052a9db4b8d918f445d53b447ce2d3171bc32d47c634fe5af3cb159a5fcce48c

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
Size 2.7MB
Sample260929-rpc36attdw
SHA256 052a9db4b8d918f445d53b447ce2d3171bc32d47c634fe5af3cb159a5fcce48c
MD5 eb772f0fca57c13641ccfe7f76462997
SHA1 041b59f1520e4f846b68b966d14245f0e64cc660
SHA512 a7959fed6721a57ad707ed84628c1ac6cd5058133c9bde03399af2cc4fd994178b199422a982566c18762a16f0310c3ebac4f663009f38399668d48bc13bf074
SSDEEP 49152:SzL5QJsTghhxSMmT8oWgBCaX0Zt5TkFyAnh1EVRkhxSMmT8oWgBCaX:Q5Mh+M4FHX+5Tk0AnMA+M4FHX
TLSH
T1E0D5E194A6EDC093F7B7467568E4B52989BA7CA0D6D0024F31D85A4C3B327C17A3C3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3336	elevation_service.exe
1332	elevation_service.exe
4776	maintenanceservice.exe
4924	OSE.EXE
3112	PerceptionSimulationService.exe
4648	perfhost.exe
4876	ReFsDedupSvc.exe
5440	SensorDataService.exe
948	ssh-agent.exe
2464	AgentService.exe
5840	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bd92aa4f25f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00010000000093e6-360.dat	upx
behavioral2/files/0x000100000000934e-359.dat	upx
behavioral2/files/0x0001000000009953-362.dat	upx
behavioral2/files/0x0001000000009b93-366.dat	upx
behavioral2/files/0x0001000000009397-372.dat	upx
behavioral2/files/0x000100000000a31a-375.dat	upx
behavioral2/files/0x000100000000a305-374.dat	upx
behavioral2/files/0x000100000000a2c2-373.dat	upx
behavioral2/files/0x000100000000a1d5-371.dat	upx
behavioral2/files/0x000100000000a0cf-370.dat	upx
behavioral2/files/0x000100000000ba3f-369.dat	upx
behavioral2/files/0x0001000000006215-367.dat	upx
behavioral2/files/0x0001000000009cff-365.dat	upx
behavioral2/files/0x0001000000009cd7-364.dat	upx
behavioral2/files/0x000100000001b97d-363.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1960	5320	WerFault.exe	88
1744	5320	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000685088ed1d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f8395f01d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000394538ef1d50dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c66287ef1d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5320	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
Token: SeAssignPrimaryTokenPrivilege	2464	AgentService.exe
Token: SeBackupPrivilege	4876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4876	ReFsDedupSvc.exe
Token: 33	5840	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5840	SearchIndexer.exe
Token: SeDebugPrivilege	3336	elevation_service.exe
Token: SeDebugPrivilege	1332	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5320	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
5320	2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5840 wrote to memory of 5988	5840	SearchIndexer.exe	100
PID 5840 wrote to memory of 4636	5840	SearchIndexer.exe	106
PID 5840 wrote to memory of 3808	5840	SearchIndexer.exe	107
PID 5840 wrote to memory of 5112	5840	SearchIndexer.exe	108
PID 5840 wrote to memory of 3436	5840	SearchIndexer.exe	112
PID 5840 wrote to memory of 5664	5840	SearchIndexer.exe	113
PID 5840 wrote to memory of 1740	5840	SearchIndexer.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_eb772f0fca57c13641ccfe7f76462997_elex_emotet_remcos_stop.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 1640
  2⤵
  - Program crash
  PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 1660
  2⤵
  - Program crash
  PID:1744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1332

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4776

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4924

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3112

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5440

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:948

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2872 2856 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2908 2904 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2908 2904 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5664
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2872 2856 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 5320 -ip 5320
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5320 -ip 5320
1⤵
PID:5316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6dd88b073b08270a371e5c42845b7f7881bdfa7695555d313cdbbb961cd88ff4
MD5 12f97c0ae0ad0b9fed66a48987ab2e40
SHA1 c2c58b1272497cd8c7964f3369f4c8c09767c5d8
SHA512 1bba27187d227bda8e2c89be138cb89554fe5f44be9ac4ff54bd4adc84c72009243ac4db3e1b3aeaa6dc4b1d8a64469dc1bf786c022a8a32247a2c3a3c5583c3
SSDEEP 49152:Wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnthxSMmT8oWgBCaX:I3q6HjBs+M4FHX
TLSH
T129D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 3.0MB
SHA256 7b1a864b88451b41879709dbac035b3dbe545712928f381510b8753bbe288f0b
MD5 d64c578bde56542b22ac58ed1a8dd6da
SHA1 cd5c67b12811a7178bbded74085530d75251bc17
SHA512 b611096873cd5b02078d85d871861b7f1ac8d8a7450d9f6585d01c8f2dea3d092b9f5d05142c72a95f1ffa744f348d28e63147cab9fe925153736e8180a00311
SSDEEP 49152:ctczhxSMmT8oWgBCaXWZt5TkFyAnh1EVR8hxSMmT8oWgBCaX:ck+M4FHX05Tk0AnMY+M4FHX
TLSH
T1A4E52335B7DA48F9DC1BC23CCDA28512EA737C584390F76707A89A642F236991E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 5da4de6e80187cf5674cf18ff39f8740e486f055ab143888c20010610cf543dd
MD5 929018319a1fdea090caa2c062b1a4eb
SHA1 9a41774c1d05dfac0bc6002faa1d931ffef1fc88
SHA512 ea87c8916d82a93236daf21e60ca5d3079e5d8b937054d881333d5f48ef34edd24434724d7fd48735ad16f7dcb75ba757981925782256ceb991e74da5926794e
SSDEEP 24576:CXYfDtczARrKhxr+EHNmT8oW4ll1JCrLKXI:JtczhxSMmT8oWgBCaX
TLSH
T1C485F128779508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 f761445b988c53772bf199630898205352531aaf154d7a3f355698251d8aaf01
MD5 d1f8b9f203d698eda240632af63f333b
SHA1 f3c10566942eccf76d9423236237ba8ad28b83b8
SHA512 510f4ea7ebc562630f35e01246265b5cf1e5c9a4632759e943deeab863535a56a1a54017833ec87a75d6547469037348aa8db391bda01859d5c48822b41a0d69
SSDEEP 24576:g0Le5ji0hmxYrMCrKhxr+EHNmT8oW4ll1JCrLKXI:gPji0A2ahxSMmT8oWgBCaX
TLSH
T1C795AE26F6748335D073C0B9C5D2A68AED71308657308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f19a9e7d256949e14298d70498f226fde4fe4ea1d29166306832633dfbf61ef5
MD5 e589012947074e2239a95273a1d06fa4
SHA1 271f897e181f752a2047aa4926e895c5e8004e9c
SHA512 982e63d5134f9f968eb79e06b9e996009be2522dd89e1eded92ff30c1ed74631ea6e2a7c7b9730077c4542e14cfa5032d766d18e3a06385d1dbcbf739d0154f0
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWE6q8wyuwrKhxr+EHNmT8oW4ll1JCrLKXI:F/ezSC6vUzPvxHjy2hxSMmT8oWgBCaX
TLSH
T1B2756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 80ce51aeadcb361dfd44f6dc430f49789035697faa796443dab27c1903064bc4
MD5 4d994f539207ef50f37ae6540716b499
SHA1 f459dd9dcc5d574a20f097304df8c3fb4bf8446c
SHA512 4d877b42b0d0d2eb2956e5a5501e28d8af45bdd5b625e3f4559c57d3cbf0c2cbb53bc51df0f26bb3d85648ea98b3751c6180096dbd62e24e9b071dfc512da82d
SSDEEP 24576:DVbqPb88hv/l+6VrKhxr+EHNmT8oW4ll1JCrLKXI:DVO88hXl+BhxSMmT8oWgBCaX
TLSH
T1AF559E66F6748331D073C07AC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 a0830eae84a52f037f281eb05bb663cba57771a0c77120289aef9140564cd7c6
MD5 144bf560617fb6b0c20cfc22aa8f8d64
SHA1 4a6de461e29cb36b468816ef565d6674c8eb3e81
SHA512 334350cf935e08259b7691c5e748e12b30a1bb0256493ab1c3624e39a34d0f50217dba4adb3650d5555d70a17aa6d3eeea9d44f0ca0db1b44aa75201dc88cd82
SSDEEP 12288:QHWJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:QHWrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1386523759F0D64ABEE3B8335F87257129A990DDCD1412E3B8F3A3FAC3934C5A9452212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 54caa4d1c9f4f472bf0cb28a331f10a8095bccb201584700359c11dedc3eda4e
MD5 3c5954819c59b469c28f8a6ad964262f
SHA1 18bbd4d3fb2cdb6f9fa9e8f4af00c3d6eee21f42
SHA512 97b9de3b92cfbd6c6763083271fde443723413098f66966b73304aa9153306ea16cfd191f63ae8c313aadf3d12fd969a1b5ceb8c3fdb4e636097e8b720dfa474
SSDEEP 12288:6eBNUbTVO86UbJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:6JIUdrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1B085CF3BEE28FCD2C67A8D785A918700D7B278704B52A3CBD175830D9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 654774d0d9c309574500a0c9624590164ebeb4169e5d1ca346e31fc254897bf0
MD5 556f2c6eefccdcfa8820ef64cfc8d93b
SHA1 d6afc16799ba743a3cd1401783adbce3d57ecdeb
SHA512 8c5d6811fe00648d1e1ada1022126b94d249842dd0dc54117d353d4c0465a8f74eb96c8ac4315ee89e107515142f11e918926f2dbf7c7cc51ebb37263a313e67
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH5:AQvGAdlCEL8c/yRNw5CT+M4FHX
TLSH
T1A9266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 6d0c2ab6fbba66b623e3114d2b207657d3a3aad065220b4e6edef59a1ef4be7c
MD5 36b8c5801656b8256c72b7fe2aac5e9b
SHA1 db41430a0902f676edca247177da711424b6ccd9
SHA512 c0a802040f8d5cb72d7af464b2e76f7fddb6a441788641d5f19d95ee24c8fad9a6316eca7e222a5c794636060891e907a41e107eb0aa91adb8d1fa1e325cd52d
SSDEEP 24576:g7ewsAj7rKhxr+EHNmT8oW4ll1JCrLKXI:CljqhxSMmT8oWgBCaX
TLSH
T10585E031FF74E036C67F0D766B36C716586C6A604B512AC3E3B88E9D59302D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d55f984ce783c466f52810961c188aa7d38af14ae29818b5ce3c7983bed3c1db
MD5 66c9cdfa36dc40d19adc1c62451332ca
SHA1 b7b7919c89018a9419b3eafd8882351e9d8d0a4e
SHA512 03469708db4fb17ea4909bd0faf35679013e34dc33f0354f90bd8e7f3c2f861c0ef2fe6fdbabb29bb00bcd69542534e6f343f19234acd7d94a1646983d7e78da
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHS4:gUEtQevvqc2W1cpV2EI32S4
TLSH
T192474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 51bbdaab928ff70eae3c479e45efadfee606beafd38e1dfc2fedcdc09a25f9a3
MD5 52cfecb9d51df0538de06313802890c8
SHA1 12aadc1f6396bcfd409104e835b87232a7b7ef62
SHA512 b263e4cb2f4decf7bf6a6493314334abb23061f7d7a0c70fea2d690e2fec4f0674d634b884d596d233221109c4fb7a0a61c9fb9ea1eb86976cf7fd497304149d
SSDEEP 49152:7CbRquA/m2yL5zTfFiV+XenmE3/zKhxSMmT8oWgBCaX:koquVjnmP+M4FHX
TLSH
T1D5D58D1976B8C1E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c96e1dc5ae7aef670c820a214809682994c59f4b07d8976817e7939f59f64623
MD5 5b603f8bf4e0351ab860802c62ee1d1d
SHA1 bfbcd65bb9b4a0a0f8bf201bc41d31e9635e2b42
SHA512 726091ec976d57be5b5d0615611a65ec5d9bd2570b23c091120453945b49ccddfec34aa722e5927b5af5a54c9719186317f82392fc1b1153ec5efc74e716d03d
SSDEEP 24576:KAhGLJIFoiwtA5l7S53crKhxr+EHNmT8oW4ll1JCrLKXI:KAMyFoiq5fhxSMmT8oWgBCaX
TLSH
T19B35AE80EBF955D4F5B3AA7899B68171EA76BCA95E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 40c5d290903a447bdc4651614e361300cac96b1f688437a58ce3954211197f22
MD5 96cfcece11805d845f839becf78d3f82
SHA1 1439876ced7ef0986292e66e79cf0fb52344f001
SHA512 efa48dbc0f9a901e4cfed56a04df0fa6c3757188d9db2d041098ac59822566bc29ce2ded9ae1d43649e3381c0c6ce6df19356067415c8892d53110547530fe65
SSDEEP 24576:owuSOWXrKhxr+EHNmT8oW4ll1JCrLKXI:ow9OrhxSMmT8oWgBCaX
TLSH
T1C585F14677A91CF9E9678238C557C136F7F2BC052621DB2F1770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 06f681a08a1a65a7bb784972062732bd2e1b398aad0e1b2a5b5aa7b69643e616
MD5 83e362266be95649046e00cb0896adb1
SHA1 25c4b9596c7d368d1113c8dc9a9ceb9580ae5e78
SHA512 ad21b29416842c13bf77eaee3a595e6adf805041cc50db4581c482efa6d9e9ac40c6f87f5b391e36f8e5d795088d20c313ec2b095586587a1ec9e2842ee0523e
SSDEEP 12288:2jZ1Iy1JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:iZuqrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1A175126A279870FAE967823CDCE14605D7B23899633143DF1A3547A92F33EC65D36322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1eaa5cec6045c1d3aae51c1a859b7b4e899ab0f2677bbda704181fd9d22a56f8
MD5 fa6092efc3c71d22fa8def378fa18e65
SHA1 a0cc766113bc309151d53ea63bf95ef6a3a288c3
SHA512 b887b2c26faf3936ee1beb2f5db3f192b7acc66662c6aa86bfd5f0fb7fccfb1cf790b5e44929bf92fd3ff7abfe2bdf0a68f4dc3d401c8d2798ef74b0d4916cf7
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U9:vQRQyi36YOcPQLvw2gAf+PN3A+M4FHX
TLSH
T1A9667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a7658303b9f07fca8431d8593795d9d03807627b76eb56ee91267eedaff40f26
MD5 77a369a83ce3e26d8518af98b27dfd77
SHA1 b1c2e62bd045f2e17582af8252468fa83aea1230
SHA512 741c8ff4104082a78b7a544e93f356d723ac1aef00fd2c2ba7c2fb495578d5d6742711fc10c1969a51e776c63992178fa4cc7893ce87e87aa34c4d09bb871cdc
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U9:+QRQyi36YOcPQLvw2gAf+PN3A+M4FHX
TLSH
T16A667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a357da83f64254e5902a349e25c5109e878378bc9a99eeeed23f6799493026ab
MD5 a9410428ae6cb80a376e13901ffd6268
SHA1 788915e2e502e87a0343959b7c295d672af35519
SHA512 9353f32b5a8d539fe7fd47eccb5efae0b3b6e20de6072a4e181d77a217a977f3d71f4d2d6a540e0cc8dc37599d2fe4e49ad6fef319c9e14db3915c2f84c67708
SSDEEP 49152:B68Qg55nhheWu7PNU3/ahxSMmT8oWgBCaX:/thWRc/a+M4FHX
TLSH
T180B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 79170dd1a4978278032672218e711318468880840c2bc91ce9bb7da65dd3d139
MD5 8af01d818be4b1d881a55151729a6ac3
SHA1 80fc7bcf8bf3caa23022c998ea3712df09e58086
SHA512 dada8e2c689d6ef3f51d55ccd78e92872b2327ff27d61b474526e19a6460a5b68248784f26fffaf2885113ceee6dc193f806ab5d76b74889c16c704cc3d20d3e
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99P:iy5112gYy5azzVvL69nLKnhZ5+M4FHX
TLSH
T1CE167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 114e34c0a6cb8a46c85ad043a72970d56f503ec1bdfac6c5e1b5e04a254c60d2
MD5 a3620244ffc325ebdf06cb3585f1a512
SHA1 a304916ec8e5f8dfa312d25ea358ba8c894cdd08
SHA512 c376c147ad081203f91e11e69d38245c6fa9a4fe6129e38f089a4c5532c87dad0b1570812211c8f15ea20a039b43057201e365fabfc8f1d413fffd3735fc9557
SSDEEP 49152:IB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glohxSMmT8oWgBCaX:Cu6JmVxd2do+M4FHX
TLSH
T1BDD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2a8201eefdeebbe6cf183609bd9972b2c52c8075a80232143121c935ad25c79b
MD5 4d5a87e800be193bdf0857fdbb4dd47b
SHA1 e7fdbf29430b62df09613ca47daefd111f9a4125
SHA512 6350cb1cf90e4e090b260112f5ad56a6277ce8137ac2114831b0240365596947f8026a2a9902b1081548ea7acf2d2ad790814467d580e095bb312aad9c12bdc5
SSDEEP 49152:31hpsNoJpF1A6UU44CwH7R4xEhxSMmT8oWgBCaX:3mifPbRP+M4FHX
TLSH
T121B5BE13F2D900E8D06ED17887569632EA62BC450B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 eb03162a1ecb0ed7831ebabdaae613100c75b36b69904319ab09d8de60bf1114
MD5 bde780d08b548d5c2a63658e201dab10
SHA1 e8e2bd8e5421998a890280c7ced5b5b40df1b410
SHA512 f723ec7d895bca54330bb5da8c4ff9767d58a568a8cf62b922a4fd27555a6c2993a596277ab9ac4bff0ad52f583830ac047b6b9fe2f96194cd0b4f32bcec6ca8
SSDEEP 49152:DSuZQIY0Be2KRRVtOnks6NMHq9hxSMmT8oWgBCaX:h5dKTi619+M4FHX
TLSH
T1C7C5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 556d5ea327e77f68447e6d10a96731758cfd638c2d28e6766e5a87dcfa79659f
MD5 620137d870e144a5f252cd561645b007
SHA1 2903402a5ab6438730531e59b1dcd5c06e0effd2
SHA512 20a1cd5dc3f4922adc262534a1c8ae32a36a77398138588dacf227d7f33d8e04cdf7667ad4b2d26cbb55acb628eadce3987b1bbb815c903c52e2bfd03a58e935
SSDEEP 49152:5htSn8EApI0figngiDn0AP5w4hxSMmT8oWgBCaX:IX2iyphL+M4FHX
TLSH
T1FF95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d6431b1569a71fd07d3f132f26db09afce08b8e3081adabd2bac2edf15fe6f28
MD5 72c73d25d49bb81a2c3e182a24ab3333
SHA1 77fb8bbf9c57220f3f08d1caf3dd43ac0e42afee
SHA512 7d19a55cc580edb4ee71657901b38292b66eb26bf63f860a5078ca0fe68f9d4744e470a2a848ab579bcb6365341f28081f0f5f7393ed8f489792904141e5a3c0
SSDEEP 12288:xeJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:x+rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T116652375AF0F94EBED2AC335E8620716D9DC0DDDF201263BAF3E2E683A31C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 bc76e82f0c8a065ec4a369c280a147654357a42815281e945fef1387b42349a2
MD5 bd855c9bf56405f12a653c84a83d8971
SHA1 75cb695d6124905846ff4e5e4c5888510bc72fb1
SHA512 136985a0ff94151554938e121f6b3c108b7344228d8b488eaa99a7c142d2d06150b81fa9d8a3bb0be106878e2ee9a10e1b003cf2a2832ac93823bd39263a0f41
SSDEEP 12288:O5JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:OvrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C9652375AF0F54EBED2AC335E8620716D99C0DDDF202263FAF3E2E683A31C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 c39dd4fd475156bed29f7c6993f46356e30085b93b966b8a030b72309c591d75
MD5 0fdda6d56035967fefbd8af5eca3dbc9
SHA1 c314d9b2559d7310272d5639e62980b4fa5ad127
SHA512 67d424961f1d2cbff7771e0332e6308ac3afa59bad8f9d944d47550e9a29d9a485f0aa1815fd9d55727e02b5149f42fc791c8e57333665d6c2ababb95a081d3a
SSDEEP 12288:0jJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:0lrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T125652375AF0F94DBED2A8335E8620716D9DC0DDDF202263BEF3E2E683A31C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 6cae22657181ec8189575d882417445e2a9971e076ebf736a151d860b0dfaf0f
MD5 bc9274ebb994bc98c39ca7d485081185
SHA1 2b89d884e717bca619fa18b65251287a11d04f22
SHA512 86ab3a71fc324e8ddfc6b27ce3029a961f82f8dca2a391613a89824dae927dbd62f683e5bf59604e9bd9156f4bed43760863597f25dff72b73250015b19bea39
SSDEEP 12288:DVgJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:irKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1456523656B0E50DBEC27C338D8724612D6F93CDCE322277F9F251E682E31A996931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 91dc3b7af5f4d11cd394147c40ff32ab65b8ccefd304c6cbee9dcbd637bba978
MD5 b0dbb52a15c84332ea28b44de648fb09
SHA1 dbb01cd6aa0f48c86a567eb9be5df6e4804c5e24
SHA512 3e6d40cf9bc56946c4e600616ad3aa23e2a3a37e6077e128971a34dd055fddf5b4ab9b00ff26ce0ac14b7029554d88f187a8d089c8eab076a4bb2f332dd22e1b
SSDEEP 12288:xYJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:x0rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C8652375AF0F949BED2AC335E8620716D99C0DDDF202263FAF3E2E683A31C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 0420f939aef3446a025972c35d7cbd6527f8436ecb5c77addc5a6628bcec68f4
MD5 e7bc25780850cfe3eb99852edfabf8c5
SHA1 e84e2a6bb4f773220dbc1fdb065db6c998bdfc30
SHA512 2f8f8e2c92451f9db11b2bbabbd4cf6d914aa727854184b03988b747006184e884964d97e241223504784da57030f9e55df05083071342c7b38430406732f931
SSDEEP 12288:AtJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:AjrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T116652375AF0F54EBED2AC335E8620716D99C0DDDF201263FAF3E2E683A31C5A1552621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 f08151fdd22306ddf8bcc7ae291047ae1bcf9ffa4ec2a293ada8518ce1eb8b90
MD5 9e92b47620f9d534852977288c967bab
SHA1 30b8aaf47c26f87371da098c30b06f855af4a011
SHA512 a97cded9fb9822252064eaa8faa51684e690d53f5c4fe2fa47c1bb013f69cd946a8782d63fae30654dff4bbfb99867cddb4f205a49d85cefdf25a917ebd30218
SSDEEP 12288:iRJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:inrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1E8652375AF0F54ABED2AC335E9624715C99C0DDDF201263FAF3E2E683B31C1A2552621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 f6f52335e19c361658bf5a1a961897c593d1c20be4d6b75b292c54b781ad9fa1
MD5 9558479d0d11fcc08ee53c8eac0b3383
SHA1 730f07f982da2e6d0852fe4039969b80d0a74646
SHA512 7a39d400933e026ff8cb52aa6198c4a7382461edd7dad4cc51db84fc15ebac4c240e979af84c29e2aafcef099844960592c7b1588dcd130a4ddb27e9584e9d4a
SSDEEP 24576:IZMEzFVSOPrKhxr+EHNmT8oW4ll1JCrLKXI:IZMEzfihxSMmT8oWgBCaX
TLSH
T11E8502A5B35018F9EC67823ECD218906D6F27C594760C61F07B8366A6F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 747d4f51636f3c8898090809484d9afdfdeef73b2c5ff828c07ba3692414126e
MD5 f1d43c93a89a4fa3b2297821a2930384
SHA1 ea7fbb64cf5184f2e076cc2add968430d4be60bb
SHA512 31d218ad12aaa79d269840291f069d7a6bdb47945acea47dfc256ba94fb58a3d68b262ce446b48d6219c477ff056764e00ec806cc1c173c8e1413c3b36e54f5a
SSDEEP 12288:8qJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:8arKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1AE652375AF0F54DBED2A8339E9620716D9DC0DDDF202263BAF3F2E683A31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 857ada3cfce1dabc364511c0ef5bfcd4629fd7aff2046f26572e05282e8ce187
MD5 a9ece957faea80f139013ba613652c1c
SHA1 8c3866f49063dda7211470d3df286ac8c815b3b6
SHA512 0bd7843379c67d2bd20e996cc31cd570e3928da707397b7b506de1631957b903645b6fe0bae430f0d4a4c7529b50c0f9a88263dd41c9ad193d31fd90321c87d8
SSDEEP 12288:VmJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:VGrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T199652375AF0F54EBED2A8335E9620715D99C0DDDF202263BAF3E2E683B31C5A1552221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 d8086766d1a283a2d2866725bddc2418a5f2cd22ae03e6c4c724f4c478c621d5
MD5 e70025856146d270eb92eabe5ff341e3
SHA1 cebf73a0cb059664027d8ab534995dcd36074132
SHA512 58bd9146a1a72e3931d9e006e0202a5430c217286fc13ee8ea6f0a1fb2c3388e34919f87640997a6da2619554dd9b129943074836fbc821b364bdef1e20db04f
SSDEEP 12288:kyPz5L81JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:9zyrrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T179751217779630F9D5378238C8621A02F7B57C7953209BAF5B640B7A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 439d37dcb1d7971983986107f10a5071fd319e9f3a880cdb6264dad35244c49c
MD5 e5f069d6834f3460c9e23fbf5a1876ea
SHA1 c7fc400813936b3bc20532434c0000041cb135a0
SHA512 f8ce92490dc9b3605d8356ec424d5d8b470126df2007b8c9d5dcf3969dd599265fe92a0c840732fd7a7642f9f080fe330d34a6cad4bce228be25cb0bbdb7355b
SSDEEP 12288:CqJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CXD:CarKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T158652375AF0F54EBED2A8339E9620715D99C0DDDF202263BEF3E2E683A31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 0696327647697bef348248c35b15ca09816ad32dd6808b25f7d104b6049957a9
MD5 6bb90855f098dc34754faddc987dd825
SHA1 f79017edf9b8a72861377a287e2cf84ebbde4f56
SHA512 e2c2ce501154e916b96ad51045212156b8a8160417b3aa6b6ba9d198423905fcf6556c398cd8602ffde067a4a369d4b800a809b890dd2df0b2f2e383750c64cd
SSDEEP 12288:7qJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:7arKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T154652375AF0F54DBED2A8339E9620715D99C0DDDF202263BEF3F2E683A31C5A1552211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 f9ebf0d809fe52c219bfb6750bd9636bb2c70c8d34a2e2e4bbf60110024945e1
MD5 91026ac1527a38e6f6f469bcc1df6c1c
SHA1 cc1ad89602159c2f1c2320438778ed49360a50c2
SHA512 bfe77982f7d2e6ef26ff42fd0224bdf4e18b6124f318486a96b18150c148cd0af5798e5ce96503ccdf3137b2a1b7cb836b1f5dd32fa5ddc8d35b6e554178703a
SSDEEP 12288:qyPz5L81JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:3zyrrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D4751217779630F9D5378238C8621A02F7B57C7953209BAF5B640B7A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 36a0035ecba77b0fac8073a24ac1dbf5be51789a9e9cb7c68f3a582de2449471
MD5 179d86a3cf79623447663fbdca19f50c
SHA1 043d32f20db00ceb2a8ff3ff8c4a6cd97c8d87b3
SHA512 a8e5c190ef01f378c9a21ebf6f6ddef940c95617bec6accf2fc6052420968ff27a5dddc5cf765120996d0efb925c3e6cc942430f0cafe32614dbe044367d2197
SSDEEP 49152:wMnYIZhxSMmT8oWgBCaX4Zt5TkFyAnh1EVRh:Lr+M4FHXi5Tk0AnMd
TLSH
T126D5F029EBDD48A5E177923CC9B3460AF6B278281B71C6CF025953AD0E33ED45E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4ff229764efbbddb3fd88ebbed1967afb9115f5f027e077094cc5c57bf85e0f2
MD5 62dae291cf1f9944b7ebff811a50d4f7
SHA1 4a17f2fa66d522a106699ea28db53fd935478362
SHA512 4f24e3684b38e152fd0a72ccdd7dc0964ef10bfd62f077e5751b7a2dd004e4e0eb31f2276d6d0abac91d2f9159f51380e885eefd122e4acb123c1134877834f7
SSDEEP 49152:HYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YhxSMmT8oWgB3:jySzPg+M4FHX
TLSH
T1DD066C96A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 264fbf0716ac412e766db6bb371608da4acc0a89b2ea3b8a4c321a4ef9d6c8f9
MD5 3614ea60a393217dc2330bd74654be58
SHA1 adf86b6bc8e4fe486122bedfe863fc2a9a1192c7
SHA512 47e3a096f0986b1bba5832e19af4093b85759ca85b3506f8c80a787ce4a91e76e591466237eacb69a59f9e22a72ee3c26dbf11d2f698f384156a0c95cb65ee4d
SSDEEP 24576:h47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY/rKhxr+EHNmT8oW4ll1JCrLKXI:h47JUQj1irIhCnDHUPfF/ohxSMmT8oWM
TLSH
T14465AE1EA3EC01E5E1BAD23885154A1AEA71782E5B31DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 c47995c67f805991de017b168ad096de6e071c96ca2b51bc2136b066f5a5a9e7
MD5 5402d1cff1149c4bc31adf4d0937eec5
SHA1 a9a1b7c5ce190695c0dac36190ef9bfca5f21dc2
SHA512 924d9b1c3e31c75e4c7c2d145e8f0574db650b9a7520891db2245baba2f02ed84c03507a41cc27b1fdc8e12fed9a3381c606b9f2ac781b518681edb9abac20cc
SSDEEP 12288:4zsfaJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:XqrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DE75F119D24801E9C46E9239CB524A01F7773C6993E193CB5BE0FA3D2F36A945DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1016KB
SHA256 fe58a06d09061be378d550db29a4c6e9aa8de6de3e80508fe55d2b3f5e37603f
MD5 7c262af0d22b826cd99d4a80d2dede1e
SHA1 2a13e16d44e695578bb89408a1f62ed09d9d5efa
SHA512 f594c97a1b1b61dd9529c113975a451013473366666e28ad6f39db2af69cc84b95d3ecf82d4a9f4de5aa047f648a1007cdb8b9f4ced79085d4e015cfbff20d43
SSDEEP 12288:89QGQdU3frl6/563+/Z4yHV1S84HYb4R+5ike24kvMP/AyMB6YbAUki:89QxUPrl+69R+QknnkP4yO6
TLSH
T1DB251811766ACB4FC66D44322E36D6CCA7707D11EE04AF0373C9873F9576658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 141b15c046805caec4f1739e05fd4600b1ea45ce031917ac9bc64cf6c0ab6c78
MD5 aa0e580e3e3b68fde41b88d97987ca0c
SHA1 cbbfb981e2a0cabf931d0852eaa786eed6142e91
SHA512 81a198c9262e4c40742658887c3064e39532ef672e4e581b283e57738e541ac37b232879578682dd00166d353efda4b047a6e584f2d37868d1b63982caf33b98
SSDEEP 24576:b7xXz+Zi6cj+JfjOmpD2Asd+VcZLSs+I198iw1FI4UCrjrorrMq:X6c4vorV
TLSH
T186652B416137E7CFD1BA6032132A5B8C77A4EC17B7096F26B3C9453AD86AB5170B83C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 c174f713a8d677eb62141519d750dea9ba307f2060b616a225f6fe527a99d498
MD5 f96b4c3e08efeb49e9f275688be6137f
SHA1 6baf528337986b4c122d06d6d10d244093c3a635
SHA512 1cf0c872a7b5973ea43ca52af09d0c7c86a2f71c34d1adb9abe53d4a9893f223e6e363d40d6ce8f57f1dd48050a99a20ab5fb58b9670529d54264d792632709d
SSDEEP 12288:QO7yJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:7irKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1C46523719B0E989BFC3A8334E8674321565D2DACD30055FBEF2A2BA87931CC95D72712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 274f78988ca9e5e3f9c8cb97ca0fb84fb0b4d3087b8d45d8ca55dc9dd394f6a4
MD5 78c130ec3386d4f2412e4cb9d9d26072
SHA1 80b65f93d74f3bb5a86fa4de3feb949083ca168b
SHA512 72e518a065409767d6bcf34d4d185b639456950d5f0b7feb47cb8883253f09f34125cd21590e84698d4ec911a2a4e61a48a27fbf60534b38f5ba6631012ce252
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bYwrKhxr+EHNmT8oW4ll1JCrLKXI:Pgb4mBIBhGF+hxSMmT8oWgBCaX
TLSH
T147659E1E22EC02F5E0FAD2B8DDA64417D6B278161331D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 b2564f513578292fb027f76f87be4aa00d2349e7c91ae5e22126079d19d70aa2
MD5 8429a8cc6652501a0b4242a07048b6f9
SHA1 e00a7c3ccb889e48f284247d686140f5e23cf31a
SHA512 6a86bb5a92f4b938bed2bca52e5bf0200f4d1a83abaa61ef1c63a9ebd1ae888a9e18a797febad1cb8e1b1200997dc0c078f2cfb46e78fb3d336f61f370b9f5b0
SSDEEP 24576:aG5lZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:aGfZt5TkFyAnh1EVRh
TLSH
T133052329B3FBA8B4C12BD13DC9B9A9A73863712007C565FB0488D2745F016E6673DF4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 fff0343bc9dc0f5ceb39ae4b1d948ffb12528c375118670b9f4052aa2fe68c5c
MD5 a3d1b3c528b73210e1438df41b7d62bf
SHA1 e163342243dfd920f67d269820618abc779209a6
SHA512 387b04dece5f6b6d9a04853a2ff182de3a3b33545f4b376cdb7e242d46afdfc3d85a31eb831dcd4b3dac6431c7106ea63aeebd5b668f28c91bfd25782ab002b7
SSDEEP 24576:zG88u8FpJqH1hzria7/mPrKhxr+EHNmT8oW4ll1JCrLKXI:C7ZFPqVoa7/7hxSMmT8oWgBCaX
TLSH
T15795F16567E101F1D47BD138C9824663F6B2B8251360EBDF0BAC8B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 37b2f977fa3aa6f5ddcd00a7e041fd238241078cf3b6f2f878bbc8b910f9e617
MD5 5ef720a4d70079a6beb5488a2281f010
SHA1 6e3520d7e9c83902d06b6bd051cf31e5e71180ab
SHA512 eac87b885bb1c9b582346961e03dda16f0c7067d7bfe17e89b918ef413f5fd0210fc7f349a1955cad714151c5d7ec7e5be8008f8299c3ddbd3d5bc6dc3e683ad
SSDEEP 24576:bPUr+NQTrKhxr+EHNmT8oW4ll1JCrLKXI:bJQihxSMmT8oWgBCaX
TLSH
T1B485F12F269D18E5E67AE13DC9824719F7717866131292DF02A1817E5F33DE8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 30aaf6398efde76e7e0d686ab474394a3ebba705098ab9eb92f1665dcb2c739b
MD5 f8f764ff303d3b68ee38bfae6e953991
SHA1 b140c76afaded7e3bf72acc73e0cbd802ba183e2
SHA512 aec60cb8a0098ea54a059fe7a99e23537925d2d0448a87a7d7f61f1fecdc0cd2ea7607d102c725a86dc68c42e26cc8dfc8a21d50b4328db26a002973987692b3
SSDEEP 49152:JBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjShxSMmT8oWgBCaX:qG05lO43bR+M4FHX
TLSH
T105D5CF6E62EC11F9D1BBC17CDAC64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c3c7b0aeb57ab1069c99473111c7b1b6ca0175c41f6b910d4230e6f69f93ba8b
MD5 fbd41b9bf1c86f874f72a7504185905a
SHA1 62db5fd028124cdb95c035789180d6a62dd59abd
SHA512 1417ac12c726c083830dcf4e260a8e10d4a517f520591987ad1df51333432a6e3d1c103d7a944a903dc6931ab4f4108004c8a1f7186d047c8dc45e7a4bbfcc87
SSDEEP 24576:Lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnxrKhxr+EHNmT8oW4ll1JCrLKXI:Ta5POZ3+Jt2pasx2+mahxSMmT8oWgBC8
TLSH
T17665AE5EA7EC00D5D579D17DC583861AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bebfb4a4a05238ac992f021eab4dfec7bd3231359fa41d409dae2de89e151ebe
MD5 9184dabdc51678d729401064ba6a0562
SHA1 5ce73331f476082f4772b958f776a736e9fa2e21
SHA512 7f93acbf8b65f64d4083f1f073db0ea2ce5cfb9f35d5ac4eabb852879f1d7d7f0e8bba53aa97fb4d2883abc63e14d706a13baddd260c4ca9037ad09006030186
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7Fk3rKhxr+EHNmT8oW4ll1JCrLKXI:7Nc/zEOVHFbhxSMmT8oWgBCaX
TLSH
T100858B2623E900E4E5BBE1BE89779546FA717869533086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 e63bf1bd2806a78812231d28386bd7bcf1460a5e62a5bf40cba66bb9a99e44b5
MD5 2ff9b21a66a059b6ea11b4818f28b5b3
SHA1 29d898a6522c2784be0b0270150d352a4fb64537
SHA512 56568ab8d0a674d10e963ceee472889cc525d24b71f62f65193dc3c313721350370565921a7a06613500352c750f667b18fabc756690a33e073e7a4a04348b43
SSDEEP 24576:96DIHlZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:96DIFZt5TkFyAnh1EVRh
TLSH
T15025011D73BB10B5D06BD03DC6920546D1B3B07187925AEF0688C6B95F93ED9BA3CB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 580603fde88a64388bf88fca0c3d8e9a557b21582c956af494991c692697ac24
MD5 655664f2cf3e1bdb4d6bcf4633b6f261
SHA1 d741697047d471ca17a3bfc6777326ab209f64d2
SHA512 63dffcc54bc3fd6b90dab3fbb445a35ceae79428beaaacc0542dd805f00da8db70fd00251229d06da20910b86a3857da64ce207bd41eb4bda488c00122b1cac2
SSDEEP 24576:ctyulZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:ct3Zt5TkFyAnh1EVRh
TLSH
T1D9152311A3EB98A5E16B913CCAB795955E37BC2007D193EB1084E32D2F227D56E3C70B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 05dab736a58f6e83639f9ac0f4d8fae10832a76ae2f1bafa7aee0ee4d37fdcf6
MD5 e26b83aa1a240fa71f053f2389839a44
SHA1 df940354d3bf3380990df5f33e97f3852845bfd2
SHA512 d570a49ed2e2213b8220978f59108b8b2a8d5d7d4e0ea0f4fcd17239ed640895fa9d96d5173ab0540d6c63c64de569350ec47ca5478c0cf82799dd2f43692ca2
SSDEEP 24576:w8lZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:wGZt5TkFyAnh1EVRh
TLSH
T1D0052329F3FF9C75D10BE17CCAAA699A2527B13407C665F31448E3A41B016EB1B3C74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 f4e587d6f604dafde2b34ac5aefb1a493e77725f40ebc5003ab0f49cb79a104f
MD5 9d07b2dc899ce17ae6cc2da58313bc9e
SHA1 8c24ed8cb8f4c3ed25858fc3973515d8e0dd8e34
SHA512 34d103944f133ee342d01c19deab90d9a8f69ecb420753b17cb06c5463117ad7007eddf6d0ee007730260b5291dc8e6eda14311681455fe3c01c4e39b2db86c3
SSDEEP 24576:3ggILoTfaidZflZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:wgHTrZdZt5TkFyAnh1EVRh
TLSH
T164659D1DB3EA09DAE2B2D239D9621493D633B4311772D6DF2448C03A4D9BED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 0f3c079b8f34d29cc383d9fa507700784eb0fa5c10cfdcb1e29b27e9a20a7c3c
MD5 a9afa376485cc0acf2fe706ef9eaa4d7
SHA1 39a1a5f7fa35f9c0dd50eeb34e43e2b89766664f
SHA512 9aef6cb571f4e12784542eb95740d46cbb26f690b8e03002ee6fb9ed7f1a38b970f8b3594f33732a16b5e3bd324078f3e92d0238fd623b4e5f20f6e493fe2849
SSDEEP 49152:Fgb4mBIBhGF+hxSMmT8oWgBCaXnZt5TkFyAnh1EVRh:FtL+M4FHXD5Tk0AnMd
TLSH
T170A5CF1E23EC01F5E0BAD2B8DDAA4417D6B378160732D2DF115042692F2BEE89D3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 d0f326f5b98c1ddd0d4db72cb7f96489e398e5685ff8615ccd5f5cff990f5230
MD5 bcfa3184b4c61c841c07c8dfcc3489fc
SHA1 88b4609c129e7e0bf98361d2ad2755c0ae4caf27
SHA512 cee24a128f9654366964c7d5c6afcd7e178751bb4dafd2913c8d09ffcf72dd78049a9f629b9fbb7cce4fd8e77a3d9120e2904b4c2f1d0a5d5de9255344848d6a
SSDEEP 49152:sDMwBtOm0hxSMmT8oWgBCaXtZt5TkFyAnh1EVRh:mFc+M4FHXN5Tk0AnMd
TLSH
T1F4A5D02EB7B945E4D1BEC674CE238512EA737861033293CB5294C13E1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 2.6MB
SHA256 9d411e26ee4eddad8aaf245a0395986615e3f02f74b31989ea1886c6af596e0f
MD5 13fb5d9182d7403f400d5c1e491bdf61
SHA1 590e28f83fa641006eb435ee92395e3662e23e2f
SHA512 12c4e673e8ffd0a299f4573cbf4c2f5c83c16d527ebd1771e5e0d14b98f2e367a3483e84be4100e8ff903e9fd70fe7789bcb48c2838d42a151b327698bfe790e
SSDEEP 49152:aDVHeBIAAhhxSMmT8oWgBCaXRZt5TkFyAnh1EVRh:A+M4FHXB5Tk0AnMd
TLSH
T1C3C5023EE79D04E5E57BD17CCAA38A06E67338AD036266D7059482B91F17EE42D3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 989b750a635e0f34a9735f53fb7bdbf240c2216891af307efa41e400772d9799
MD5 641a926a8510061242c93a5d90df5160
SHA1 2bf11bd78f84f716c98e872803bda1f9837450a8
SHA512 5a54174bfc2a69a79b2d94f95306823f9b0e9b66494d08bcb79349eeaa951f42580425fc26b32905de5f8fd2dfc419bb2626cfcd19b8234b0295155e81729da3
SSDEEP 24576:0JnJPbzB4SLlZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:0JnJv6SZZt5TkFyAnh1EVRh
TLSH
T1A935E13DD3A910E8D4B7C274C15A1A5ABE32343D2B2669D719B4D5343F02EE0AA7DF09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 018dde9d43b748defcfb581243eab4763766ef9c6b8ca73cf54261f612cc2130
MD5 ad96397de65f85de0fe83ca7fd4c1c59
SHA1 d3049e23a1b5cacc9dd344dee797b59a9beb2648
SHA512 f7ef95a64db4c8e8a724920d7e249ad7d8e287e7467a7665f1ccb0c997e395620ae02a10545b98149fe45c663adbcc0640082c3c9cc3b029311995b17117a58d
SSDEEP 24576:zglZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:zqZt5TkFyAnh1EVRh
TLSH
T111052325F3EFCC75D10BE17DCAAAA99A2917612507C666F3140CA3852B016EB1B3D34F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 4f11ae4bf50c7c0ee74c02bfd44527adad4a4a44621624b336db571cef466f0c
MD5 2e9888d6605f69ef7487f82a81ffa803
SHA1 986fd0fe2239c7a9162702e86282f845699191be
SHA512 fbfcbc3b505622273254c1837b2c47ba1c4f4fa39fdbd75de6b92929c3c788989ccc51c7cd907d62ce8ba880e0f4e105954bd6600abbd733732999f935594e13
SSDEEP 24576:46Uqjp6lZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:46UdZt5TkFyAnh1EVRh
TLSH
T11215231EA3DB58F5E02B9138C9B5816A4563B83103E665FF30C8D3794F31AD5963EB06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 855056745f9c04e95ea180d947002bc3d538d069f1f95a680d5a84319b6734c2
MD5 9e6f189e008ba7c23b65b155e880f268
SHA1 03a14f3ad01f7b135afaa1b5d4ad4f2b6dad9e43
SHA512 125193518ea9ad1b6845c7c0da62bfffab92cedea488e798ff1b4a29e9d5040e63b92b371e20e5a2938ed613bf08162e394f886b2eb52126ea7ed93bbe044fb1
SSDEEP 49152:9CLHGeeV5ijCmlDWDkEZt5TkFyAnh1EVRh:kI5Tk0AnMd
TLSH
T111A57C05E7EB4184E8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 0942f1968637ae44185b85f90301b4d22bcf573ea8d02b1859844fb4618dae65
MD5 f5c212782982ada351d793b737b6f67d
SHA1 99ad0c5be20d0c46b1c51bf10e0c880564afc8da
SHA512 d5e1f4819f3a3f8f8cabc7d2988dcb0007670e0c7cc31d4f7682b55e3ed6ce706528f272b4efabd3405d221d4c0aa68807dc7929b1b7fd38072da48599e08f8e
SSDEEP 49152:0DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3EZt5TkFyAnh1EVRh:x3Upow8sBV5Tk0AnMd
TLSH
T1DFB59D3DA2E800A8D9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-141-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/948-149-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/948-143-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/948-351-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/1332-41-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1332-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1332-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1332-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1332-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2464-154-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2464-160-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2464-166-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2464-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2464-168-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3112-89-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3112-262-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3112-81-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3112-83-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3336-31-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3336-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3336-23-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3336-29-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3336-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4648-93-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4648-290-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4776-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4776-47-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4776-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4776-59-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4776-60-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4876-113-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4876-426-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4876-107-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4876-424-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4876-106-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4876-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4924-231-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4924-68-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4924-74-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4924-63-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5112-442-0x0000014782D70000-0x0000014782FFB000-memory.dmp

Download

memory/5112-423-0x0000014782D70000-0x0000014782FFB000-memory.dmp

Download

memory/5320-11-0x0000000003220000-0x00000000032A5000-memory.dmp

Download

memory/5320-62-0x0000000000400000-0x00000000006C4000-memory.dmp

Download

memory/5320-1-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/5320-8-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/5320-98-0x0000000003D30000-0x0000000003D97000-memory.dmp

Download

memory/5320-103-0x0000000003D30000-0x0000000003D97000-memory.dmp

Download

memory/5320-361-0x0000000000400000-0x00000000006C4000-memory.dmp

Download

memory/5320-9-0x0000000002DC0000-0x0000000002F09000-memory.dmp

Download

memory/5320-0-0x0000000000400000-0x00000000006C4000-memory.dmp

Download

memory/5320-17-0x0000000003220000-0x00000000032A5000-memory.dmp

Download

memory/5440-346-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5440-127-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5440-128-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5440-344-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5440-134-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5840-412-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5840-171-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5840-177-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5840-170-0x0000000140000000-0x0000000140172000-memory.dmp

Download