F53E1F7A681ADFAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 ee5c7ecce996f7715aa649bf4ba8f1040696ea72e128a3d2c8e8a9d9bbf51a13
MD5 d70455f67a325eb14cf3a91464ac409a
SHA1 b135f5621da7524d151549edbb9310e9c7afef9d
SHA512 655a729ecae309250e618432cc8d39f36ec38fb632437d54c69483ebcaacb62080d52233fa20fa1c1fc98eddb234463219879bcf4811dec62f37c619a849ccc0
SSDEEP 12288:zjpzU3fzPiPeYh97KHkqppBTGyTINfATtmy0sql:zjVUPLi97MkqLJ3INfGt5l
TLSH
T1953518507626CB4FC6A940321E33D2CCAB707D06EE056F1772C9873F9576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 e3ba6ad5cfccd84bf9b263b3b22e26f79705b526b04d128d33affbb74a5618da
MD5 aae128859452ce921822495931956a53
SHA1 ad5887ffaf6a46c293aef8e6a2e503da87f15b5f
SHA512 2ab420fe5b948e7235760b4f2eb984757169b3e36881689cf23a179b79d9b002a41308a87f86e30189928beec06422c1970d0a4d0aad19b077fa5589950d1fc5
SSDEEP 6144:6kOENxqXorqWEDJRpm1xbAt9xzi/gJZRJTvvEtMxZvEtMxd9RFfOA5U5F8rG5EYV:6IrdURpO8ZRJTnW5OrqEYft
TLSH
T16C650980A537E68FD1B76032072A5B8C7B64EC17B7056F2273D9493AC86A755B0F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 7670e452f3323cb3dd69f5eb8bf9dede5082e65d583922626182ccf2146d99fa
MD5 37684f5f594e884d2a4fb8423842b0f4
SHA1 adbd5a12dfcb8709c691dbff363065db9cab26a8
SHA512 a54c2a3ac275f8a3ca72c19c99995a3bced4ef8546817a9052098f7a1920ce090e802daf0251ee7a1f73546a0d370470d1ce37fea84d10b2394e50293289293b
SSDEEP 12288:VL7O0Q16K1DW1JYf1EqBckLBb07X8WUwTypzWlMae2GVGWDy+:tO0Q13Kc1EyRLBb07vUEypqlMohWG+
TLSH
T18B6523268B880860D2A15BF07CBEC0747118FA949F5190EFB225166D2F7E9C3EC76F65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 95e17a695bf2bcc863e18fd6fa4156451e4f8c739dfa70982aabc17eb66f9fb6
MD5 5ac4241c67271b3cd4709eb754842d32
SHA1 89739fafdaa53d3665dd0d17005f00367d3cffb8
SHA512 eeb11364042609b365bb7f56a2bbf466c89e71e719102d8235c9f1196dfece1353e0c146df97fa6107dfbc012e2100797dc8d07117247345b931370befd03f97
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYg0Q13Kc1EyRLBb07vUEypqlMohWG+:Ygb4mBIBhGFRKcGa1qFypq2o4G+
TLSH
T15F659E1E22EC02F5E1F6D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 f38d8e254fe55a379a7e8bf7d35adfb4357cdb89dfd7cbb707cb73e1f8ab3ad4
MD5 af63f92909e23f09a1870008309160c6
SHA1 509fa18f984121c34ad808897f34b17402354a40
SHA512 868e1a06cca634228d680939a848195637cc7769e5a16b37f027c1c12434a6807575f0915e7e17504a5482fbdf6f6697e1b0e0fc2469082c0627ba0f8a4fb650
SSDEEP 24576:FG88u8FpJqH16zria7/mL0Q13Kc1EyRLBb07vUEypqlMohWG+:o7ZFPqVFa7/CKcGa1qFypq2o4G+
TLSH
T1CF95F16567E001F0D477D138898646A3F6B2B4250364EBEF07A88B551F23AE58B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 311619906b8bf10a02c6a771d6d278faf6b22138f899de6e06bcb46d5778a605
MD5 664f9af2335f6f0f6ba7dec1b161504b
SHA1 c2fa11ef01f204adbce126207359901aa039164c
SHA512 64722bc6ed213fdf120cda6a1578c768832edbd7d4dd5df486f62d19f0d01b788bfda52696f7af81018aed58b6ab294fee4a482ddcaf453c267591a1032c23e7
SSDEEP 24576:7PUr+NQ30Q13Kc1EyRLBb07vUEypqlMohWG+:7JQ9KcGa1qFypq2o4G+
TLSH
T18675E12F669C08E5E676A17C89868619F771B462171292DF02E0817E1F77DD8FC3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ec588f5043e83d0b89af8dbe7fcaea1c7da04bc1e36229326fbe01e11b8d4ab5
MD5 a22d062eacfd66070f8c206f623a81d4
SHA1 6f1f3fa7d4600be6cbf97b4be0be429712ec6a5a
SHA512 02ac4209fc4d617b589e4361027c2433fd3116e097a20a971ec8578783186cb2045e0efacff696ed85edeb1bd27654a747853cfe87464b90f5563fd99eb8b5e0
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNKcGa1qFypq2o4G+:mG05lO43b0KcGa1ixb+
TLSH
T18BD5BF6A62EC01F9D1BBD17CD9C6860BEBB23415033556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a715901122c07108c37c8ffb0ce0795eff9ace3ea2204079547b7f59440ef0d2
MD5 5173ab77b49a0770ba556b03652b2b93
SHA1 3d125c73dc33667edc41cb7cf19eb1138ffab74a
SHA512 ed269d408bf8c6e38bc3266c62145f059642111dae87ee6bdd407413fa8a4e694f430f021431af7ad1bdaf145a0f354a1aaf61f93b573f4f8f676ce5e40a43ee
SSDEEP 24576:Ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnZ0Q13Kc1EyRLBb07vUEypqlMohW5:Fa5POZ3+Jt2pasx2+m1KcGa1qFypq2oK
TLSH
T16A65AE5EA7EC01D5D1B9D17DC583861AF5B1342153329ACF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f10be05ab4250f3b8d2205932e7e18e5efb22f41877f96173e63fc96112abe48
MD5 88fd7c338749394a4a06ae846ae0b963
SHA1 06939b34f145ca3d93c5f758f143ca041763a846
SHA512 279f8ee8747f831f6ca18a51f1f6a662ec98875e63d8603847cf4ff2e88c94b7bd6120c90f9a354d7f518c3c0a19e46422b744a179530ef676dd2f8d652a52f6
SSDEEP 24576:DNcwHdjbyQ4nLC18lb/EOjowL7FkT0Q13Kc1EyRLBb07vUEypqlMohWG+:DNc/zEOVHFiKcGa1qFypq2o4G+
TLSH
T188857B2623E901E4E1BBE1BE89779546FA717865533086CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 49735d03416718f6998bd3daa861ed460cf15c82154b7c4984be83c8cad93b93
MD5 3a927a7de00ac1ff6ec01922e593f0d0
SHA1 0d41e9fe688ea1e61a2294234fe19ea7111730b5
SHA512 2e5f971711546a9b4d5e2d7e0cd33c34fa6b78364c9f1d7783f5646169238fd49ca7be06dec6c6409ac56c07993380c47859381b66042737254bdb862269a596
SSDEEP 24576:18kNvNnaFeYhJNtmZBmN0Q13Kc1EyRLBb07vUEypqlMohWG+:18MwBtOmjKcGa1qFypq2o4G+
TLSH
T17B55AF2EAAB806E4D1FAC6B4DD238512F6727461073293CB5390C13F1E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 5b691c8917cbe8bb163634c62aa21bff9800655774f55b8af66f33a912628397
MD5 3fd98d50247979c61fa7f8faa1736238
SHA1 89c0f52a8a5edc957ef5082d10ac4ee5ac864ee5
SHA512 d8765ca7455a373862f6ac1313572fa9ad89cc0526fe9c17474c4b67ee9d08969f3a04f12648cbe4a4b7410d2633bdabc3d86a506a4ae85841ef45de9809115a
SSDEEP 24576:cD3FHshBIYQgAC0Q13Kc1EyRLBb07vUEypqlMohWG+:cDVHeBIAAkKcGa1qFypq2o4G+
TLSH
T1D085E13EDB9C04E4D57AD2BCDA638506E77138A8032255DB12D481BA1F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-77-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/572-276-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1172-247-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/1172-64-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/1172-66-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1172-72-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1336-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1336-123-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1336-129-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1336-132-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1336-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2108-53-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2108-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2108-54-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2108-213-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3492-110-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3492-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3492-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3492-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3492-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3604-291-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3604-323-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3604-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3604-85-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3604-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3604-91-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3632-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3632-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3632-84-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3632-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5412-112-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5412-308-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5412-111-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5412-118-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5416-98-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5416-104-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5416-298-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5416-309-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5416-97-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5416-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5800-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5800-139-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5800-312-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5800-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5872-49-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Download

memory/5872-51-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5872-45-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Download

memory/5872-38-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5872-39-0x0000000001BE0000-0x0000000001C40000-memory.dmp

Download

memory/6036-0-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/6036-76-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/6036-1-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/6036-6-0x0000000002590000-0x00000000025F7000-memory.dmp

Download

memory/6036-8-0x0000000002590000-0x00000000025F7000-memory.dmp

Download