324c2bb223dbad6381d7ac592d2f44699b16d80b1c71e65b2e8dadfcb4286961

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
Size 3.1MB
Sample260929-pgz7lszbmc
SHA256 324c2bb223dbad6381d7ac592d2f44699b16d80b1c71e65b2e8dadfcb4286961
MD5 064c32d199e847841996eb5df72bbd55
SHA1 6765eb3a42fad67881fc47bf10e3c15a0ecb32ed
SHA512 2c013c683ee654b380475b23261680ff7cdbacc5af6e8a96188ebfc8e513dd3cc29552f3c60dfd991e6d173abdf11c9d870790fd46e188fc806d95ca24176f50
SSDEEP 49152:lAWmHuMdEg9AXYhkecA9n/TDbXNKdLCLwSWo03fKzrrA9n/TDbXNKd:FmHzAXYh7fb9sE0o0PSEfb9s
TLSH
T1CBE5D021E791D836D27264709EE9D22962647E31DB76518BB3C03F7E1AB05C27A3C70B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
3508	elevation_service.exe
2884	elevation_service.exe
4704	maintenanceservice.exe
2852	OSE.EXE
2560	PerceptionSimulationService.exe
2236	perfhost.exe
808	ReFsDedupSvc.exe
4308	SensorDataService.exe
3064	ssh-agent.exe
2452	AgentService.exe
1424	SearchIndexer.exe
2660	maintenanceservice.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
	\??\F:\	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	maintenanceservice.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1174d4e77465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000009337-301.dat	upx
behavioral2/files/0x000100000001b952-306.dat	upx
behavioral2/files/0x0001000000009952-303.dat	upx
behavioral2/memory/2660-314-0x0000000140000000-0x0000000140300000-memory.dmp	upx
behavioral2/memory/2660-402-0x0000000140000000-0x0000000140300000-memory.dmp	upx
behavioral2/files/0x000100000000a304-352.dat	upx
behavioral2/files/0x000100000000a2c1-351.dat	upx
behavioral2/files/0x0001000000009371-349.dat	upx
behavioral2/files/0x000100000000a1d4-348.dat	upx
behavioral2/files/0x000100000000a0ce-347.dat	upx
behavioral2/files/0x000100000000ba3d-346.dat	upx
behavioral2/files/0x0001000000006215-345.dat	upx
behavioral2/files/0x0001000000009b92-344.dat	upx
behavioral2/files/0x0001000000009cfe-343.dat	upx
behavioral2/files/0x0001000000009cd6-342.dat	upx
behavioral2/files/0x00010000000093af-302.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5b269bd0c50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e6584fd0c50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034b8bdbc0c50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d48a8bbc0c50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009715f3bc0c50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000218a11be0c50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe
2884	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3268	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
Token: SeBackupPrivilege	808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	808	ReFsDedupSvc.exe
Token: SeBackupPrivilege	808	ReFsDedupSvc.exe
Token: SeRestorePrivilege	808	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2452	AgentService.exe
Token: 33	1424	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1424	SearchIndexer.exe
Token: SeDebugPrivilege	3508	elevation_service.exe
Token: SeDebugPrivilege	2884	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3268	2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 5424	1424	SearchIndexer.exe	101
PID 1424 wrote to memory of 6092	1424	SearchIndexer.exe	102
PID 1424 wrote to memory of 2092	1424	SearchIndexer.exe	103
PID 1424 wrote to memory of 4904	1424	SearchIndexer.exe	104
PID 1424 wrote to memory of 1192	1424	SearchIndexer.exe	108
PID 1424 wrote to memory of 5084	1424	SearchIndexer.exe	109
PID 1424 wrote to memory of 484	1424	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_064c32d199e847841996eb5df72bbd55_coinminer_elex_emotet_icedid_stop.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4704

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2852

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2236

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:808

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4308

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3064

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2988 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1192
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2988 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:484

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5656f3af92f4ec8ec22e7f75bdaa9532bdb990871ffd1af52bb67a7bdbd337f1
MD5 c7bf09ec907eb67ee5c52ae0ec9e4fb5
SHA1 b6eaf7e48a6fea17dc31bc8b0885348cbc576a5d
SHA512 e9886e31851d37bbcfe73c32111e004378728ff5e27f39248383c015160c79b31caa5dc884eb5097d9f4418a6d7b58508be06288c7600d739880e023559a338b
SSDEEP 49152:Mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnpA9n/TDbXNKd:23q6HjBHfb9s
TLSH
T108D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.log

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log
Size 3KB
SHA256 7e96ee865acdca98158ae5fecc48f41a553955141c0fa14ec4c9685d92f47891
MD5 b2f1f675355ce5f31793e5862fc809dd
SHA1 b91b64628eaf27b523d8f3a244cb63322e77aa5b
SHA512 096899cd90e23872f075c1e39146e5a3be1eedca818317787373d0ba2867b38be9b85f624d95d7b8acb3e9e7aea83436d12f2980caf344e2c62d31a83d4e0ca1
TLSH
T110514E6B217D3D2A1C46EF85DEEDBD19A64D314C54FC6178221AEEBC0DA508CEBC6710
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 07fb1ec4f88c91c70b590829d6e4c761214e0a7e2afb4b9a58df79775b86fa2b
MD5 ab7b7e9e288741a3512e00ab79916bc5
SHA1 835befd48f856108ef50b96665956717f04249db
SHA512 d1897df561113cb9f62f39816ab2c6044c2256121bcc282b425adb93fe7366c87a8678022a26a372fa41507eb5422d427aceb14bfc50090f8d9b37395af5bd97
SSDEEP 49152:p4cfA9n/TDbXNKdHLwSWo03fKzrkA9n/TDbXNKd:pYfb9sr0o0PSFfb9s
TLSH
T16AE5231567E80DF8CE578278C8A2D604DA72BC498770E79F0398A5255F333D85E3EB89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 23a9daa5e58528723566f55fa897986fc34c0eacd9c9a34ac592be26ca6fcdb6
MD5 edff12879e77a1f2cbdd7ab07afc4b29
SHA1 b639791f22401574c30e7ba64e84cff92984d63b
SHA512 6ddab469ad4fe8a6add8a8c70286338c6e3b56c1ace974b1dc31e8c229b3732d57d3c48d2b5fc3e85c57d5a57952e9e5fc6db731bbee28a29b6358b5d94daa7e
SSDEEP 24576:NXYfDtczAoUeA9n/TM4NZYeNm+9MhUwd:YtcfA9n/TDbXNKd
TLSH
T18285012867E408F9DD67827CC8A28505EA73BC454760E7DF03A4992A1F333D85E3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 9aba6e2d0ab5bf6088abfba774db75b52c5f3a6b0b3284d99e3a3be780d2c43a
MD5 ee9f729eebaf6c30174009ac4be8816c
SHA1 55683379fe6bb6078adc0ccd04fae7852491d0fc
SHA512 feb2a6f770a7f5404bc85304de08f04a077456b971a2e450e707af408d2dc3babd3c57799d8aac37929dbac5a06b2c956e9d61a93f402594533af86001b41bab
SSDEEP 24576:U0Le5ji0hmxYrMlUeA9n/TM4NZYeNm+9MhUwd:UPji0A2sA9n/TDbXNKd
TLSH
T17C959E16F6748731D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 26b842ee8b9b3ea8ccc2d96db6f4e504c4aa7b791255bc6e45c3a244b38ab604
MD5 c816221137eb0de3a632aa86a8a8c034
SHA1 3902d13cc4950a3e906c26efd08509b7d384d0b9
SHA512 0d277b71fa02db9e443b2eb20a8197e51345504d604f70d412b89dc12534c0b2a31be056dfd5d8af96c0c7ca2642db5666bd5dd7f37518b6d2e708cc2489f78c
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWE6q8wyurUeA9n/TM4NZYeNm+9MhUwd:o/ezSC6vUzPvxHjyIA9n/TDbXNKd
TLSH
T124755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 af7903d9053f18c4e46d697bf88ed34e6e97ef0f7386236a4bf001e66aca0bc0
MD5 0e0741e1c1e3936511fd5462c2438b5a
SHA1 d39f9af20eed597f9d92b8707797f900e494a0d7
SHA512 2d82f940dad87cc57958fc5af4248b408988b9d30d7e8f7c90c0d47fa9efaf15ca45183c0d069ab5e0a47e0916bffca3252531b5f943f42ae9dffb684b1e16b8
SSDEEP 24576:lVbqPb88hv/l+6sUeA9n/TM4NZYeNm+9MhUwd:lVO88hXl+tA9n/TDbXNKd
TLSH
T15B559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 14cd36bcac7aa0eaa781c13e2ee5f4274f1db464192b81733dc8a1499c514f78
MD5 f83d2d40bc813e1499cb35a6c9343e32
SHA1 f3dbb9296d8585c43460000ce7777c56e6cc6d9b
SHA512 d541e257122ce17506760813075b9e837b95152779fc32a70d0f680e79eaf3b6fc87ad90302158ea025dcf34c8d358dd61b92c89a741be7a140a0a59f9c6dfa8
SSDEEP 12288:fHJBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dGZ:fHJUeA9n/TM4NZYeNm+9MhUwdM
TLSH
T1CE6523824BFC08F1C78E0A7544AABF0C8EA2FD4DE585879D4719772E5E381C6C96648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 bb81e0de9eec787ea5f7736917fbedc9069b4143d8904015963517220c9cdec6
MD5 13ef5cf705c1fcdd4e23b9d2367f7924
SHA1 494bbe08c01d3ea5304ee5b08f9baeeb79fb3b5a
SHA512 7ef1784dac1cceb623774875ca6d768ead50e7f3267f56ef08c163d208ee9e5db8510685a8279f4b8211b13a3019272f81e83ef78f879985f300457dd6d17359
SSDEEP 12288:CeBNUbTVO86UkBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dG:CJIUkUeA9n/TM4NZYeNm+9MhUwd
TLSH
T11E85CF7BAE38ECE2C27E4DB956918700D77278304B6293CBD165830EDE235E15E7AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 842c0cc172301085a49d1394d79caabe5439063e7470e499854a825984caed6c
MD5 fbc1f52bb46b12088997461141a56164
SHA1 487ee53eb06b684c32a816deff89af50d10fd5f6
SHA512 895b8b89ffd4da2043f92e7422c6a3a52ed7cb9eb82968cade676a649a79184759a27133e3b3070dce30fe2ebc3ef043c8df0aa119856970178ad36cdc2f4c06
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH+:WQvGAdlCEL8c/yRNw5C8fb9s
TLSH
T1FC267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 15212a4e27db89897d871558e12a256573f7d1af03db0a4783786493ea59b137
MD5 958d9b276d6484328a8aa4b95d5082b6
SHA1 65baf6712fc5725ac5647a8ca38a4139071cc4b4
SHA512 2d68755e635c307c2e4b0ba0d333b2aa6877f209f070f66ba4d2f356dcbac36c95ecb3e31347df68f8e25ede90b0f3e5da30e2e42d3e4ed5b9dddac2219e287c
SSDEEP 12288:AAwSfxL/2Dc3SDLLmt0LDQewsAjCBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9L:V7ewsAjCUeA9n/TM4NZYeNm+9MhUwdv
TLSH
T11E85E031FE74D432C3BF0DB21B36D706586DB9204B511AC3E3A89E9E59302D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2c3e676983c69ca5a752477dc4934cc66287071912126160caf9dc9776483250
MD5 c96d8c3fdbd2571eb967319e51e96446
SHA1 717edeffc12f642eeb814883dd2975a64abca48e
SHA512 073894426d20ae595ab916c391e49d8c233c8e1743361bf79a81151959408721fc319ef178b8db97560bbc0845d440d221d935f7f2a420b29d221bc2d7ea65bf
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHZ9:IUEtQevvqc2W1cpV2EI32
TLSH
T159474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ff4dcfb3fb5df0426c69503a36b939dd3d7b592e6ad619975eb9a1931ea612aa
MD5 0a447b95bcfcc4157c85e5aaa2b28f73
SHA1 37391a42640beb4122ebb2a4afa8f6ffa564d50c
SHA512 ee042d0bb64c12a56710c6404806ed8603da5dcb0b583dc7005ba0cd71dbea53492e6b9c0935e246e913ad7c3bf6c51085852961582db2b02ffbae120c90003e
SSDEEP 49152:ZCbRquA/m2yL5zTfFiV+XenmE3/zcA9n/TDbXNKd:2oquVjnmwfb9s
TLSH
T17FD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f6fdec4613942dd924461b7ac3cf02940153b99494c70ee70b7adc6f5c1e673f
MD5 3d47e7d844d314f1201ec58f376aab62
SHA1 f7528d80ce4586f6232b3c737900417eae466d87
SHA512 ff0facfa27918f5551c38ed61cc13b33c93315cb8cb9931ef77bd59bf2f60ddf7822b7898084fb2a791fcca2ed9bd73a4b84ae0e73df0d6a4f0629b8a9c30a72
SSDEEP 24576:SAhGLJIFoiwtA5l7S53HUeA9n/TM4NZYeNm+9MhUwds:SAMyFoiq5rA9n/TDbXNKd
TLSH
T1BA359D81EBF945D4F5B3AAB899B69570EA76BCAA5E31C20F1150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 1fa1c32afb49f049ba39a081d62ae3b08fd9926a0ac11138e048e007ceb0a5fc
MD5 16f8f81e4506856456d841936366ce91
SHA1 10e0341c8ee06c8c595d42c3a5f6f9394a2a2127
SHA512 059b311aa0d2875a0651660d9e8aa30fbb097368a9ab4d7d5f7e94de8b95fa3937178877005c8d3bdc80da9fed8a253fe71f11d3a37f39162f4daec4e32b0cb2
SSDEEP 12288:nmw5HEjsChNzBFgl0WDm+CLBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dn:mwuSOW+UeA9n/TM4NZYeNm+9MhUwd
TLSH
T11985F14637E80CF9DA6742398597D635EBF2BC062A25C71F0760C61B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 077dfad034d3496004def54f523cd77c237861da46a926d486210d05531bbf4a
MD5 7cae0af12076f018ad8131aa61dba4be
SHA1 9aec6c576f789b57e82c0dcdf38cfc5c084128de
SHA512 554835cfb6eb0cf1b09109e496b540c9631329d5dc49aaffe40c352c43a368b6ef425f439e90024da2a8bc1e63abd74940914eb0c7214176f8958cf4f7c97141
SSDEEP 12288:mjZ1IySBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dy:yZu9UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A575128627F810F5C397527DC8E56B08DBB27C5A637543CF0625526A1F32AC28E3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 758e5b1554e85372eec24c5eaa45446fe56cb3c6f7310b244b9d25f1bcaaff7d
MD5 16810bd2a9b067af36872920b27d10ec
SHA1 0ccd822e2f54566fa5df4fd4335b39311b55ed8c
SHA512 e980e373dd643c4cacfaa5cd4ee40791c5daee13381c9c5dfa8c2b290bb19c0326abe558a3ebf7fa1d8766396a21280bcfc5ac81777e935f54c43da8498d4e00
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ua:VQRQyi36YOcPQLvw2gAf+PN3jfb9s
TLSH
T1F4666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c439341d604da2168f3b116616b22bebb2554e9808eecf95868e9baf14baa7de
MD5 81c8514abc94eea41349dbeecef28c09
SHA1 c8f75a6f13d2e2c03ca8cf1a504d004e53ff342a
SHA512 16f32876d90ae2f8816ecaff729c1421865dbfb8b6be19caadb3fd42daa0a211af50cca09955e8d766a41578f03ee880ef26f333e1fca8cc504aed1f339d59a2
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ua:TQRQyi36YOcPQLvw2gAf+PN3jfb9s
TLSH
T106666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 941862552d97450ce9377fff7b8593907be138d5e782c0d5974de04fffb59925
MD5 29aeedd9c70d18ccdc7bfb0538d1b58e
SHA1 91362d33a201c94d1edeef8d4b1d039946f9f5a4
SHA512 daf347d17f31340375612195beeb954d3f59f9c5e4cc4f09b7a4cafd69b5a78dbb864fa643bf2d68074f3098107411ed295f584ce60495d0e4bcda8d2ed90baa
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0tUeA9n/TM4NZYeq:i68Qg55nhheWu7PNU3/sA9n/TDbXNKd
TLSH
T135B55A33B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0b8ad5ed54ca6b3fb4dabbb7e782fb5d405f274862fa9c39ced4297ee58edb92
MD5 b4adfd304410dd9c8f727ac8b1a7775d
SHA1 b8175a99f4cc3594c4b38fbba2639bca1a9adb0f
SHA512 f8134b0fe49f31323f34fa4974a123fe6975727354391f3893e26fb94653faf31f557530f2c33a932affd9e964b09bf79fb9fcd909b33fdae7ebe11edcdd5234
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99g:Ay5112gYy5azzVvL69nLKnhZWfb9s
TLSH
T1F5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9e8baa62a909e714022a8a03704d6e72d211b57cf8f4cb06d69ac17f661e0406
MD5 63c83f787015790d5cd1b8ea2e776c2a
SHA1 cef58b84733090e05164c2319b03ad4e1080ccb6
SHA512 911619f353c4086b1fc576dc69a3b39bc0468a2d3f7f949cf3cacd10f3396fdb62ea6d2cbecce6914e98cdb2148e4036d65b1d54e5ba313f20cd0392a1954e8e
SSDEEP 49152:MB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6A9n/TDbXNKd:Gu6JmVxd2drfb9s
TLSH
T116D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9697585fa1cddb9a42b0e537b9d30c571b1793c104caa776a7a1271d4ffce69b
MD5 e2d3891b38ba9b38d9efdfa4c0674a3a
SHA1 1d60b565613363dbd7fab79a819b93ffacae8219
SHA512 30c696edcf0ee8a7ec045a66267d2bf037cc78cef0c1a9fe78bb2c17147d71e1dca715e056d420b42686f3543f74e7a2b296d5cbb57f5e8fa0453d75dd121dcf
SSDEEP 49152:41hpsNoJpF1A6UU44CwH7R4xmA9n/TDbXNKd:4mifPbRwfb9s
TLSH
T157B5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0386ce0a803767934da439adfccd0ca9a037067ccdf4a97c6e677f04f761e4ec
MD5 1ba0e3e5629f85d44efe906f18621d62
SHA1 f1f3c1ac24ae5ee3f5803a582fceba173fe5480a
SHA512 aac30240decac0f67b13be19223428dc0cd55cee1154ccb91be0777858bb5ee4dcb0472e15ccc9433f8a0ba3ac81120a06a980a9a50a6017a606782b43857f52
SSDEEP 49152:HSuZQIY0Be2KRRVtOnks6NMHq5A9n/TDbXNKd:d5dKTi61Sfb9s
TLSH
T187C5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6c691ddd4ef41916782f23728bb047ad1552c5c261514b4923fc1751cc3c5aca
MD5 6ef44602369d21a753166c5d3954dfb4
SHA1 6dc140eacb434e9afa0d770cd0a0c1d3b2a83802
SHA512 658b457cea5b251a7c683f52c1dfccc14dbc46b7109ec09818a869b27a9d08c05108c481259c36e71f2e48686d5f53fb0433fe9e84c0f76f4cbc9ee5c781907c
SSDEEP 49152:1htSn8EApI0figngiDn0AP5wKA9n/TDbXNKd:EX2iyph0fb9s
TLSH
T13895BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 ca8bac9354104ebae17b0188fdb5c16e17a9b9ff90117921dd664ffe7865b3d0
MD5 e5165359d103fb757d39c810211416d8
SHA1 ecb0296cbfc51ed66f46983e920dbbdb6dca13ee
SHA512 edbe2c5e4b648929eb870e26a08263cd828f0ae274976298272b1bda3f4a220fda0eaea59f59164256a54f88c008f6e47929d8e54f223fdd98e3a9c5646ead23
SSDEEP 12288:ehBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dn:ehUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1046523824FFC09F5C74A0AB580A67B0CCD92BD4FF68543AE471D722A5B385C6CA564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 a71bbd4c568f9c26295d7ea3508a419241d66937ec9c9e8d7be908ecd91c45fd
MD5 7b323be4337c44833e5ccdde0f42e196
SHA1 b5c94a6b0a22cf5e71ba7fd1aa507c5fc3c6045f
SHA512 a2e5295f6388731afacdc1ee246307a614ac4a0cd1a3123de221976a5d5170f67da7612118cf2ee35596099c7fa18dc079258a24e080050ebe0f1d247feacf95
SSDEEP 12288:amBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d8:amUeA9n/TM4NZYeNm+9MhUwd
TLSH
T10B6523824FFC09F5C74A06B581A57B0CCDA2BE4FF68583AE471D712A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 7a27c7c9067273f9edad26613b40d6a0107882bf90dc6e7c9f1646fdef26ca36
MD5 ed83b73310092d2682d3aa15052fb4b1
SHA1 6a6866b30593f581c5e4158be2251bbd00961c72
SHA512 8c8772bcc52c8d013f02d12f6f88f61bb2838ba446af2b9ea5d86f1a470859f7cc7ba9523fc4725e279b0fa6b9768797fe9bfabf49bdfaab593295ff9ee07f20
SSDEEP 12288:6cBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dD:6cUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1FF6523824FFC09F5C74A0AB581A67B0CCDA2BD4FF68543AE470D712A5B385C6CA564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 decfe233b59b53586a8dc1afe70026946a5c350fdd69c0badcd69d40664372e3
MD5 859249eab9e1d05db3b96327da9e74d0
SHA1 737ef91e7b3bd361195fc60f5d5b35a7466bb408
SHA512 cab02e4c1d9092b6b5aea2f9841235d78a2f6e24abb51dfdc1c81fc7e7e7bc586bbdbcbab22cfba94da8d397e40f8ba02eee8f6dd8b7db597d962f2f3c4cfe22
SSDEEP 12288:YVnBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2do:MUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1336523821BBC04F1C74A5679C4A6A708DAB2BD8EF76283DF4705361A1F302C5DD35A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 e38a6ae30e7c2b955a221ee8144fcf0951f36852f16213f231a196addf5080a1
MD5 a770db89aa2269d6e4de5aa23dc9b9d6
SHA1 4dd4e148618c08a403e127dca1e1e6ebc9ce56cb
SHA512 7efbc201dae7baffe7b7ca8642a7a4362e4c18018aa9c848009d0f5b65c44fdc67cedaf601d500ae2055f7219b9c81e999f2108f0a25b1209a15c9f58b9ac853
SSDEEP 12288:3vBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dS:3vUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1256523824FFC09F5C74A0AB580A67B0CCDA2BD4FF685439E470D712A5B385C6CA564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 fbe52d58df801164c91cd4773f23a9264817fcd99899c33c8f6bbb07dc026e86
MD5 aef95400c266005e68fd515cfce671e1
SHA1 f6e339c8f5b3c3d354c95671c4f476a86452c4f9
SHA512 ea472ece852bea03fdcfa969a0f14053b3165bca9ea3bfdc6c6307871a43fc8195485169704d85d91bb9b323bd796ba5a660b508877daf8d4719fc8973af6b8f
SSDEEP 12288:haBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dS:haUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B86523824FFC09F5C74A06B584A57B0CCDA2BE4FF68583AE470D712A5B385C6CA564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 d93b5d384dff3a2339291a828acef44470e91af336661d773b9debdb06f90712
MD5 4ba34d32aecc372a29afde213b2bb7f6
SHA1 651a5bff1e7587ac838ce99aa0a221870b34cd7f
SHA512 3c65d43d97c5935492e07a22e4a8075bd48c88928be9792a4761609e24474354cba79e8314ec13f443a9f11541d64e4d26dfa8079504b7673444a8146602acb7
SSDEEP 12288:WuBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dV:WuUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A86523824FFC09F5C74A06B581A57B0CCD92BE4FF685839E470D712A6B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 b925c46fb936f6c25a024f3a389c0573897f1f944035c00fdd0edbf52791357b
MD5 f3801dfad04f7b329a1d00abf3565bcc
SHA1 1254900e57cd95cad9ddf126ae662343954e1d7e
SHA512 f49064b29e67c618033746a866a8e97c74ba50eed417654a3b01b6cb4d2730a5a744d663d12f9b9d747e6fa4251ebbfa09f2c78c8535892f2ad0db3058c178f8
SSDEEP 24576:EZMEzFVSOGUeA9n/TM4NZYeNm+9MhUwd:EZMEzfkA9n/TDbXNKd
TLSH
T1A1850295B3A00CF4DD67423EC8659A05D6B2BC1A5760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 4a72c09d310cea3780da1c1d2361c7b09fe3b61e2643a1f0ef6832c435e29fd4
MD5 9e031800c7c1d753d7906436bc50e9b2
SHA1 1ab56848cb873bbf058280590d33a943cf4ea097
SHA512 3c22449153e5fff8be83316075ecc3ca67c1ba7b6091ebbc554df0bcd6155cbd81b8131f68eda7c9f47991ed21d536c857703a1c8652fddff5cceba6705365a1
SSDEEP 12288:RNBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dZ:RNUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1D66523824BFC09F5C74A06B581A57B0CCDA2BE4FF68583DE471D722A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 f54e467589d3dc68dcf04b95b5c7d56a1f08ea7cd8e0be38d51d4af1b363b9a8
MD5 8dc963f8d39b44948e7019a69fd87c6e
SHA1 06c5247d73b2d3ae490f865e823a9229324b0136
SHA512 f9617c8420d75de9ef5572355e5149e99892e6aeaed90851de66446a65d2b0419a077c5e5bd453c79bec2a93d134df485044e6734487a03ceb45724a2bbff1e3
SSDEEP 12288:8ZBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dz:8ZUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1616523824BFC09F5C74A06B581A57B0CCDA1BE4FF68583DE471D722A6B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 762b4527ec523b0f9e4995cf6c2de3ffaba1926eafae0b178b281bae1898000c
MD5 b8aa870cc29f91e13e0926495cc842af
SHA1 e2a97c47924a91f27d823aaccf98659763734698
SHA512 96e857d7928cc7821e8f8ed2ebae51fec3129b922c6929d70bc680d92fe5744368d4138aae1ee7ee6ab5186f8506dbb1d30af6bdfcf7cecd3f9ff5378224bcb4
SSDEEP 12288:eyPz5L8SBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2du:DzySUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B575024767B420F9C2664239C8A21B05F772BC3A57608BAF036417362F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 e1eaa7d791e4cbcc737c797c129f3fdac0e469a193804a07ad06de518d4e804b
MD5 cfd0daa8294375ce264a94dba5a7ede3
SHA1 78cb4a8e2734b5eb0ae8a1cd7985ca65aee9ad19
SHA512 f5326adf19a5b47d9b2fba495fd887cf57edc025872a96cc0f2d19e76540b9e968c4bc9e77110767de8aca5c032ca29e9a15f2841f02197b0a625acb9c0d1dd7
SSDEEP 12288:oNBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dq:oNUeA9n/TM4NZYeNm+9MhUwd
TLSH
T13E6523824BFC09F5C74A06B581A67B0CCDA1BD4FF68683DE471D722A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a32836fb052c51d57e10c7050bf16f6191651d06e71e2ec12043f6232a924112
MD5 f59a042f023a542747282deb18b4daea
SHA1 607041ca92eb0a05b41f7d0a885ba70cb076bc86
SHA512 8f427d3406dd977332eb0e481dea6a99ebaf7f839284a5b162fd28e4f6d04213949e7e81733ebdb78550dc0dd588d7c15d521a35f049644f218a8d985079f43d
SSDEEP 12288:ZNBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2df:ZNUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1F26523824BFC09F5C74A0AB581A67B0CCDA1BD4FF68583DE471D722A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 24a56ccb9f3f02da24cb9fd27423f416837ca4e89b1f1a568b16e910c6a118c0
MD5 8f02b90492320e4099790745b37d767c
SHA1 4aa9489469243047d73891dbe8bd19f4613e1212
SHA512 e1f188496f3eef666ab64b0bb1039152002041392adbd59b61ff93952566785c12b087cea2d3a007724c3f9b906999c2897b1a7fec12ded2f86bf9603dda69f3
SSDEEP 24576:V8wvik9RX6wkyAIpUeA9n/TM4NZYeNm+9MhUwdZ9hHpWvqtW5f1I0omDDKUgr:YMnYI1A9n/TDbXNKdZLwSWo03fKzr
TLSH
T1E7D5F12AEBDC09E5E177923C89B3460AF6B178591B31C6CF025A536D0E37ED45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 18aa9899c64e20a8754ac0056912880d6a48bd2348a432eb6b3e53e33ea0f07f
MD5 0005dfb7f3c30ca530d9adcb0403f29c
SHA1 f1bae21c0456a08399b893eca512af29cbc14a7f
SHA512 5812f2aed854a78073cdb64ae3d99265c177be2ba79a173244a63421b16cd27f3d32d059545ccfecf45e849e7dceaba279f9e312724087a312f28a35212ac0bc
SSDEEP 49152:iYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0qA9n/TDbXNKd:cySzPDfb9s
TLSH
T156066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6ae38cfe714d039577482ac239cbda908b5904b700ca37612fd7cd744133ab89
MD5 eb76070ac1bc684bd3d75862230b810d
SHA1 69e2b4982c9827fa87d3ff1497c6efee68375fe7
SHA512 2784dd4848f4739059da5a11babbb5f3e3d3238428a11a56060bd7d30d1a9db332dd1ba5e0b0d5abed63e919995362043b15a54b7c80cde415ba52d3b8b135a0
SSDEEP 24576:U47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYWUeA9n/TM4NZYeNm+9MhUwd:U47JUQj1irIhCnDHUPfF/6A9n/TDbXNs
TLSH
T13F65AE1EA3EC01E5D1BA927885154A1AEA71782E5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 b14fba0063b9cf2384516de391de6d6ef3ec214a1ddd5333fa39ac17d42d7f6a
MD5 8ece0b6639fcd6bed6b6cba3eea7fa0f
SHA1 1fe3d0fc2b3d5f225faf298c1fc903c54571202e
SHA512 fd4fbceed64872770eef2b77d1359f6152a7fc0da4573afc345fe58fade648495898189a7325625cf64d5e1899c3846ef596ef7e432d7363c001ae7d6476a039
SSDEEP 12288:bzsf9BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d3:29UeA9n/TM4NZYeNm+9MhUwd
TLSH
T14A75F04AD2A802E8C15E6279C7965A04F7737C2993E1D3CB43C0F53E1F356909EEAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 d036a6821cf717eaee0f44b4e1418014be6a915c6f1d0a15863517378e9a106e
MD5 5ed7d6b41a27352356c5e1f549aafcff
SHA1 cbcad835b7096ca647e6dfb27fa2054c13125a56
SHA512 853361252f3e32a5ee4229205ffd0d181daf8d33c859c356aea20a6c6f1e08dbd8083a5112fd32a968c0ee8ad3ca1cf8f80425030ff8ebc26ea5b242bc18ea0e
SSDEEP 12288:AximHXTU3fZ7pAzop6VRZw0BUanHhf0aR/cMK:AxiuDUPsz66Vo0B1V0aR/BK
TLSH
T15F3507017666CB4FC66D40321E32D6CCAB707D51EE08AF0373C9873F9576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 c548f083d008054dfedb4709d3f01dd0a3f65a410805e743dc0b91287af31917
MD5 898194f1e254c1ba3f91f35fc94e8060
SHA1 723b35e62fa33525dc982c6a03bbf2938d7feb97
SHA512 0e4ccb0429d365f452cf3023599094c77e2f6cedf4a00d727ea64fd8906511ad90257f6bdb7bfc61d9f2cd77221b645fb97c67e5eb5790e137544067cc4477ac
SSDEEP 6144:wn3XAElxCeEgvCZ+41+W9p4Le1RydIbXIOSVsG9oOXSV1G9LQEiq9d1aJpP5mdZC:wn3XAEP9W9p4C1RydIbYmEYSz4MaRjv
TLSH
T1F77519815136E78FC1BB603207265F8D77A4EC06BB096F2773C9447AD82AA15B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 c017955365ac798ba5c0523478e3136420e05398155afdcb9baadb19e2a06ba6
MD5 fc2de5e2392c60330c09e0e34b699549
SHA1 2ab418ef6f4509c9103e737515086bf3db8567bd
SHA512 471284fa26d99af2d91bce421e236e26bf973a23691f323d37b7fcfc0249c8ae43f0ade50910dd6e53ffc2c2f1194ecfc7bac6dfc9324c667ab236b28dba4209
SSDEEP 12288:OO7FBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dUd:hFUeA9n/TM4NZYeNm+9MhUwda
TLSH
T1966523824BFC0CF1C75E16B440AABB089E56FE5DAB4082DF8609722A5E345C6CE7654F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d8b740a52169ea2474a5a3f881e1a7e173b6792085036a31c235978ea2fcb215
MD5 ce30e6a267fda82c0c29369ca82c6e02
SHA1 cddb2b64deefe111584b4fffffd9b1e9fde27bf2
SHA512 7ce9a29e0109d0ccb4b28aa9e3d594407cdacffc36521eb6e6feefda635cd2fcaf6d893741409e67f3e2d8502e804a132cebaf0e65739637bd5276e2dff0f0b7
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYrUeA9n/TM4NZYeNm+9MhUwd:Kgb4mBIBhGFAA9n/TDbXNKd
TLSH
T1EF65AE1E22EC02F5E1F9D2B88DAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 39dc827203a1db58c655ded1a8431707307104acfe4763daa0f94b1c785d82ed
MD5 c7d4d96eeab18928dff496eb0a1f9b42
SHA1 4aec451fa64ba6bbf1f73c65f976b140fb25bc4d
SHA512 b3bc3a7fe897df2e42f2fdf777ee77dcf28273ca2d6976ede47e17771a1f4f6e5f9a4c5bef4826c2188d1f72aca89c0974cc023c869f966e9488293dbda7d40d
SSDEEP 12288:H/GppuuH+krVUPqY1oXhHzpUwjsEI+MwrMqlrW5f1ILYL0mDPDo7b4bCJrwUNk:fGF9hHpWvqtW5f1I0omDDKUgr
TLSH
T1C005233BAAA957D8C535CA7048B2A55968F030615B30FAFF05D88178E7C17E4373EE98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 844e15f954d2a6491b2da0f57aaf7a17a95da66db46bb76bc77b74832d8dc074
MD5 f11c8aa286a25be6179042184ba79759
SHA1 b13fb524fb512e8aa3e878e0d8e67add4e65affc
SHA512 0f32785db2023e5c78da0a396543f466fdebf4ddb44da72cff72e57f62c1aaad16699670b59ffe9e4f2357a1d67be1a7df5300c6cce24426fed352695bef1c89
SSDEEP 24576:KG88u8FpJqH1hzria7/mGUeA9n/TM4NZYeNm+9MhUwd:x7ZFPqVoa7/3A9n/TDbXNKd
TLSH
T16095016567E401F0C47BD13889864663F6B2B8251364EBDF07AC8B561F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 26b4f1bcc5047d527c8f85b1466409fb2d64d6c8ebdab5a9344677c27db1b0ab
MD5 cc020046c31729110e8d236e057f3ad9
SHA1 a85f07cc5e145d5f2f9ceb890a090184c0d8f6fa
SHA512 a5dbbd693693ce1831e1a86c67c8430f7cc60a5340707c5d6188430e21ab8dd0154aea33233bfe69b5581df2f0e3a4fbb1f5d2a64ee29aa20417e5c51c97ceee
SSDEEP 12288:tHvUrBFrEjwaQqBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d6:tPUr+NQqUeA9n/TM4NZYeNm+9MhUwd
TLSH
T13485E11F26EC08E5E67AA17D8586870DE772B8561312D2CF0290817E4F37ED8AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 956f32484d5e413bbdc7cb9b2ee1305174e4546f916ad8a6b5f2617fa51c2280
MD5 06bcc6d8dbb84df11b6f07675ecf070b
SHA1 9a2b8bfaf019bd57a4ed5807b80b26957087ac56
SHA512 15ae7ba817247362afde2824c4b9134a54c0bbf4604b79aa128af66ea8101f6e0fa888c6c6854a51c3495f3b4188a0061b1c31eea5c75cc7c5fe535a89e3b545
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUA9n/TDbXNKd:MG05lO43bOfb9s
TLSH
T1FCD5C06A62EC01F9D1BBD17CD9C6460BEBB23815033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0d1e1c073683c17a6d1ca65462dfd5b822ceb893ffe4dc90a99e9f5f6ef51443
MD5 9ca23401f2af45efe52e784cdd4211fe
SHA1 2a757c689a6e2ad93afe9b71b42fe78260946ce1
SHA512 81567d8e54a91ce41b60c02e227a1bb4b5d32856188d64c03e49f5649e5e329bf109feb39bacf1bfe2d3f240df8f2f9f667f2df5fef6d0f2784da0145111d474
SSDEEP 24576:gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnIUeA9n/TM4NZYeNm+9MhUwd:Ya5POZ3+Jt2pasx2+msA9n/TDbXNKd
TLSH
T19965AF5EA7FC01D5D5B9D17DC583460AE5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c80c67e81e14cb026a73b330d73f9af01f51d1da44fd3904eff2795ab0c93964
MD5 28ad7260ce6a728f1c7b34238e3c4d3b
SHA1 210cef6055ef233c2dcae5e39ebeb33ee3c76bc0
SHA512 65a9f21536d8a77c237ae2fcf7560d5cf9e14ba0b31f5a9a955ffdc5e1fff15ef05daef76b272039e79d6f2af3cf7ecb61b4ec4c850160acbaf68cd975dd1862
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7FkeUeA9n/TM4NZYeNm+9MhUwd:QNc/zEOVHFXA9n/TDbXNKd
TLSH
T163858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 0ce6974ad74f8c19894217bd9fe176f5ad207c5175889ffe575b23ed2ba30ef2
MD5 cf36fbd3c904608e94025bde252a0f09
SHA1 fb7f700ffe002947ab47cfcb43b07908df964231
SHA512 89991326a1b2cab0c2a529c0713f4dc33905f508b717d2be52e9e4cbab3a1089259e877816ce9cb0d30d5183df977c2af265efc12b24c798feedccb59d03ceba
SSDEEP 12288:i1HTkBa5ZI7QpuuH+krVUPqY1oXhHzpUwjsEI+MwrMqlrW5f1ILYL0mDPDo7b4bx:/BwIg9hHpWvqtW5f1I0omDDKUgr
TLSH
T17E25022E677A01F9D177D03985934505D2F1B0718B21AADF0A98C1BD9BD3ED8BA3DE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 a810d3e52cafd8b73dd8ece9fd8c1e2462d3ea81808c72fd9677e3badb944dd5
MD5 9aa82c430c21596484837b7a9121a065
SHA1 584913d47c8c150b6c7d02781dd87c274aa7eb49
SHA512 9dce70c2282b6fd59ceeca91bf40ad049396b538bcf91325d3ea3b0fd64ce288b046eef038fb530f851eb4840867c90132fcc4f890cbfaf96b7841044488e6cd
SSDEEP 12288:CG6kyWpuuH+krVUPqY1oXhHzpUwjsEI+MwrMqlrW5f1ILYL0mDPDo7b4bCJrwUNk:rtya9hHpWvqtW5f1I0omDDKUgr
TLSH
T15D152302975856D8EA348674897381988EB4BC309F30EBEF1190D22D7BB27D47E35F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 804KB
SHA256 00ce381cd70089b720bbb0f111ed2eab50f1f1fa138714a1405097e6356eb335
MD5 b0074fffeab24c4217804927c2c585c1
SHA1 59bf6d5ae2180dfc3da7d7833a6a0943f81ef7a9
SHA512 6559a5e4d8db98a179866bf1d619f5ab0b9c411c3512fea97f8dc5baf9d6fa4fbd969b3ffc278aa2c10b1800783b4183bee6ff167921ca13975d4607568adc24
SSDEEP 12288:xbiWpuuH+krVUPqY1oXhHzpUwjsEI+MwrMqlrW5f1ILYL0mDPDo7b4bCJrwUNk:t/9hHpWvqtW5f1I0omDDKUgr
TLSH
T18C052327DB285BDCDA24CEB144A2A64D45F870315F30FEEF15988158E3C63D42B7AE98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 73dcaba29dc390f611ac2e40a968540a1b799e4cc92978b7c17a3ddb382cb685
MD5 1e85c19fbe079b355567beb0b30a85e0
SHA1 43c60c7ef2e052cbec26c0cf500dec9cdda40340
SHA512 b95431cac143e414cb7f0cd94329f09863418ccd792640dc5fc7ba3a385585a8aec25614caba90bbae9cf42a41e115b5990c5d4240e4ea8e4632a942577f186e
SSDEEP 24576:k0gGNoTfaidZH9hHpWvqtW5f1I0omDDKUgr:lgjTrZHLwSWo03fKzr
TLSH
T15665AD1DA7EA06CAE2B2D635D8721493D633B4315771D6DF2448C03A4DABED8AE74F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 7d5a87b4a1f55426582fa1bafd5fca0c8b61287fedf34366a4baf9e7cb1687b3
MD5 4b5dd43800c6e1ad0d556e2153742a47
SHA1 7872196b84b747c1a3d444ab36810c79d71a0bbd
SHA512 cfc2685144201044e79efd0f148e2c59dcba07da057aa0739cc5b65ae3804c56e448e9dd1f84314d8e6b364cb8a0e39234f1aa4e3dacc93af68aef42528f8dd2
SSDEEP 49152:Pgb4mBIBhGFAA9n/TDbXNKdBLwSWo03fKzr:Pt0fb9sd0o0PS
TLSH
T1BDA5D01E22EC02F5E1F9D2B8CDA64417D6B278165731D2DF0251422D2F3BEE89E39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 f0207fb9bce1be1f9775b5aaced6a69801ef5fddf6c9323cdfe85b5f094b85fe
MD5 96ba708502a80ff8a02d3459cbe1a0c3
SHA1 cb0f31893abff1790e262c0402c1f5460ce225b6
SHA512 c0ffdebd4c8d9f50b37851709de8fdb36a343eac84fd4fe8c7d926ba679e4fd14dc8856fafcaba0cfcce5f1ccfc71d47c21148fdcfcd9870902b294c7923d876
SSDEEP 49152:NDMwBtOmWA9n/TDbXNKd7LwSWo03fKzr:pF3fb9sP0o0PS
TLSH
T167A5E12EABB806E4D1FEC6B4CD238516EA727451173293CB4390C13E5E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 9d51606fa5db93bf286cb4f0b3bf0b1333aa06fe20f630fff1542f595003623c
MD5 27c76ca2857344019f1cf0c7587a0ddb
SHA1 1c87203d0973514a173ce3a90eac2f523a08f01f
SHA512 ca3853388fbaacc833af80c7bd24fee48c29b805ca42804c5d45edf23c27ac4c1912e656c143d1a990191196fdf7111bf2d022ed9ab0de6114916935dac0f195
SSDEEP 49152:tDVHeBIAANA9n/TDbXNKdvLwSWo03fKzr:qfb9sz0o0PS
TLSH
T14CC5123EEB6C04E4D57AC1BCC6638A06D7B138AD033196DB029481795F6BEE46D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 448e2bb1299cb383d227542e58f48434833e6fd97031ebe5f6248b6cd585be87
MD5 a3c724007a664b5dc2d2a8cc015a2485
SHA1 d5ec915c4499a3b3374fd2271aadc8bbf3299793
SHA512 0522699400e43860899a24108faf64b77d13171919015847853987767f25be18d9a91075856ca6b6975c36bbf3bbc998eb6835a50017e1852e87cf739623271a
SSDEEP 24576:rJnJPbzB4S89hHpWvqtW5f1I0omDDKUgr:rJnJv6S8LwSWo03fKzr
TLSH
T18A35E03DD2A810E8E4B7C2B4815A1A59FE71347D2F2169CB19B4D5343F42FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1174d4e77465cd71.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\1174d4e77465cd71.bin
Size 12KB
SHA256 37f6af992d5570fc2f6cd072959561c67bacbc03c9e8f1917245737920ca1cce
MD5 b1224c351171c43a361a180f84452f30
SHA1 4c1fd26e2feee15c43f2fca1099f67d366101545
SHA512 747140918f389f1fa872e4f7b1bc5813564d25216603f4246452ca12961f8a24624e984167f27ca29b1e23ec6226c002266724d839a1dad2c2521117489d35e5
SSDEEP 192:nRS82LQcr/7/ylJK92L6JkXVlY1NPnDmUYFRcnQgVA10MrDtGUjuGlPq:nRcj3yfqJoYNPq9FiADn1p8
TLSH
T1C142D0873D7C36136BA4BCE2C6904CA8B3040678974D5FA71329BA3D96271F539B8587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 fcfca960923e2303a31f8e62d0ca8452e1c57d2fef074a68491416a2f49b4181
MD5 d4946583f82ea3f61e0f077e9d51f9cf
SHA1 a36ad451e02c9257f00d236477b3f5081221668b
SHA512 f023a31679e8fafbb077ed75a7ad3df4f056827324e765bedd7f9fc31d4d0ace6b55e2eaaee761740a6dae1d223ba8812b12a460ab2863b93246b3f9320b1c50
SSDEEP 12288:p1puuH+krVUPqY1oXhHzpUwjsEI+MwrMqlrW5f1ILYL0mDPDo7b4bCJrwUNk:ph9hHpWvqtW5f1I0omDDKUgr
TLSH
T1D8052323DF198BDCD624CDB144A3A95C49E860219F70FEEB155C5148B3C63E83B7AAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 2fcf350f3164c2908740de6b17df0da16627b3aa7dffbd13e652b11822cade98
MD5 1a200ed6931376f0b2f65beae50135ba
SHA1 6c32da894cbdcae21e8140d3a92bddfd6ba07d2e
SHA512 4b3c2f3c683fd6c9b170cd551e919c16aabdc0ec0be63f224fb11e6b08af50bf7d4ff24c7d9ad3502032397c25a5d05d70fdf9e3d903b0d4d66b1aa68d965cbd
SSDEEP 12288:Py66b3IkxjbBzxpuuH+krVUPqY1oXhHzpUwjsEI+MwrMqlrW5f1ILYL0mDPDo7bi:V6Uqjp99hHpWvqtW5f1I0omDDKUgr
TLSH
T16025221F97945AE8E535C670C862812985F4B8321B70EAEF31C8827D9772BD4663FF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.2MB
SHA256 614a911022933128fbd9a1e3a37e853b853a09a41b4a7b7d8e092b8bf98bedb1
MD5 359bb07156c78c2df0e5149f96b25276
SHA1 cab877003da8daab566182457d5d7976a4f0f2d2
SHA512 def51224b32f8b03faefecd45caffdc9803b6cf297cd98634bb56df2e9d18c7e680df27454769acd7e198daf1836a15136740ed0d710a33a48deadbb29ceaf8d
SSDEEP 24576:2CLHGL0MoeVtFumTijCmlKQWDkB9hHpWvqtW5f1I0omDDKUgr:2CLHGeeV5ijCmlDWDkBLwSWo03fKzr
TLSH
T164A57C15E7EB4284E8F3CAF5C92294168A327C549B34F7EF4A80C96A1E32FD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/808-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/808-110-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/808-458-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/808-456-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/808-409-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/808-104-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1424-168-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1424-444-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1424-161-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1424-162-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2236-90-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2236-313-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2452-152-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2452-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2452-159-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2452-157-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2452-146-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2560-76-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2560-74-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2560-82-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2560-305-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2660-336-0x00000000039F0000-0x0000000003A50000-memory.dmp

Download

memory/2660-314-0x0000000140000000-0x0000000140300000-memory.dmp

Download

memory/2660-402-0x0000000140000000-0x0000000140300000-memory.dmp

Download

memory/2660-330-0x00000000039F0000-0x0000000003A50000-memory.dmp

Download

memory/2660-363-0x0000000003900000-0x0000000003983000-memory.dmp

Download

memory/2660-364-0x00000000039F0000-0x0000000003A50000-memory.dmp

Download

memory/2660-315-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/2660-323-0x0000000003900000-0x0000000003983000-memory.dmp

Download

memory/2660-329-0x0000000003900000-0x0000000003983000-memory.dmp

Download

memory/2660-321-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/2660-366-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/2852-263-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2852-63-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2852-69-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2852-62-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2884-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2884-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2884-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2884-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3064-442-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3064-130-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3064-136-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3064-128-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3268-15-0x0000000002700000-0x0000000002767000-memory.dmp

Download

memory/3268-73-0x0000000000400000-0x0000000000721000-memory.dmp

Download

memory/3268-16-0x0000000003110000-0x0000000003195000-memory.dmp

Download

memory/3268-8-0x0000000002E50000-0x0000000002F88000-memory.dmp

Download

memory/3268-0-0x0000000000400000-0x0000000000721000-memory.dmp

Download

memory/3268-9-0x0000000003110000-0x0000000003195000-memory.dmp

Download

memory/3268-304-0x0000000000400000-0x0000000000721000-memory.dmp

Download

memory/3268-1-0x0000000002700000-0x0000000002767000-memory.dmp

Download

memory/3268-91-0x0000000003E40000-0x0000000003EA7000-memory.dmp

Download

memory/3268-96-0x0000000003E40000-0x0000000003EA7000-memory.dmp

Download

memory/3508-30-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3508-29-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3508-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3508-23-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3508-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4308-123-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4308-430-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4308-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4308-117-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4308-440-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4308-443-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4704-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4704-46-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4704-60-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4704-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4704-53-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4704-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4904-455-0x000001E682540000-0x000001E682BC0000-memory.dmp

Download

memory/4904-474-0x000001E682540000-0x000001E682BC0000-memory.dmp

Download