1b8fdc546ebd8e2e667014ced9e23d9f3499adbb5c17f0880dee9956e543c911

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 1.5MB
Sample260930-b4k5bastcs
SHA256 1b8fdc546ebd8e2e667014ced9e23d9f3499adbb5c17f0880dee9956e543c911
MD5 4b6a2c67e1ab4a98faf61d3192f6b21c
SHA1 b2fb4eebdbc4b8f3e68ce9d2751a63c355fc4780
SHA512 a41f2bfed8b9c12bcace5d095418ec654098b1dc8695db38de34823b22637a8f3ec782fd09e57843bbefabab535417c1314bb9ee329f57f0bd216bbe37dd50bc
SSDEEP 24576:6Sx8FXpSBhvn/+r1fGG7uTeqGybWZJKSMCxVbT5o8P:nKXEBh3qr7uatQSLxDD
TLSH
T14975126179C1C831D6B71A3458F4DB79AA3CBCA85E34C65F63583A6F5E305C2A920F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2108	elevation_service.exe
1332	elevation_service.exe
2892	maintenanceservice.exe
568	OSE.EXE
5688	PerceptionSimulationService.exe
2000	perfhost.exe
5724	ReFsDedupSvc.exe
556	SensorDataService.exe
4616	ssh-agent.exe
548	AgentService.exe
4376	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5c24314825f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105218\javaw.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c91012e7d50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7baf1f37c50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bfdaca2d7d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd72e3f27c50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dee04df47c50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050bb082e7d50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000deab1af37c50dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058b501f37c50dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2108	elevation_service.exe
2108	elevation_service.exe
2108	elevation_service.exe
2108	elevation_service.exe
2108	elevation_service.exe
2108	elevation_service.exe
2108	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe
1332	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4992	2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	548	AgentService.exe
Token: 33	4376	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe
Token: SeDebugPrivilege	2108	elevation_service.exe
Token: SeDebugPrivilege	1332	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 2612	4376	SearchIndexer.exe	100
PID 4376 wrote to memory of 1972	4376	SearchIndexer.exe	101
PID 4376 wrote to memory of 1196	4376	SearchIndexer.exe	102
PID 4376 wrote to memory of 4344	4376	SearchIndexer.exe	103
PID 4376 wrote to memory of 4660	4376	SearchIndexer.exe	107
PID 4376 wrote to memory of 3392	4376	SearchIndexer.exe	108
PID 4376 wrote to memory of 5560	4376	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_4b6a2c67e1ab4a98faf61d3192f6b21c_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1332

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2892

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:568

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5688

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2000

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5724

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:556

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4616

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1196
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2936 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4344
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2932 2936 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 37dba58483d8e07bbf3d6373b5b1534149d34e9bd1a0b404d41a9458dcac4bd2
MD5 c4a3885a0dbd5e2106455e9ab8669cab
SHA1 f1d19d5a9309eafdc8cd723485def321fbc88c9e
SHA512 98a839d0355cc4bdcde0d7d795e3969d41fb202dddb54d810de791ebe52e79ecaea24f918f38862770136d3713f3cbfc8df1711bd8814ab30174213c78de07e1
SSDEEP 49152:ib+632BuPkFKRrdE6ohvstBhuXjfS4LWxn/uatQSLxDD:E3q6sjBM95L
TLSH
T1FED59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ecc013113331065027e0b7010833f4f519d14571c7dabd215335cac1fa05583d
MD5 0fd6f0001e41595d13baccd2b2a164df
SHA1 7e994371ab020b64806991c5fa0c5f4a55074f25
SHA512 43e207997fd5f2143547c95c3fe6f318038bb9a41b56bb30b533e10f47279a2b6616cb5f12e928a241ac5af433ff81630fea9b82fc0b2185f588d900cd79c0e8
SSDEEP 24576:HXYfDtczAguTeqGybWZJKSMCxVbT5o8P:Stc5uatQSLxDD
TLSH
T1AD65012873A408F9ED6B827DCCA2C401E672BC9547A4E7DB03E499661F336D85D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a22896e18ba78a493d13005a63a2af1b91df0fc4ae5ea8d29ffec8d302d3804d
MD5 c92070821f23808eef608d8dd2761dd4
SHA1 3676857afb9e793caeee5f4079e1a5bc5d69e651
SHA512 45fb0754a46839c0fe809322e2da7ba7ced1f343cc52dd51302bfa980708978e9e66fef370777b60d4b2f08bc103816f7d4a0f486b0fec4e5da5105787a4cb4b
SSDEEP 24576:A0Le5ji0hmxxrMHuTeqGybWZJKSMCxVbT5o8P:APji0AjWuatQSLxDD
TLSH
T10085AE65F6748731D073C0B9C5D2A68EEA7130865B308ACB4286D77C3F67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bd16904b15bd479bbf8e005479b8d68e4f909b85e52c7ed14133d3665b61f8c4
MD5 ed28edd5129f49330fcbb620e18d2e27
SHA1 45a54acf292d7de52f1c0c9fae9280590b96d854
SHA512 ee8fa93e822f0b99890569ae25f393f41e49fece87fd1136d93c76c30b8d6eda7728a02450bbd155c30895c046e0d6fd4dbe46dfa0c6f5245abbc7113844471b
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWn6q8wyuJuTeqGybWZJKSMCxVbT5o8P:g/ezSC6vUzPveHjyquatQSLxDD
TLSH
T18E755D15F5788323D0B2D0BAC5D6BA99FE7230865B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7a11269118d4b3b61daba495c931e494362b73a945f8dfa4c81736433b0a0e28
MD5 ad867d4032e3e209b08357dd24971978
SHA1 e46e5b45a8c7e0532c8eb5faf521c5ce42b493c9
SHA512 0f7c9a270fb339649f6d3c96bc4df4fd86dd1f126a8d04225941822b0e2d2695d71ec4e89ca7eae9e93779aa437d4ff1e4a6a2cc1fd43ca27b8809b7092ac01c
SSDEEP 24576:qVbqPb88hv/l+YcuTeqGybWZJKSMCxVbT5o8P:qVO88hXl+huatQSLxDD
TLSH
T1AE559E65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9ed8b6261849ba7f1862b26a00f23cf1e2063a99a5b901422fcb1d5c0d61462f
MD5 abcb00c446efac324aec11fddf65af45
SHA1 59b912c1cb917afe131832ed794a73b8b821bdc5
SHA512 7a5beb92028003a0a3fa335218ab51fe4465169619001b44ecef4951d4c99e9ecf153f19f546ce752e022749c3d29c6d4674afde40bed3ef4a38b8f72d1483bd
SSDEEP 12288:BLGIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:BLjuTeqGybWZJKSMCxVbT5o8P
TLSH
T1984523D865184C45EB4FC777E875D896B640CEDCBCA8099B626178E71A388EEDCF4803
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e43c38313132c1ad27568d163b2077a93969abc2ea3fcf6a29fa06a09bd3e133
MD5 46f91a516afd95084c8faa38d6794c9d
SHA1 be394afe4df0ea05f025f1ffbd5905f323a9602f
SHA512 bae566f41b165cde4ab1e3f808220535fc68fd45fb735e7dc435e206769d4b048da14d7a8271bdee58822b4920e6b9e743e4fe65139de4a3cefc5a06e182d39d
SSDEEP 12288:geBNUbTVO86UfIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:gJIUEuTeqGybWZJKSMCxVbT5o8P
TLSH
T1DD65DF7BEE28FCD2C27E8DB95A91C600E76278704F6293CBD174820E9E235E54D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4eac3f9cf1cf94da6af979839b22596599f2a25186311604d7b0e5fc6dfc4d24
MD5 3976c3a1fbfe79e0b08f8139f99ee0fb
SHA1 b966b41b989bc5efb42554f325c2acd2e2b09aba
SHA512 38929b110dd089be3514c2be2b1a2cd99bc7cdf3f5221826f9987d90b1c6680ca1cef0171e17b8a3f2e326df781acf857adb9431431d4c0824d82e69864437a4
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THq:WQvGAdlCEL8c/DRNw5CZ95L
TLSH
T1EA267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 00a4759b82d82ca4e15a9080e429ab95514ec6c6e9efcc1c578ab83a3df1aaa4
MD5 435794ad2a3e92ee312760752732fdb9
SHA1 d927f6f08f0fccce0e76e2670b95daf3f4521c68
SHA512 660439f949540138ffba17dfdc7f5f9dfa42787b56e5f065bdecfdc990d06a8042ef8182634db2a0220e53cfa2512e79f766d6e2ff107aeb597df542613ae15b
SSDEEP 12288:FAwSfxL/2Dc3RDLLmt0LDQewsAjBIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3Iw:m0ewsAjmuTeqGybWZJKSMCxVbT5o8P
TLSH
T11775E030FA74E436C77F0DB21B36C716246CAA604FA11AC3E3A89D9E59341D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a482c128cb2f9d70b7f4b8707fcff30391c14242d72bec92932cebe5475a78af
MD5 7b1c45537aa6888f7695bc27083835d3
SHA1 f3f0b5381853d91461aea10f55ccdae4f2a451a0
SHA512 c82273d497e93392db08c874bfbe56efd9057218c18f0b08769123b274b754d467a49cd3102db589c9d8d8764837308ac12861be92f955aeba794ef5b1175715
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH+:uUEtQevvqc2W1cpV2tI32
TLSH
T16D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5745ba3778d426d84c9e4e0ea91931bd1b1e11399376d8d43b9c0e19fb7e8aa9
MD5 211424701ab741a4ea9f88c3daba3898
SHA1 74a02f6f2e7e0fce2252f540ba106d00e75f19e2
SHA512 2b37559bee97d5234bb02bfa8e8ea68c6bf9dac7e5e191745005577405052b9b7e7611fc97e757978680af22c2de71f8352d30ff91ae4a4c31c2d5f2f1334580
SSDEEP 49152:oCbRquA/m2yL5zTfFiV+XenmE3/zGuatQSLxDD:BoquVjnmt95L
TLSH
T19ED58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f45708544f9da61206ac8fd98a57a6af89438667975113caf971e404e5510685
MD5 e2db07a53be327b273220fd07143ec63
SHA1 260703ef025b792bc4717d8a62ddc2bf0067beef
SHA512 5aefe66caef06be639a35e340926b4a9d517902c5065c697debe23efb9f886f1375a93df60a19ce2c4ceeea64f3bc1d4ff7682d9be53872cea284b986afcc521
SSDEEP 24576:LAhGL3IFoiwtA5l7S53NuTeqGybWZJKSMCxVbT5o8P:LAMUFoiq59uatQSLxDD
TLSH
T15A359D80E7F955D4F5B3AA7899B68571EA72BCA95E31C20F2160D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a971ae1baf12c8ab7cd3c15634677e916894da931b49b4186f7f737d1beea8af
MD5 96922716c9e88524130cd73b5d65fdf0
SHA1 a202a296b85f980842947a88e6013ad27af22369
SHA512 0265c49eab7d7a48c55fba8c47b36395183aac3fb5bf124580498e51e8d5cb45dc233de9d27021d73f472238589ab400fc76e15675da5a48350e5d590964e6f6
SSDEEP 12288:Emw5HEjsChNVBFgl0WDm+CUIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yF:hwu4OWKuTeqGybWZJKSMCxVbT5o8P
TLSH
T12D65F18936A40CF9EA678239C557C436F7F2BC452A25CB1F1360C65B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2c3a91aa49819d3a6f01289ca95ff9edfd2b88b222f8127bd4f5ef9e89fdf3e5
MD5 e7f9223c8ecaf96c28a88b24a8a13956
SHA1 a63a3d0a0c27d8740d5835e3d160931667122f5c
SHA512 1074a99ee214077e5be09aa4ffb85b9d93d9731bfd4e7b00ff4ab84f4c92dcad55b07782d254b21d3bf6867990c380b04ae4d2dae4c21771e9afee00595aa02a
SSDEEP 12288:teZ1IyRIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:IZuPuTeqGybWZJKSMCxVbT5o8P
TLSH
T12555129C32A824F5E7578339C8F18945E3B1BCD96B7503CF126065AA1F379DA5C38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f6efd09f1566df722ae2b91d319e75ef2222c4594c8d79526319b9959bac1c5d
MD5 aab7d613bc0b6286527d34e7fc096f91
SHA1 af8690bc54722574c5099ae81fef08836a86f7fd
SHA512 3182460ece868588d7719847ae8f841a446367f3f304082458e49a24b60dd83f00d56057d317c5b714d2a92d818d6a3ee3d10e4520c03f739c5fac03b01ca3d9
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:DQRQyi36YOcPbLvw2gAf+PN3o95L
TLSH
T1F4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a846fd4e748d415341908ff9f57b8a3f6c3e97f874271eb2a927dc2a9d76eaaf
MD5 a1141348ec02dfc55821e7a046aa9968
SHA1 fed216a5868ca568f2c21b3449bfc1f9f36d11e9
SHA512 edb068eddae9d3a350927999c4a5de1b7e8f7f12dc6ad6123d41b3d183fe2096c90f04f123f09e77955591f5648b646d0ea0b630c522e9535811159846bc2551
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U2:yQRQyi36YOcPbLvw2gAf+PN3o95L
TLSH
T1F1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8cbfe91c2fd4ec0f8ae0bab879deec23e164367446f679cab951b89206dcdb9a
MD5 f37080ad4f232bfe9564afc26cbf487d
SHA1 d79e5fc5eb5f057d943962900e9ed262627cab0e
SHA512 c1ea116ae3cf9d5f971ea7821f099310b6fae3da4cbe9fee5eed1d44ccdb21b275eaf3103932588f136909c37531d66aca0646e7d0bb622caf14c77484f1d781
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0/uTeqGybWZJKSMu:J68Qg55nhceWu7PNU3/WuatQSLxDD
TLSH
T1CFB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8111721A1BB2AD47B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7dceac368fd11feba2b67939beb6de4b5836c9e65ec353c335a03c1e1c13082f
MD5 14abbaeb2e4973a2cc940df55ab0e211
SHA1 aacde76249e72124895d2dda1ae0df947888a18b
SHA512 c8849a9e5c8ca7ad508de0f3d733e4cde133b603eefcc80947d182cae4eb4e44e11ced6f2464b9674e36faa7ecb870a10caff31858bfb06961e43cf298fa504e
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99I:Sy5112gYy5azzVvt69nLKnhZj95L
TLSH
T154167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cc6fcd4764ff6c5f898997bd83f47491bebe2af7f6703d1ea72684e0bfdf619d
MD5 988953589b0ed1eae84007d1950d2ed7
SHA1 5251c92430cda44ad386c928923284c5110b6fdb
SHA512 9f47f94550dc2345e9fc7cd139583855a2bf4fa647947c5d3d7198718585e297439183b14777f8db1a8e40f53b0da4a797e7800f0d118a5556a82744a91300ee
SSDEEP 49152:mB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glQuatQSLxDD:Uu6Jmdxd2dQ95L
TLSH
T18ED59D13F1DA01E8D05ED578974A9233FA62BC490B34B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8e02a7d34fe6acd5ff431223796833322643af3f6547997df9e998182a06fdb0
MD5 969867dd860b217ccc94f735c0374982
SHA1 c29d8d5c09cf5edff0cca37c990d31df3ca965ec
SHA512 21c54d74dbf9cd72d9f021c2ab784b21bc4f0a2fc4e184874d26b8945133e8f06a54ca26b3534dafb3905f115510f245b1a43fd95a96efc1460c0d54da866f29
SSDEEP 49152:u1hpsNoJpF1A63U44CwH7R4xkuatQSLxDD:umifPWRt95L
TLSH
T1D6B5BE13F29900E8D05ED17887569632EA62BC460B34B6DF0A90B7962F7BEE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 672e7299faa5751b20453082ded59fb224022fd0ed4cee26f8a028a105f73f17
MD5 221b89637a581886f6ec0b3a2c47e786
SHA1 2e2992bd10764fc3223f1b76ade9d52d491f1a92
SHA512 a606d370f7d27b56f5855a2a0e579405c1c7f8df9287a805207909c8a81539402743e6ac64055a60ef7953d0c87b59c890ac8a0020cb614738bfb21a6a5f4a2d
SSDEEP 49152:aSuZQIY0Be2KcRVtOnks6NMHqPuatQSLxDD:E5dKii61P95L
TLSH
T16DC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6d2d99799258fac954c471756116e43028ec7916c5ea2e17eb0da5da1cd5b845
MD5 100fca485fd3661a64f3a8b5527e1201
SHA1 560b2ad3d8ca2aa9a45d9f3bb1a936f2c8dc582f
SHA512 e53547f3c9aaecec7f9099324fb2db0ae83f5691cfa141268a63df0a8eba66f7a9847853bb9975856ce4701329866e53217e79beefd88a57803a18bb8636434a
SSDEEP 49152:DhtSn8EApI0fig3giDn0AP5wguatQSLxDD:iX2imphx95L
TLSH
T16295BE13F2D900E8D05ED178C7568632EA62BC150B39AAEF0A90B7561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1f95a11c68566dadd8beef74461242830224a03b6776ecdd4f9b1a94fb74d35b
MD5 8dd736a92e8bcbf3d7435f8512cb2c5d
SHA1 b84f7cbbf032519625776fe3777b9ad011e3dcdc
SHA512 6a9d8c1274ed187e08fe362837015cf969927702a61762762648a3d525d7f5966d4efdcb0a37c2c489d51ea6a4f5251a2e1aa10c660e8fe26553151d8d0acd06
SSDEEP 12288:dOIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:druTeqGybWZJKSMCxVbT5o8P
TLSH
T1B74523DC78194C45EB0BC7B7D86198C5B6808EDDFCA9059F726574A32B398EE5CF4802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 25ae6e4a4c43514143cfe29df842733023fc128937c56354eb8c49853d7f0be3
MD5 6776ecf011b7b117f6989f7b233107fc
SHA1 07cb6d8925f314de0adb2f7dbcce1c75cad2c0f1
SHA512 25aff8dd103189a79eeeefd679408e73692dc69f74a008362cdeeaf720e87d147789f21f76952c07bddad68c5757c74f57109ad4dbfd3d4e538085dcb120d18c
SSDEEP 12288:mlIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:mCuTeqGybWZJKSMCxVbT5o8P
TLSH
T14D4523DC78194C45DB0FC7B7D86198C5B6408EDDBCA9059F726578A32B398EE9CB4C02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5fca1c118a3a04ffc4b6d64539fe8150badf2707576aa0dffe032321662af4b7
MD5 09672b92e1b9e9beb3947fb41bc50a9b
SHA1 7ee684918a61020a8282a4f280382a275e3ea94b
SHA512 b703ddff3c88e54c499aeda908f498146a691578c7f09cb74c4831bea538ed7713659a191ea8e311aaf4bc19594ebe73ae50762f8d1b5e123eebfd5bd2886009
SSDEEP 12288:vHIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:vMuTeqGybWZJKSMCxVbT5o8P
TLSH
T1724523DC78194C45DB0FC7B7D86198C5B6808EDDBCA9059F726674932B398EE9CF4802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6d30b3cc322d25c4d1ce6fc488cdc4edfd2f43f3ffa160f4e82f3a10c24d3a28
MD5 92fc269aa4d688359baacb9c48581ccd
SHA1 fc53203047c6507d0c597e6a0dc4786936f9476c
SHA512 1abacd208786cf9166025bdd9c1b2298285701237e84af4922b9de552f3474ae77cc95dacb508185e9e2cfd7b3589cb2d7d9dff13c369a909de77f2dd5ad4c1c
SSDEEP 12288:WVAIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:+uTeqGybWZJKSMCxVbT5o8P
TLSH
T1C34522983A294885DB0BC3B6C8719885F3A0BDDCBD7A069F626138971F355ED9CB4D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4e9064115e1ba248222dfce82f1c3df8583927017a5e757da04b6fe274e90014
MD5 18ff533b4ed28d556ce68e4aadbd38bf
SHA1 89f9d570278f7ac633662bcbaf8b786f93b2deea
SHA512 5218d0c758973499382d0ae77f30dca112a2ad0ca00a34a93be74306e2ecc34ac21bf9dc0d2fc18fe0aad901355d3a0d20a5f4bd5297b3ff6582c8289c625385
SSDEEP 12288:ZYIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:ZluTeqGybWZJKSMCxVbT5o8P
TLSH
T1E24523DC78194C45DB0FC7B7D86198C5B6808EDDBCA9059F726674A32B398EE9CF4802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b6100a30c80440924e5d9da51722c55d94143b1f447c2c36111d0540c1adb91c
MD5 5ad091494bb6aa1859274584272da973
SHA1 c33c9ec5136f34db463732beae77aa137ff5ed0a
SHA512 02e56e2ded12bcb9f76341dd1d05aa281e3ea6e24cfc107c1320f5cebd9ae64a5c839b72c9ed20144ed9107403c2eb3048ba9362df02629b2d307c922b4c507b
SSDEEP 12288:/pIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:/OuTeqGybWZJKSMCxVbT5o8P
TLSH
T15B4523DC78194C45DB0FC7B7D86198C5B6408EDDBCA9059F726578A32B398EE9CF4802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8556b24b1b3048258231c0f534254e974ed2f61e58066a9322f01318e7388a00
MD5 086ac7dcf53e53e9229eb8b0c387408b
SHA1 397c11224284f1723ef4f157da142e0f811f6fb5
SHA512 754d57f91744d73225c7fe1a5598a9f012c44f3e6ff7f4a07de2ec75f8be3418a1e66a57a213fa86942da0068c92ef22e13e41fea5b4d54361bedfd8f98134a4
SSDEEP 12288:IdIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:I6uTeqGybWZJKSMCxVbT5o8P
TLSH
T1B44523DC78194C45DB0FC7B7D86198C5B6808EDDBCA9059F7265B4A32B398EE9CB4C02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 fb95397b2aa229fc6d9779037b191a6ec0c9a2eadf63f381a71fdbd9986a855a
MD5 12495a167f019cd48963a2380eb71a6c
SHA1 e0b1d93ca4dcb6f2156dfd386d4af262650d8ae4
SHA512 78ba04f5042cb77a3ba4d84109c0a3fb5b8df5cdf21a74b5f6047cfa29c7d040640f1b1b6645c53110c51eb129a03a1a92969be8edb7dd2fda30aa7f2846c4d6
SSDEEP 24576:ZZMRzFVSOiuTeqGybWZJKSMCxVbT5o8P:ZZMRzfeuatQSLxDD
TLSH
T15D650198B3501CF8ED67823EC8658846E6B2BC995AB0C65F13B436671F332A11C3DF56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f697dba662d5054bf6e0d326fb0409db44f79ffe62c9ddd81478a992553ad281
MD5 27203c5579b49ce2ee33ada507fb6472
SHA1 9e6929c327d214e796042627199adf13a4760c08
SHA512 901beb8d82c3dcd0a4dd3e000beecabec0d4495848d2d7db40164d592964ca53b938ff71dbdb407e5712b3baaced36794a9021082c39069b216004281e22545b
SSDEEP 12288:i6IPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:ifuTeqGybWZJKSMCxVbT5o8P
TLSH
T16F4523DC78194C45EB0FC7B7D86198C5B6808EDDBCA9059F726674932B398EE9CF4802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 32f408f83af81fcc95fcac7698438eeefc779e0939bb282db6185c18a79864ff
MD5 0f28ea9c7ca0f384c7888c770a092aec
SHA1 c4bcf9717e2051a0ae8e201f6516665df5cdf7f9
SHA512 de2a14b273c85f7f5949e82df2154aecdd03443fb9a8557aadc2bf6f7f5b8f393ba20cde6270b04b3a54a3d81c1ea1e9f166f6b2955371359ac6cf5cd8c9ffdb
SSDEEP 12288:cWIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:czuTeqGybWZJKSMCxVbT5o8P
TLSH
T1994523DC78194C45DB0FC7B7D86198C5B6808EDDBCA9059F726678972B388EE5CE4C02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 814e15e9a63f981f8e4d2738105cdaf007ce19fdc49f58c0a2f3bb9d627f347c
MD5 4fa1303ba40a3810980974ae92abaeea
SHA1 bca54ade10651fcf40e9d07845f014840076529f
SHA512 808af178b07d12e4c0e08e4dec9d1b84d4da87cc6d67991f023a945ea39bed0c4fdfc3d7ff189c2f7d3bdf4711a62a7c4206dd97202d831ed79555e162a95ed3
SSDEEP 12288:iyPz5L8RIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:/zy2uTeqGybWZJKSMCxVbT5o8P
TLSH
T14655125B726520F8D22BC339C8621942F371BCB95B744AAF13A016772F375E59C7AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3b62a1b6048771680fb7635106ce11871471b63d0a52a11118ec8e79f57af0ca
MD5 66bfa0662c4bb2e9150be14ca20dc1fa
SHA1 8b6fd1d9209584a20855cf6d7365dafe7aaf083e
SHA512 4169448d59be2f18d15d36d9a164d0060340ee0a7a75a9a94c409a2a7af3684afcfdf29bf9fc46bc51beb41a1178a4e50c618b1e20deaa655d63b532d8737a83
SSDEEP 12288:g6IPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:gfuTeqGybWZJKSMCxVbT5o8P
TLSH
T1EE4523DC78194C45DB0FC7B7D86198C5B6808EDDBCA9059F726678972B388EE9CB4C02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 32beac24343916ff4849d046dcda739b52207271370b8ff1e27d91d63fa1df12
MD5 669c966a6fcd7054f293ebd56b3c74f1
SHA1 f3f554ed2d1edbc1575909e447d8f9449f6d6f9f
SHA512 78b45fc5d9d6ad42bb3e003b46d82e5e74be39bfe1cb39fea754d1a359968b27863d554a62e8c722a59a0ca5fed62a4aeb67685cd62223e6b75fc21062fda899
SSDEEP 12288:O6IPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:OfuTeqGybWZJKSMCxVbT5o8P
TLSH
T15D4523DC78194C45DB0FC7B7D86198C5B6808EDDBCA9059F726678932B398EE9CF4802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f370571885ada5a1b6946bdc7080641bca707a575d74d69747a6af45f854c02a
MD5 d05a4b79620b0cb110db5037d53bccf4
SHA1 3daa51da8aa11a75d70d559e8965f856fd541610
SHA512 4009585c7ac575cd253650139cc7efd8e81584e048fa2420bef40f140a35b3df6a1b6d6c9b46b23d3033e727b2f9c29ea9fac1147e9f5e561381757e4999a460
SSDEEP 12288:qyPz5L8RIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:3zy2uTeqGybWZJKSMCxVbT5o8P
TLSH
T1A655125B726520F8D22BC339C8621942F371BCB95B744AAF13A016772F375E59C7AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 f2153c1c355daa286a22f1e547bb66f039ee732f469bcd8de2ebd5956a2d842a
MD5 1b3a148fcc013bc6b27af4fb695d5da5
SHA1 ab9c1e767b6eef1a18a788767974013aafdf1402
SHA512 fd67400d21c50125bb6720d47b8d446ce13fb42a40f1f3423395f014f676902cb1d5901ccb4b5f44b8f5fdbc0f40c0e9c0ed09acf760c87c7535e10adc002065
SSDEEP 24576:wTDaLl3z0zD8uTeqGybWZJKSMCxVbT5o8P:wTuLljJuatQSLxDD
TLSH
T13F650198B3501CF8ED67823EC8658846E2B2BC9A1A70C65F13B436675F332A15C3DF56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 68f064c2770be321e477ceeaf6935a0da5395cfdc6892b0ea8ed1a2eedf208b1
MD5 f747d34169f3c860ed2868a9f24264cf
SHA1 b5bc7c5398a9d980969721db5721f3573f0214c0
SHA512 4aebd49be24bd6e853b29e7f9832868a8fc983466c486b05b381518b209aac035f94849cd09aa26ba3dbe3bc7d632007b53d4743c17f303f140e20941c7adeac
SSDEEP 24576:D3vd9CHKy7GZIuTeqGybWZJKSMCxVbT5o8P:jvd9CHKyaeuatQSLxDD
TLSH
T1D675CF90F3E414E8F1B7CA35C9768511DAB67C9A5B71CA8F03A4255A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 88e494c82e22ea8453fc5d6ca5cb8bdfd1fe92182070a11d19c168db1393d290
MD5 9b8f41e7f6bc135e386d482aad816f9e
SHA1 ac900524bbcfd4ac8af65f0e8de256a759fe626e
SHA512 1064d67e52d1e02f5ba7ae7a46c97a70f589d4681f7b9610b9baacbf732e2c2636e9dbfa87092a34dfa9b22c8e81c156374ff05cd9801c750770afb2b70c4e9c
SSDEEP 12288:3nIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:3suTeqGybWZJKSMCxVbT5o8P
TLSH
T1674523DC78194C45DB0FC7B7D86198C5B6808EDDBCA9059F726674A32B398EE9CF4802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 577645dd3043291a08c635434afc1033c7fd36d55aaf9e8841e066e9848ec1dd
MD5 d5828f3d83e5d4452e3e69137fabde22
SHA1 0c34ff165d0ae59f00849e08a800378459567c0d
SHA512 e4f3905715c744274ad1da70232b4dd7ba1aa0755bc393cd0987e6b03eb0dfd63d0152adcf17746a9a2258c63a31e9c965618351082244f877f6de081b31be54
SSDEEP 12288:VxIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:VWuTeqGybWZJKSMCxVbT5o8P
TLSH
T13F4523DC78194C45EB0FC7B7D86198C5B6808EDDFCA9059F726678931B398EE9CB4802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c053cbeb3bb7f07a6d19cf957736fcf7e937d88383aba0b93fd8c5b199cfba3e
MD5 bfb66ed19ae6af384b0c9ad7d7fdc2b2
SHA1 658a693be7b34271c0148dc7d4a929a7d6d880b9
SHA512 9046bcda4d3e5fc2845c69eb09c30e93797f9a7af823a98714a832e0fe08263ae438f72e08706a80053dc817bff32f79bd838a4fa2a82669923ff592e8c310e7
SSDEEP 12288:usIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:uBuTeqGybWZJKSMCxVbT5o8P
TLSH
T1094523DC78194C45DB0FC7B7D86198C5B6808EDDBCA9059F726678932B398EE9CF4802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9061f6d1c53bfc5707a4bd873a011abe89084ca1c025a70aba2b0cf2b22300b3
MD5 7a9f7cc48904ee792855c839b607021c
SHA1 6e51ace6774a336498f275c1a55931f2a802d7a1
SHA512 b90b75ad623ef1783a806d2a1690e867a1f20b16a280cfc4bd0fa08468cb045fa1274933191478407fd4047ba5696553392cf53a254dddd5433eb84e2351fce5
SSDEEP 12288:M6IPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:MfuTeqGybWZJKSMCxVbT5o8P
TLSH
T1994523DC78194C45DB0FC7B7D86198C5B6808EDDBCA9059F726678972B388EE9CF4802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 bfe69bc5c10612a11e3d71325923c948bce375a853fd2ecc9de03db51cb8bed0
MD5 a065523d415f11acfbfe1f770985ee74
SHA1 506caea064790cedf892851c70ace2b252f90dee
SHA512 148364a520aa1231c8ca7f310b5934e382d71c0c3909c8ae506cb973a4d0fbe4f23ab0a6b69469f482c5bfbee5ee8589a60b523e564dcb3170c42195de1dea66
SSDEEP 12288:vnIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:vsuTeqGybWZJKSMCxVbT5o8P
TLSH
T1F44523DC78194C45DB0FC7B7D86198C5B6808EDDBCA9059F726674A32B398EE9CF4802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ca1aad4262b810f6d22fb04c78dbf350226ecff96e58272775a7be3b9043f8d0
MD5 c2cb8a6a9158e1a6b31255d94e7f8d0a
SHA1 e8a2135814cad22c4c35eec522d42d6a56e9c684
SHA512 feb9f32d1ed939cf8532c73125ac3f33db0e3f08afa7f48fa25ccc11f91d3a3b8769b4b044bc0c12351fe01fa588e42cc27c57133b8300f91c6e97986e23b4e3
SSDEEP 12288:9SIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:93uTeqGybWZJKSMCxVbT5o8P
TLSH
T1404523DC78194C45DB0FC7B7D86198C5B6808EDDFCAA059F726674972B388EE9CA4C02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 9b566b90ccf80779da5df99d57e997d5876cedd18cd4572c8d01fb565c82b611
MD5 5d1bf0b1aa7959a2226204cedf5f9e4f
SHA1 cf4e41dd480aead1b92de2a2d2bb7403bcddbc4a
SHA512 5655c96845acdf6cfeccc2b10dc38abac4a896990f11dec9288509a5307019a88a61d2e76b16387ee38646e6902a5474934feb108c2995ca6f041da3c3a56d6e
SSDEEP 12288:LYIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:LluTeqGybWZJKSMCxVbT5o8P
TLSH
T16F4523DC78194C45DB0FC7B7D86198C5B6808EDDBCA9059F726674A32B398EE9CF4802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 fb9de631fd7f8806d6d939f9d1e8cc036d475975288e9f8b3f86c39218798b6c
MD5 978d0b52c8e64c30b3623975e35f4c04
SHA1 8c47406d20a1a2121ce7deeadca9de5845af6e9d
SHA512 ea953bcc97a2565fe9863a6eec10a6c1ebb95b95c6fcbea8cdcb910cc38c0c8a585e5dd2781d06533f27a2dae686bb31afecab9d84b2c99b8b061d30ef727deb
SSDEEP 12288:kvIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:kUuTeqGybWZJKSMCxVbT5o8P
TLSH
T1CF4523DC78194C45DB0FC7B7D86198C5B6808EDDFCAA059F726674932B398EE9CA4C02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 bdbf107815719041014c1fe75ee5053653848dbac8c28299522788ba4b40f8d6
MD5 597de820b163fa9e83f0361edc458ffa
SHA1 7d7e53f1b5eaf9c474214732fd707367846ff6fe
SHA512 8b33071f111f34a7e57027785d0d68f485d42114924bed53ff86ad7446a856e23fb3150db3a9b4b08f1d64c992c9c0a980388174d2efbb3d5fee1a5763730f0a
SSDEEP 24576:8fwvUk9RX6wkyAIDuTeqGybWZJKSMCxVbT5o8P:4MnYIDuatQSLxDD
TLSH
T13F85DF29EBDC48E5E177923C89B3460AF2B178691B31C6CF129A53AE0E37ED45D39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 81fd1c0ebadd98b111a08dd7d31ad222c454ad47aa3bc32f042958e315bca7e4
MD5 3bfef8225320e9ebc1f955375c7fe1b3
SHA1 c2a3f3b2fe36ab564bcc5950a56ed83d11bb162d
SHA512 046d10529fe27837e45b4d8d96dbbdf03b43a3d9456832b4eaeec0cc63b40a37a08a57ebc2f29558400933a03779847088aa80d0c7e247432c340f5c0823914c
SSDEEP 49152:uYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0AuatQSLxDD:dySzPI95L
TLSH
T185066C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a9c8a98bb0a5c5425bbd85fd7431093ba68da775468d720bd05ef588ea273bb9
MD5 40cdeee0817e95f49f0f8d92b445c15c
SHA1 12efdfe75e26811fd7fc49844685b669b3a46427
SHA512 fa433feb022a7e903a36aac84c8a0211e5e76a01d0aa3fa233a80f0c1d57863e080921d26f3200bd57dc72b994d70f3d52137faddaef250030c3421e978f7061
SSDEEP 24576:h47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYyuTeqGybWZJKSMCxVbT5o8P:h47JUQjTirIhCnDHUPfF/QuatQSLxDD
TLSH
T1BC65AE1DA3EC01E5E1BAD27885158A5AEA71782D1F31CACF2270837D6F23ED45E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 124adf15aef65645f17a8d9ae0a80eee7cc7699d7a77bef624eb28e972f0b1d7
MD5 6450ed21f27b0d46bf347d078fc878c1
SHA1 703678ab27ff74e5f358c5260dea4a6ffddbb88d
SHA512 d13fdaa404438545efdc7b96a1e4efa0e183b3cc39dcdd4753bd5093af4b08fd4d6cd7e7405b9d68c42219f110c9adf3135dddca7d2a671441b156cd2533785f
SSDEEP 12288:obsfqIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:PPuTeqGybWZJKSMCxVbT5o8P
TLSH
T12655F159E25802D8C25F9276CB518941F3237CA99BF183CB62D0F47E1F3A5D99CE9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 988KB
SHA256 fa6cef780cc68705c351d845886e1f2771ec9ed819c1cb44b1ffa40d77c14a13
MD5 b19d4d2cfac018e1b6ada210efcd43b2
SHA1 7bc73f7d86ae3ae7e572e438988ab682a4b2d429
SHA512 601ecfdb1f3f956e5aed1e657ed27abfbd647bfbb3a82f5ef0d536d9976f004d0d4520611b32c80c40c4b30b2c679f933cab84d06ef7ff091ac75fcbe57a4e28
SSDEEP 12288:l2GMU3fPnM0O+yKXDwzX23TwDaRP0NFJHWII:l2LUPPn++yKMzXesDaRP07JH5
TLSH
T1692517117666CB4FC6A984321E33D5CCAB707D11EE446E0373C9873FD576A58BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 4a2594b32970c24ad3859bb402950d8ef851a04380a606ff239a7c87cf0d8523
MD5 54ae3efe33e36a3be219446ea3620d6d
SHA1 4a96678704aeb9533df7112f10ad3c8fc1a65bec
SHA512 32a71f62ba96d92eebb0bc68cfcf0d50c7e6ebd5edbfe4bb49d716247a2ff4f89b5c8ad641a0a931bd5b6a85a17022c331cc85a68cfb53bfa60b72249f9af7ab
SSDEEP 12288:SKB9+3pE9fsSVKNKZKVgDDBDdXL7A6B/GuqI:SKB9+3pE9fsSVKNKZK6DFdXXAmv
TLSH
T1E865F9416137E78FD1BA5032032A5B8C77A4EC06B7496F22B3C9453AD86BB55B0F87C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d819967ff441c421a95ade71a02fb2fdbb04f5def16e089f07b28ec3ed7e0d5a
MD5 145b934232193e61f6da5dd35174630f
SHA1 bc6273d855b6656ac86e1a1f1a151e729b68348e
SHA512 e1928513bdf76972f74d6d2ec4308c6735c5d62683c6e644f952d2609eb5402bdb512ade09e52b925b48fb5b18609a1a67854486e51022634247ec223b6b66f6
SSDEEP 12288:g07CIPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:NnuTeqGybWZJKSMCxVbT5o8P
TLSH
T1FF4523A8661D8C05EB2FC7B69865D8657240CEECBFA805DBB15174D72B388DE8CF4902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 db274d9c1933ff36718f04e297b56a7ba09e86ac0825e8343ca2d5c1ae6cb434
MD5 e241ec5aaa8446d40d99af4baecaf949
SHA1 d0c6f602dde0afdec9df8357f6c50d9fac4e8551
SHA512 1aec690ca4109124cab40c5340d4e8c6019b132b46e05970c2e496dc77c459ac086eeaf375cdb8b6a78f1749f4265bcc72c7d6072829177c13a33416fb72826d
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYJuTeqGybWZJKSMCxVbT5o8P:Wgb4mBIBhGFyuatQSLxDD
TLSH
T19465AE1E22EC02F5E1FAD2B8CDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c4e7a1782e4aff2bebf4c117e8bb10acbd3a1c4f6119b31d67a8d6dea88ada50
MD5 6c8e0f3754e3db76d217790d21810f49
SHA1 99eb05644acf95888044412904dfa9caed94980b
SHA512 969b10c09ca22d2fc211af8e6aa233ffe07e4ecfa1800a0b842d5257cb92281e0f4ec9deeaa680a6d2b58346401482a29beeef4696e7c2aa821bda7ec5995e79
SSDEEP 24576:gG88u8FpJqH1bzria7/miuTeqGybWZJKSMCxVbT5o8P:z7ZFPqVea7/huatQSLxDD
TLSH
T17D85F16576E101F0D47BD238C9824663F6B1B8251364EFDF07A88A521F23AE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b322226327313b3f2c64eef4969224ea0ba4f65469afa50636449420895dd750
MD5 81f2b983aca9ea525ad5cd51a4d7c91e
SHA1 ed6486f50d9f9cc02b2124bade8991aa9ce10307
SHA512 36de198c6dba7be27b961594ffbf4491e8f0a46583d7bc6a164f1f508e4c1f1b950966b69ab04868aa9bac8c57f971b052a293e47352899417eb6f735aae03f0
SSDEEP 12288:7HvUrBFrEjwaQ5IPuTRYvg8oGUxrbWOSLxbrEx3xMZSCxVS3IVtd9yKWB8Pz4:7PUr+NQeuTeqGybWZJKSMCxVbT5o8P
TLSH
T19D65E16E22AC1CE5E77AE17D85428609F771B8A6171192CF02E0917E5F37DECAC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 819ed97f183e9e45a5226760846653820df5880c06ad633382bfdb3484d700c2
MD5 c7834e264e2b49b06f4f4f5fed0499e7
SHA1 b770f18a82b0fb2a25af972931c748f324b29456
SHA512 87780eca223f49cff2f0593e393e57ef2851f4efd4a5c98dcc6eeba99f43bc9a90ee2e25a1214c1327fc83d36bf2078471f3969a621ea46b222b7ea7eb0beb15
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjOuatQSLxDD:iG05lO43b795L
TLSH
T1F9D5BF6E62EC11F9D1BBC17CD9864A0BEBB23815033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c9ebc41b50093ed32d17ccc4b021cd5cf4319dd8bbf0121483e15698fbd9ae64
MD5 c2224d7dd8c28e49a68ccf93ec2726ab
SHA1 1c1c52c9741cc8e5a596e6bef9e234269ba17320
SHA512 6c42cd5f385bcffe2ef132d2aeefdafc46bcc2a51fb223e107ce9fb273c16dfa291d77d54c363ffbd6a3de3a84eefebbed685793e153ee5a0c375afdda3e3c4e
SSDEEP 24576:Sfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnAuTeqGybWZJKSMCxVbT5o8P:6a5POZ3BJt2pasx2+mWuatQSLxDD
TLSH
T1E365BF5DA6FC00D5D679D17DC5838A0AF5B1386553329ACF022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2309a1b5dc78b92902882b9523a583174c83d9cf3a561bb373ad052f42c8ecc4
MD5 1ca2fa810fca37949f164e57dfe6a645
SHA1 d2ec713a5ebd4006e21f4b341c800e80a432282a
SHA512 928421c7b0ae21f08fbefa13591383f4948f7161108ac7169c17c514082b3a751d8dcee49dc5358b25b9d68bfe2bb5b68cd87c4e128ab86fd83c8020a07421ce
SSDEEP 24576:fNcwHdjbyQ4nLC18lb/EOjowL7FkquTeqGybWZJKSMCxVbT5o8P:fNc/zEOVHFBuatQSLxDD
TLSH
T1B7858C1623E901E4F5BBE1BE89779546FA71786917308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2783eb62ca5e9ebdf724c606c8ea93b5afc298364653d354636a99ae03ad02fe
MD5 b67179115408402e6f448dd1d00e1e3d
SHA1 9badf41fef23434b531a7c742afb0b93476e7a62
SHA512 45947ae694690717032445fc5c08bdd9136ce4971ff3c7a553902857599857d3bc1dc165de304f0d2d5035a497247f220adc03f0eecada072e52042fecd24952
SSDEEP 24576:gTkNvNnaFeYhJNtmZBmUuTeqGybWZJKSMCxVbT5o8P:gTMwBtOmUuatQSLxDD
TLSH
T14855AE6EBAB806E4D1FEC6B5CD238512FA727861173252CB5290C13F0E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e3b9c167e43af970d81830af1687d51e73b80ed6fece6eb7382f411ca630afff
MD5 121df7ae73b1297ef6f6aa5ad0bed92b
SHA1 3aef4160bd3f0d91af72fb9106daef8675135a86
SHA512 52578b760e9f78ca29bb89b8026c800f94da248bc8130c5c715a08eedf892f6c9ececc861331f85beb49069f0cd0b317d99dd8976d6e886c3b8a23767d10480c
SSDEEP 24576:uD3FHshBIYQgALuTeqGybWZJKSMCxVbT5o8P:uDVHeBIAALuatQSLxDD
TLSH
T10875E17DE65C04E4E57BC2BCCA638906E77138AD072256CB12D491BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/548-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/548-128-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/548-125-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/548-119-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/556-304-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/556-94-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/556-306-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/556-298-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/556-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/556-100-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/556-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/568-189-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/568-60-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/568-54-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/568-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1332-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1332-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1332-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1332-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2000-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2000-272-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2108-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2108-22-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2108-14-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2108-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2892-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2892-49-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/2892-38-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/2892-44-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/2892-45-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/2892-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4344-391-0x000001383CAB0000-0x000001383CBAC000-memory.dmp

Download

memory/4344-368-0x000001383CAB0000-0x000001383CBAC000-memory.dmp

Download

memory/4376-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4376-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4376-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4376-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4616-105-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4616-113-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4616-303-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4616-107-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4992-0-0x0000000000400000-0x0000000000633000-memory.dmp

Download

memory/4992-7-0x00000000022B0000-0x0000000002317000-memory.dmp

Download

memory/4992-6-0x00000000022B0000-0x0000000002317000-memory.dmp

Download

memory/4992-76-0x0000000000400000-0x0000000000633000-memory.dmp

Download

memory/4992-312-0x0000000000400000-0x0000000000633000-memory.dmp

Download

memory/4992-1-0x00000000022B0000-0x0000000002317000-memory.dmp

Download

memory/5688-72-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5688-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5688-66-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5688-238-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5724-81-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5724-367-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5724-287-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5724-366-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5724-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5724-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download