Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-10_f4cd2d08f05c7ac82a5c68be6b6e93dd_elex_remcos_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-11-10_f4cd2d08f05c7ac82a5c68be6b6e93dd_elex_remcos_stop.exe
- Size 3.2MB
- Sample261110-e9kyaach44
- SHA256 1c5c10c9031c4d083d0ab85c80f20ab93397e6d97c923eb6c9c7166bdd3a47ff
- MD5 f4cd2d08f05c7ac82a5c68be6b6e93dd
- SHA1 62e1fc92619a67e3b064f5dbe8f1d0e8a84f4996
- SHA512 866bb3155e4198ecda2907755349f3d32f21e088b3f03a9a551b8574f5f1771313472b8c3b49bd81139f271daa9b8e5a158ec14bc6d6ac9c651264c6b36749b5
- SSDEEP 49152:x11MwltwThAt7Uv+MnIICTgxJqWgVBKkGQoAWhI/36YLaWijEwdNh:/1VZGGMnIieKDQ4I/KYLaZEY
- TLSH T10CF5F1A1B7D5E0B4E8820134C19BE0F6A9D7AC82E332295731627FC63B7874667147F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 6136 elevation_service.exe 2572 maintenanceservice.exe 5676 elevation_service.exe 3576 OSE.EXE 3500 PerceptionSimulationService.exe 2452 perfhost.exe 2676 ReFsDedupSvc.exe 4844 SensorDataService.exe 3992 ssh-agent.exe 5904 AgentService.exe 1268 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\49b7fc643a35217a.bin elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-11-10_f4cd2d08f05c7ac82a5c68be6b6e93dd_elex_remcos_stop.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-11-10_f4cd2d08f05c7ac82a5c68be6b6e93dd_elex_remcos_stop.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-11-10_f4cd2d08f05c7ac82a5c68be6b6e93dd_elex_remcos_stop.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-11-10_f4cd2d08f05c7ac82a5c68be6b6e93dd_elex_remcos_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-11-10_f4cd2d08f05c7ac82a5c68be6b6e93dd_elex_remcos_stop.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 3428 3396 WerFault.exe 89 - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-10_f4cd2d08f05c7ac82a5c68be6b6e93dd_elex_remcos_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004f34d5fcd70dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079bd1d5dcd70dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009540ff9fcd70dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7ddd25ccd70dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c052d75dcd70dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e52ef9fcd70dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 6136 elevation_service.exe 6136 elevation_service.exe 6136 elevation_service.exe 6136 elevation_service.exe 6136 elevation_service.exe 6136 elevation_service.exe 6136 elevation_service.exe 5676 elevation_service.exe 5676 elevation_service.exe 5676 elevation_service.exe 5676 elevation_service.exe 5676 elevation_service.exe 5676 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3396 2026-11-10_f4cd2d08f05c7ac82a5c68be6b6e93dd_elex_remcos_stop.exe Token: SeTakeOwnershipPrivilege 6136 elevation_service.exe Token: SeAssignPrimaryTokenPrivilege 5904 AgentService.exe Token: SeBackupPrivilege 2676 ReFsDedupSvc.exe Token: SeRestorePrivilege 2676 ReFsDedupSvc.exe Token: SeBackupPrivilege 2676 ReFsDedupSvc.exe Token: SeRestorePrivilege 2676 ReFsDedupSvc.exe Token: SeBackupPrivilege 2676 ReFsDedupSvc.exe Token: SeRestorePrivilege 2676 ReFsDedupSvc.exe Token: SeBackupPrivilege 2676 ReFsDedupSvc.exe Token: SeRestorePrivilege 2676 ReFsDedupSvc.exe Token: SeBackupPrivilege 2676 ReFsDedupSvc.exe Token: SeRestorePrivilege 2676 ReFsDedupSvc.exe Token: 33 1268 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1268 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1268 SearchIndexer.exe Token: SeDebugPrivilege 6136 elevation_service.exe Token: SeDebugPrivilege 5676 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1268 wrote to memory of 1344 1268 SearchIndexer.exe 105 PID 1268 wrote to memory of 2124 1268 SearchIndexer.exe 106 PID 1268 wrote to memory of 4264 1268 SearchIndexer.exe 107 PID 1268 wrote to memory of 4384 1268 SearchIndexer.exe 108 PID 1268 wrote to memory of 3720 1268 SearchIndexer.exe 110 PID 1268 wrote to memory of 2988 1268 SearchIndexer.exe 111 PID 1268 wrote to memory of 3676 1268 SearchIndexer.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-10_f4cd2d08f05c7ac82a5c68be6b6e93dd_elex_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-10_f4cd2d08f05c7ac82a5c68be6b6e93dd_elex_remcos_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 7282⤵
- Program crash
PID:3428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3396 -ip 33961⤵PID:4020
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6136
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2572
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3116
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3576
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3500
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2452
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4844
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3992
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5904
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1344
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2124
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4264
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3024 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4384
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3720
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3024 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2988
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:3676
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 610c25d4f69175ae66d98eb3664ccdf41acd9d3263c0e0337b67934264d41c31
- MD5 5ac2b46bc0e5573e3c7cd7c2c0517617
- SHA1 903175d0c6a996cd8ab0aa8ad7aebf9076e18074
- SHA512 293a2cc716538d9201cffa1ba3297f36769dad449287b62c89807a8f8bafda842ab906f4fc01c06a82490e141d70e53cc5b5ba5639a46470087032bed76c15dd
- SSDEEP 49152:+b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnkoAWhI/36YLaWijEwdNh:A3q6HjB54I/KYLaZEY
- TLSH T161D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.7MB
- SHA256 149eb5e2a169891be93a17700e8b8a6c741542820349430d9d0161254f58a74a
- MD5 ca00316cf85bec0f51927922295ee3cb
- SHA1 e18b4283de2bb2821664ddbdfde60f6aa60b45e9
- SHA512 be78911492e8f6d907af501efa9de6917836d6177fe369f18519748e6c9667642884b217e2edba1955dd1768228961970cff5c8889309d38ab5ac840a5ade8b0
- SSDEEP 24576:lXYfDtczAb9GATihI/3b2Ym2aH2ijEws6XNhWE:wtc4oAWhI/36YLaWijEwdNh
- TLSH T16085F129B3D009FAED678238C9A2C511EA337C9543A0F6CB03A499665F337D45E3DB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 3b68dae161cce8a0a6d8f75790818e934a5687caf5920bc63af6529379abe284
- MD5 e374c5d69156870670a30cad0e90ae0c
- SHA1 4ebf5ca2a231fe114fb1bfa87345e8da549b0c81
- SHA512 9afa289a3780a21c15129b48b96fd8c65752d4da7d286f0017a62790effe7503ed1eea14fcd8a5ff0d194e50e8b4548d3a244e70a5d6ef001dbe302de2d39def
- SSDEEP 24576:50Le5ji0hmxYrM29GATihI/3b2Ym2aH2ijEws6XNhWE:5Pji0A25oAWhI/36YLaWijEwdNh
- TLSH T17395AE16F5748335D073C0B9C5D2A68AED72308657308ACB4286D77C7E67BE68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 d63024dda5033d4c6a37609a913caccaeefbabdc356d58b8a4d36f30dd7c8760
- MD5 f2db65796d47540847d94585fbda433e
- SHA1 5b1254466905f90e937894a784235239128401bf
- SHA512 0b8d5fed9bf4cf0997df7d0853b5b0a9fe2a16e9e74b4d4d426e90bfe68294a0af185607399a58909faf0a75b7a4172b3443005ac45067fe788f4fe97ed298f0
- SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWE6q8wyuo9GATihI/3b2Ym2aH2ijEws6XNhWE:h/ezSC6vUzPvxHjydoAWhI/36YLaWijd
- TLSH T1CC755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 3294b0e9993aba3a19da0562e6480b9bfe1dc8c0f2e87ba603aae1097ddc6015
- MD5 42ad82debd8fa300a1e678557fe13fd2
- SHA1 98ad9a695637042039f06a5ea00c4e760dcccbea
- SHA512 e8912e3cf9a340ef1a8b234882ea5271a0a552e8c1baf3f5e205c6816876b4be1f9459686cd775642e8d0c2f3d87cb809a9d4d32588aeafebf64c46cb88e4076
- SSDEEP 24576:HVbqPb88hv/l+6H9GATihI/3b2Ym2aH2ijEws6XNhWE:HVO88hXl+qoAWhI/36YLaWijEwdNh
- TLSH T19C559E66F5748331D073C0B9C5D3AA9AEE3234414B318ACB1246D76C2E67BD6D63A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 cb5403b467931aeb1de869abd5645e363dcb044f997d5b4694a6dd05da29b5f7
- MD5 8542583beea26010fd30c0a0921a83f6
- SHA1 82edc3fd44184843de8cf5495d4996b80cec0f47
- SHA512 b71df657f90381a6709e3e23e89cfd373746fba12a6ca39bff4e9a0bf0341a6dfb28aa840347058fe83e3a75b069e5f89f630a7e7842ee7e9f6afee2efeafd53
- SSDEEP 12288:THS9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:THS9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T16D652347F04421ABF68B0330FAFBD126DD610EAC82E47C9C4610B69A9A75B51DE4C777
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.7MB
- SHA256 f2190ebc011d91bab8e792abde90cd7a5af354b1ac33b6b476c451978898c34f
- MD5 015d681daee1f200fbf686fcf7a09e2f
- SHA1 d63527fbe94729be9a770f7cb7f9bdbca4af2ff5
- SHA512 0f5a6ffc4e91972ec1a9b86795dd931d24af4c6fbb8cfc13f2c30ae0afb0381f22bae15446eb17230c52e75684889a6d2e21c22f631763a1b14bae55849a75cb
- SSDEEP 24576:yJIU/9GATihI/3b2Ym2aH2ijEws6XNhWE:yJIU/oAWhI/36YLaWijEwdNh
- TLSH T10585CF2BEE28FCD2C27E49785A91C600D77278704B62A3CBD164C24EDE235E15E79D26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 723bde1a786b5fa9e4189119835cb90ddb355e88143995c6cacdfae0dc5fe4d2
- MD5 a8f4c2f403c084e63ded2ed65e636d34
- SHA1 e62ff6fd04855c9f88c2fbe0eded81d94aa78788
- SHA512 6eacf4a9b3dc62c0cd3ac101a6af39816448cf08454522ed18bfd683c26586b3f6b7aa77db5c6112164ab917a95f85def00b53e5da9d2c24913f815ead9a75ab
- SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH4:SQvGAdlCEL8c/yRNw5CY4I/KYLaZEY
- TLSH T1B0266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291C66F2F336904D29726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 a65f2ab9dec39918da0ebbdb90a3b11b15477fe51ee96c0f59267101af386114
- MD5 ed79f3804f59cc3b278e9631a959510d
- SHA1 fb68d6959976b0972c7ab0238191d98884ed84de
- SHA512 f89c519907b60a6b9b838ea88eadfd4eca31e27dfc3adb8b5f30a3ad2c4272b752c8ad227f96c94cc134d304b9ebbe7bd75b27052224d866793e6b42d697cbd1
- SSDEEP 24576:n7ewsAjp9GATihI/3b2Ym2aH2ijEws6XNhWE:7ljpoAWhI/36YLaWijEwdNh
- TLSH T12485E031FA74E036C37F0DB11B76C716583D69604BA129C3E3A88E9E59702D22776B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 95e946de6d977b5abb46366e30ca90d9be2776fedf5ac3c713a88b3e36ab0e21
- MD5 938ad3b9571abd8dca57b312b235968c
- SHA1 7cca1fb2ce2f23bbe36494de6fd05812cc650a08
- SHA512 99363eca8d53477f272e5c9593da946f380b6dd346bdd19b5db2cf8beb6f375b39a47496650646fb9f469153f4fca2b527017b7921edecf9c23bcb805f02d928
- SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHOIS9K:VUEtQevvqc2W1cpV2EI32OI
- TLSH T10E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 65b435f1642ce3a9472b0dcc192512c254e1acd4f9be553941ec82478abe8e66
- MD5 99a88d81e8b4c79722a7d9c382352a62
- SHA1 588276a9056cb9888e493eafe7bd7f15ce92f405
- SHA512 48fe208ef5ee0bf2a54854f6d1e83351f188113987671eb4c1c5b26472774b7b5961646bfa78acd491f55034f30d9c2a96da41afa9ac6d54f1274568ed1fbc02
- SSDEEP 49152:KCbRquA/m2yL5zifFiV+XenmE3/zJoAWhI/36YLaWijEwdNh:/oqHVjnmc4I/KYLaZEY
- TLSH T193D58D0976B8C2E4D1F6C37886A2C647F37178154B35ABEF4265461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 aaeb35692a387b4c02c96d6f1dcf23843ac630e6c1a805131d0106c07d014326
- MD5 1cae81874ad97d28a7a200150c7de979
- SHA1 c5c3be82f5f6463d1045824fdde84104fde5de8a
- SHA512 56765bd1de32e5bd067f3bb7aea4afc73a73ebb1f4a864b1db79df71625510ee006de8ab35f561cbbfd157ba33a59e358f7dcf8d6a4dabe944d345f47280ee4f
- SSDEEP 24576:iAhGLJIFoiwtA5l7S5389GATihI/3b2Ym2aH2ijEws6XNhWE:iAMyFoiq5MoAWhI/36YLaWijEwdNh
- TLSH T1EF359D81E7F955D4F5B3AA7899B68171EA72BCA95E31D20F2160D11F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 3f666b31ad46199acc35cf2fd12b4ad07b7929cb905745fd4700a8f58f7b90d2
- MD5 40e30035e81385f8dad775c059592a09
- SHA1 6992ccbf323c63b1d9d29970d1f409329855d5b3
- SHA512 fda8ceb31037a88a40ee860355a3a1caddc5f28889e01483ee999ec3336ea8c220acc0d51aa68b01d475a5c62ba24d1d7d204ab9df5ede9e9c484523831a6a1b
- SSDEEP 24576:2wuSOW99GATihI/3b2Ym2aH2ijEws6XNhWE:2w9OAoAWhI/36YLaWijEwdNh
- TLSH T17785F14A72A41CFAE9674238C597C136FBB2BC152621DB1F0760C65B6F37321AD2DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 4fd72128d8668a80a5ca9eb8f0c79670627ec311fb102420925c91fb79b85c77
- MD5 ce55e2c1ba223df05e92e5e768f87f4f
- SHA1 0c11700eaf4ca55efa562f637bb4092208cd5cfb
- SHA512 345e3304e7889315b926134854a5638195cb1d1acb913d36a6b0f6bf769564157706e50cf7b6e909eee2ba75eeefb9673de095177866b4de4e9539c1f407d20d
- SSDEEP 24576:iZuO9GATihI/3b2Ym2aH2ijEws6XNhWE:+oAWhI/36YLaWijEwdNh
- TLSH T19F75124A329431FAE1974334D9F69605DB727CA9537563CF022482AA6F73AC25E38733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 106c091108b8cd7447bd343ff1b6e1d3685f1bf304eb026f5b57af4bdfc0d058
- MD5 98d0593f535f853c4b1682f9db885f4d
- SHA1 c44514ca14359913c5f9a1dfc2fd10fb0386b3ff
- SHA512 53c0da5f62e198195f305f08506359d54fccee5b7d99f47632ada773419988500f3b68660dbe03e4ff38db492bf2a91dd966a7c19a91c08cc2af22511eab26bb
- SSDEEP 98304:SQRQyi36YOcPQLvw2gAf+PN3T4I/KYLaZEY:JQyiKayX+PN0IS9K
- TLSH T10C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 2ffd86fba2eaf9d0f7fc6a79450ac4cdb7a3f2107d449f93419e8be0db4ebbc0
- MD5 e9853a71f27402bf86bad5335614bc5b
- SHA1 b1d900d0b36dc160474c927784c599f613a94836
- SHA512 c31332f1e05a636fb9fe62dd901a6541f70f7b6e19dc203c51c3ced3466113c5fbb5075703a22b84958fc786c35d3d50c176f8ff138b8c0143f0d10921004e0d
- SSDEEP 98304:HQRQyi36YOcPQLvw2gAf+PN3T4I/KYLaZEY:WQyiKayX+PN0IS9K
- TLSH T11B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 05de989b804db5b812bf53de120da7dbd648e4a18f649ac96054c39664b62628
- MD5 76e8cd53c7f303dbfecbfd769968513d
- SHA1 57f78bbd8256c495fc4fbc09efd10b6a69c17059
- SHA512 58e2546c4056ee7eef675b3cf1ad8e222cddd82a38eba16a25acb67eafe888ac913544bed6fbfd975f8241e4d93260d2babc63977e95fd5b3aa936cbdcccdeb8
- SSDEEP 49152:c68Qg55nhheWu7PNU3/5oAWhI/36YLaWijEwdNh:WthWRc/54I/KYLaZEY
- TLSH T145B54933B2F200A9D44DE1769F4A872196D27C758FE0E3DB851172161BB2AD07B3A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 7bba80ecb0deb6d3998e9c69d99e6456f5649575e573667770c435009317d1f6
- MD5 0ed0a9160bf17dc587d4687d8b414d66
- SHA1 e8585feabf9b4e1adc0ace9385de78f54966f50e
- SHA512 46e4379a27066515a73606b355ab1fca5e21c51a89bbc8076317a5878a6f0ccfab7cc2850341ab4bb0b7fd4eb350d7ab7242ce499495170435709fa37d9376cb
- SSDEEP 98304:+y5112gYy5azzVvL69nLKnhZS4I/KYLaZEY:vLIHmWhTIS9K
- TLSH T1B5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 2ddef292786fdbd79fcfb1f94ba9738b2306f0019902d07b1e7e32b9b28765d9
- MD5 ddf3cc290172c10848c811c1253a21d7
- SHA1 b96addf149877ecdb908e46aa46b6909922bd8df
- SHA512 b7bb7fa149689b7649990a7d48c523ab716984cd9f4c00a3da3386e41601bf9fddb541efa5e76234a2fd8c15dfc3c4e6ba821f749ecb90e98f317bd06daa3218
- SSDEEP 49152:LB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glNoAWhI/36YLaWijEwdNh:du6JmVxd2dN4I/KYLaZEY
- TLSH T1A6D59D13F1DA01E8D05ED178974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 74e754ddf6f912f390c76add9b34e714e4bc02498a2557ea6767d37dda900f19
- MD5 522eb037becd488bf85891c621682d67
- SHA1 e8afb0ea384ee0db279e28c6736b3aff6918173f
- SHA512 1aa4698ad8b2a0ae0af35d3c21a9252562d2c78686b1e6c22e146af21315660b7bd9d8da23bb4eb4a688d4da6d8e50f730351c14b6c1a67b9ecee2cbab3c1aaa
- SSDEEP 49152:l1hpsNoJpF1A6UU44CwH7R4xfoAWhI/36YLaWijEwdNh:lmifPbRc4I/KYLaZEY
- TLSH T155B5BE13F2D801E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 4e302d1a94ee5ec3efc25ddf385134455d2cd805b3c4a8a6db639730f7435de3
- MD5 850c32618d28f20f54c31f7fd5f38d9c
- SHA1 da26e81e6363b88fd1d51f9bc7d94b9d559c2832
- SHA512 e4621fd99fcca4798513be2c8fa1201b1148a4154bd660679427f5c3869d3549c262d7f7682b3fe5b7e3ff460a3c0c5c4d81c13c48ad84734acfc57dd2dcbe5a
- SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHqOoAWhI/36YLaWijEwdNh:x5dKTi61O4I/KYLaZEY
- TLSH T15AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 70473876c9ef0be00aa8020c567da511e4613cf127170e26fa40f2286b0b9d11
- MD5 97fefff5adb7bb2f75535eff94c2a9c2
- SHA1 cb06df472b3ca3ac40591e0367edc9f925b4d563
- SHA512 4bae062eed3b9cf499d839630e4e9d4412e2b96c0e9a05b83bb70113580f74f940839762ec7d7be562350f77119d6953b1b5850dabe3552086b9717aedc589e9
- SSDEEP 49152:vhtSn8EApI0figngiDn0AP5wboAWhI/36YLaWijEwdNh:+X2iyphg4I/KYLaZEY
- TLSH T14495BE13F2D900E8D05ED174C7568632EA62BC150B39BAEF0A90B6561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 d5f00b8882759665a615e7619bc0080ef2177c003fea44b09e818d898e540774
- MD5 12a40e9c180e7606a6e605183f6c9ba1
- SHA1 c4168a6ec75dcf09bbce9e94cdb6bc3881a016b7
- SHA512 66c48bfb879f39c5f201410704c86072702e2b8d52f33da0692e5c9118aecc33a3cfe4c4391b9b08f2d8841a62cdfeb99b70a9c81c8ff4bd51cd917512bba99d
- SSDEEP 12288:Wq9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:Wq9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T13B65234AF484269FF14B4330E6FB9226DC510EACC3E538DC5708A156ABB6B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 3bbdd093c310d822e977d4a38b740e3ef7c181d511eb2c6b92b2e3d93ba94eff
- MD5 e6c16f563d5a9c3eee3081024978a7b7
- SHA1 9b42d9c9a43c8b00fbdec9f15d28a587f6cc2e0f
- SHA512 518f49659683f67679095c69827bf297867e1d6ffdd8675d2ab03ac8eefe9398fb25b2430b2be082ef87222d1772d5ef2bdfc71862bc7a5e81901aea729289e9
- SSDEEP 12288:ZF9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:ZF9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T11265234AF484269BF14B4330E6FBD225CD110EACC3E578DC5708A156ABB6B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 c8f9847d5e1a40b1e6f80786d6d799daf7063cb811b1f5e1d7ed76090496b12d
- MD5 9aeab953bb797efba8716609c7e61fb7
- SHA1 5c85ee1e367b9ed60c59ad37ea8790fea71221ce
- SHA512 a6c60cef17b1b8a9da6af80205e674e81c1c3c5fa0b4e69856a342568adfb5e5d8b4385fe6ea4b5900b7c7480821090d6e2b102f550156c7b9c7132a1d560f94
- SSDEEP 12288:AX9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:AX9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T1A065230AF484269FF14B4330E6FB9266CC510EACC3E538DC5708A156ABB6B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 4e224297cc250fb769b5d1d4fb2cad3d75e85af536d93964fcebc933143b6f8f
- MD5 7afc64f864c165dd176bf6143174c8b1
- SHA1 43c6582798dbf119805525385a80a1bd9f488c2e
- SHA512 d6537600c852750854d7b7d7c4c0600d2c504bbda4cc26674877f7ca8b57ef88bf8da1b781b2e19a9030a95f964f5328adaaca1770ee5f365607dc996bc212e3
- SSDEEP 12288:2Vc9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:R9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T124652206B19412DBF4478330DAF78126DAB17DACC3B27ADF4700455A5EB2B809E2CB67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 311a5653fce7487f0957dc662d23ec8fd77c69e46de1cc07d9aff09fa83ad09c
- MD5 d71dd13fbc3586e26378fd56a1947cfc
- SHA1 bae4d4383d6b2e17b854c3614f44ee8285a03356
- SHA512 055095a7fae469e3c0fc15ae898886f9932f5fd2c4880ae3109d5bccf7386011ab5888dfe98037f5c2cea58b3538d06cc12c9d5069805731f22cb84f7e9b9aa8
- SSDEEP 12288:oE9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:oE9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T14765230AF484229FF14B4330E6FB9266DC510EACC3E578DC5708A156ABB6B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 175c38c02337da9112e16dc8790758ab037cedd1775de697b57df0a8de8a0d10
- MD5 273341bdd061f9219f263ed368f7d5c0
- SHA1 c9b7d9852a0a381d9c4894d3c1d934069f2abb78
- SHA512 d3022350d7b272bddc0b0008c4dab379fb5b30eb63de1ab22b3deb622c0624f165203afb106a6c445822bfe6852c68860c94e69c3c2c57dd8cadfd97519ac311
- SSDEEP 12288:8h9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:8h9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T1E265230AF48426ABF14B4330EAFBD226DC110EACC3E578DC57049156ABB6B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 120c4263b176961a23ea3b20a7ab36f12c10a8add97d047a1d9d83e3bde2f65f
- MD5 cc91c7470cec583f5d4f81c7cb0af823
- SHA1 bde9d1eea8d3c74c3ccaa21295edbeceb7d3d79d
- SHA512 cf7f27d0df96005a4e0427b9b4af27efbe448dcd0afb3cbaa0f878c6ec9debf5275d6867d1b5f6e25e7869831f5ac96a1dae0448dd5dc2d63b57ca6ef0ff7d06
- SSDEEP 12288:jN9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:jN9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T18E65234AF48026AFF14B4330EAFBD225CD510EACC2E578DC57089156ABB6B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.7MB
- SHA256 d9f028b3981276e7f05f33a548034b07d61613a93481c1aa45e9dec0564481ad
- MD5 4035b678861a0c9681841e5f107a2aa3
- SHA1 43046d59de0f1fa8c5469b5d12d1b03bf918d589
- SHA512 7af60e8525b5d385ea059e83eeeefc5b5a8a6b755a82ef699e9fe891f0f50fb3e9c6b67b62846767dcc8e123f363bbcbf9857c0ef5c58ce1b1ecffa2df08e27d
- SSDEEP 24576:gZMEzFVSOl9GATihI/3b2Ym2aH2ijEws6XNhWE:gZMEzfRoAWhI/36YLaWijEwdNh
- TLSH T175850285B39018F9EC678239CD668906D6B27C6907B0C65F03A436675F333A11D3DFAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 f28aad83e933b4d691200b7ed0d01e6402b2882233a3d4e05229b5c9678c8fdd
- MD5 b4c188edc6ca5d1ebfc55cad982fa97c
- SHA1 b94a22bde48b51dc70d07fb848c8d5437e062aa7
- SHA512 731ab98aad10eb4bcd298fd4209f500c542188ba8501fb3c08b8f51fa3fb077bd0961b2616f3e217e5f15b5330b34d3872e1df373a9213e7e7c659438a346214
- SSDEEP 12288:w+9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:w+9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T1AA65234AF48426ABF14B0330E6FB9226CC510EAC93E578DC57089156ABB6B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 ed8c57f2d497a5d1fe47087f38ea7b74d3328c6f04e7fdc2b7e40954759f68df
- MD5 5ad230c8a8762fe89f5434347b1fbd98
- SHA1 e6c0cda3ddd653b31cd6db7d78b436785e96518b
- SHA512 0948960d8ccb22d74aa06939331c6eb5012108da04e5d64044a1e6eb9ebc3ddefb04250eb19a4f16a66803b7acba6c37bdb49bd96ffd592e5d80ef5d5ca1fa42
- SSDEEP 12288:2C9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:2C9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T17265234BF48426ABF14B4330EAFBD225CD110EACC2E578DC57089156ABB6B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.6MB
- SHA256 0d3ad7212badadd0a9a1760f88652c2eae1dfa0b24e625399e4f33e22bd88df4
- MD5 e58ec6c41eaf009166e60b86a64c2228
- SHA1 f8302aca2f796c061438620826ca2fe719352467
- SHA512 dd9f5fe785b67e1206dab1b7d2f55d3fb67450ecb470f4f09da2cb24bfe13694dba8ea27d0c0f47109f934d87c7ad4c191f2d0ea966d2d787370059495bede1a
- SSDEEP 24576:KzyZ9GATihI/3b2Ym2aH2ijEws6XNhWE:KgoAWhI/36YLaWijEwdNh
- TLSH T13375020772A130FAE1678234C9A25A12F7727C754760AAAF136447762F337909E3DB72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 41ed8649180c36853be43d4231abf6c8f30d755b8a1dd777e502b12b59a4ebd7
- MD5 99dea5e0c81f326585757ceac594b9bb
- SHA1 3a494f87223b5cd060bbba030acb4b3443957404
- SHA512 1016e53184f88e2e2ae01de1014a4ac9faf4897f544c9123b473e6b3a2690c6405c4e5cd8a51109b5d6b029f3b77a0303d8ec851ba4587be0a5aa5ec32a97416
- SSDEEP 12288:4+9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:4+9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T1C065234BF08426AFF14B4330E6FB9266CC510EACC2E578DC5608A156AB76B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 b53f19ec3b163da213ccddcab568c0883311b3771ebc74c817d300e53fcfe6f3
- MD5 9e13f3d55163cc1b1baf8e710a767958
- SHA1 c85c95d3c8f398c135325fb21be79c72c3e9cd4c
- SHA512 eb539b532071a9605354a6d539b9f94755cc51accb5bed1d9d052c0f33f91fe539f027937ab1c271e3ade2c40953d0e236da9579151d9109d6c9de8e41fcde8d
- SSDEEP 12288:2+9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:2+9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T16965234BF084269FF14B0330EAFBD266CC510EACC2E578DC56089156AB76B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.6MB
- SHA256 aa1a7975bb27b88c2865fc5d2fd9de39783516fc1c252e411c71a228fdb5d718
- MD5 96d095494e37c731a3f59e88e5c79e69
- SHA1 270645577864d9e0a85c169d6f5bc9fc8d3fe3a7
- SHA512 16182a472421b1d703c38c2daad2a961d453a3507e7a5efbce6a315f6f24da5098af7bcc8468e1c52fc67e7280e4e0749b29627da15e2e717ca4f7d3f5899a6e
- SSDEEP 24576:4zyZ9GATihI/3b2Ym2aH2ijEws6XNhWE:4goAWhI/36YLaWijEwdNh
- TLSH T18775020772A130FAE1678234C9A25A12F7727C754760AAAF136447762F337909E3DB72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.7MB
- SHA256 55000fe47198863876627b01d4cdb3ab989f469a9120d47d1cd2b6a35d224f73
- MD5 395a619df3033c80c88de43999385a14
- SHA1 f2c4b9861f4f69d0ec793290d5dbc9551b3e06b3
- SHA512 60b5b12ef049f0684618eddaaf91b6a0b219ee9d6ad27f1fdd0e2e5c0659379a101cb4608457b8cf38204d2bca509759929cd31f0f1104611aa0186e3d372cd5
- SSDEEP 24576:XTdaLl3z0zDn9GATihI/3b2Ym2aH2ijEws6XNhWE:XTwLljooAWhI/36YLaWijEwdNh
- TLSH T165850295B39018F9EC678239CD668906D6B27C5907B0CA5F03A436675F333A11C2DFAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.9MB
- SHA256 65683684cad42d66fa061f1a1fd52f59f30c12ef83168bc420ef09390e85729a
- MD5 38691407871d0205a115a48ca93e85da
- SHA1 450889bcee797c88dd940d7b65e82f8c433c0aef
- SHA512 1ab43ab14d202d4f76db26fafbf169131145ec18b41e599f790a40a3ae6a40f46115e87d777a06daed4235e32519986b35c76df35582074911c65555fda27ab6
- SSDEEP 24576:K35d9CHKy7GZz9GATihI/3b2Ym2aH2ijEws6XNhWE:s5d9CHKyaRoAWhI/36YLaWijEwdNh
- TLSH T10395CE90F3E410E9F0B7863489768512DAB67C995B71DE8F03A4665A1F33BD18D38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.4MB
- SHA256 25ffbfd62e2a1e0a096f80daca679434d96e74cc44f81b92685bc63ce6c79fd6
- MD5 087c5b693de490ffe304ace0c3588046
- SHA1 2388949f0f152c5e845ac592b8007de5dd9442c0
- SHA512 255f4b53f013a2adc73fc44052eb924e229188ff560ba277ad7b27931c093f1d54a851792714a6f83ab802d51ab6713d85fc99183d6ac1127ed948b90290fafd
- SSDEEP 12288:p39GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:p39GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T12365230AF445269FF14B4330EAFB9226CC510EACC3E578DC5708A156ABB6B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.4MB
- SHA256 2b123168a60db6fd35b6ee0a7d93db0027f3f5e19d8f62b801736bf5192ee7be
- MD5 f6106aa024742b776f596bf14ef055d0
- SHA1 0ee772c4652bb75f5e41c2b80c3313f146a26461
- SHA512 b2796e060e595f720da79e51b220d10ea517c27cbae5b756c40dd5d322c3546539ade6f6969a558f3bdb69611a292d1948cebdc64a9eabfe95ee926c432e6c92
- SSDEEP 12288:j59GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:j59GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T13565230AF49026AFF14B4330EAFBD226DD510EACC2E578DC57049156ABB6B415E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.4MB
- SHA256 8e2715f5d9cbfe07a2773a8ef480c918c8e5c7b1104d42b563ee47b0abe3386e
- MD5 6c07989cca1a28660b9c7384706c2fcf
- SHA1 1b56e2dd8c49af35eb416ffd8112683e6746cafb
- SHA512 0f76b5e8f7e72ecab1a8f6a349d5648aa1458cc19607ddb8f7ee6666c3c9acb5cd8689555b94169ac563c3c05ba8d24649989540b6035f9f4d1202ff6ef224a8
- SSDEEP 12288:uQ9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:uQ9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T13565234AF48426AFF14B4330E6FB9226CC510EACC2E578DC57089156ABB6B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.4MB
- SHA256 b8529eb803b597babb902e2c13e12d22e2e465ece574b74e6428db3f6abcccb0
- MD5 748d220ea910b7d6d300f8183e2c29fc
- SHA1 d8f20225ddfdbce3d57bf7a7509919ee8ec0da3c
- SHA512 b97bd0763984daf2ea02fa81c3382d6db14ac1368b52014e431b11e359ef4a947547d6ecb03c63bec4e8b211586bc6e3fdf1aa519912fe9cd6cb987ed395d8e2
- SSDEEP 12288:z+9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:z+9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T17A65234BF48426AFF14B4330EAFB9266CC510EACC2E578CC57089156AB76B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.4MB
- SHA256 f9825a4044baf0b21de4e8f044b117e5474468a428354c78d161adfd8d76aac6
- MD5 9fd37e63892900be17ef6ed89286b930
- SHA1 470a46853278e850b9fdd53aca6d70178653b729
- SHA512 009dfc2441f57fbed791256e5492dea96509e20c81e485b56fe5f3c73f9a2e495a4e1ef4a74af56d23cffb97e9532b1e5f3ebe839577eee95b7b346c4e7f7db8
- SSDEEP 12288:u39GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:u39GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T1C465234AF444269FF14B4330EAFB9266CC510EACC3E538DC5708A156AB76B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.4MB
- SHA256 9f8b11da0f6fbc5d537924929bc9892700fc28839720553943329a496847f55e
- MD5 183030c768ac39f808b76e74092fc7a0
- SHA1 bbfab9d9819eea988b03c43f5a2f65e9461ca48c
- SHA512 50833c78aa4f69dae4047529c4db9c7efd7bfcb7223e5ca6a1c6b644f4127b03085e3b05f35e2c3f9bc0d942d62e51e490c6b46413b4ee4db1c66a5f1f175e5a
- SSDEEP 12288:XG9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:XG9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T15765234AF484269FF14B4330EAFBD226CC510EACC2E678DC57049156ABB6B515E0C77B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.4MB
- SHA256 f446169170882214fafa529b031f02cd5f9e8eafc64d1f65028e31c09630aa58
- MD5 e3d69816957022c7a05824585f45705f
- SHA1 7d9c342b4be3e08eeed505155a7d48007878a37b
- SHA512 8c00a0c092ad20695d308bc066214dbb1fad2c0153d4b697a1bb62b5749a817e216de30478bc12be835be9201d7fa887b822232621f9cc02d27241f7f41f07f1
- SSDEEP 12288:BE9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:BE9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T17A65234AF444229FF14B4330EAFB9266DC510EACC3E538DC5708A156ABB6B515E0C7BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.9MB
- SHA256 ab5dad698ac3b67a409864118d3c9b66318cc940d640884d1db30bba46933365
- MD5 0cd5ba13d3423d5b101e5ebd7bcbb822
- SHA1 a0c1be45d0cd8474c781d9e4c679924e2fcc26d2
- SHA512 e0af8a4156923ac7ef36d111e42f7c1239305e10c498f03f7ba4996f5e72e89fa21353783728ae64f42d6a2ec0224c3cd9d6eb4af9baa28b7eef8ee48736cd24
- SSDEEP 24576:Wfwv+k9RX6wkyAIy9GATihI/3b2Ym2aH2ijEws6XNhWE:kMnYIyoAWhI/36YLaWijEwdNh
- TLSH T17395DF29EBD804E6E1B7923C99F7460AF6B178681B31D6CF025953AD0E33ED05E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 59dc6371d3352a5495254657ce03c6dc4be66d9e53bf9601396b1dbd9fec012d
- MD5 2b54657299b3ad0ae1ae3f2bc5ad593a
- SHA1 89bd3c0f89da7650f0691f333fa36cd5ee213d57
- SHA512 8ba6ad33b04e3aef67056346eb2822059317c094afe0464236c28b06a152641f4bb13fe393d4b81e7c06a2962baf38087a8b4f0b090deab4421742513d53559e
- SSDEEP 49152:wYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07oAWhI/36YLa3:eySzPz4I/KYLaZEY
- TLSH T178066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 79d7e6f0cfd3e5ad1357e88a7e184cbbebcb915bb4f55e844f2f277b72405419
- MD5 eee33613b291361b16b632f2fa39b77f
- SHA1 f76caba8d09595c4640c9e612ecac4f454eb2448
- SHA512 b59c00550bebb4e40a0817022eea5b8b150e60007a4af6235242ed1bc31d043d446f1be23dccf5ebb7b59d0e7277c7a071f48cf520dfd7ca336272bc3a54e492
- SSDEEP 24576:L47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYV9GATihI/3b2Ym2aH2ijEws6XNhWE:L47JUQj1irIhCnDHUPfF/roAWhI/36YW
- TLSH T19F65AE1EA3EC01E5E1BA827885554A1AEA71782D1F31DACF1270837D6F23ED45F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 fab549d0252e540f7b0024fe8b783477ea390ab04cb8ad50c17ca5d2339e08b2
- MD5 19f2336a1e7d950475f08d407822d899
- SHA1 e42ad2d6a868c7b1c6f15987b4e641a3e28904bf
- SHA512 7662b9f9e6ff679ed69e36342bec875e6d266386fd58dfb20c2629101d880fd9725328851c24a2c8202c78bb88d5c156eb550d56caba4cad2018fc930c7a3b4c
- SSDEEP 12288:MzsfO9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:LO9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T13675F00AE29412EAD05E5234C7A68641F7333C6883E1E3CB52D0F57E1F766909EE9B53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 0ae3a223b59907f4795166846da920a66034ed169fa6a6611387033aac6f4bb3
- MD5 50e05faa1189e7758605e539c649739d
- SHA1 ef0b56faa7eac978e36c106b803aa54251e9eb18
- SHA512 1560c223ff4ce8060b33f0b9822d84b79e034242522229ed1a156ac81c8c6f0885c9d74eb317554bbdeceda1dd654f3abccb4c5f51e31ef1a795d5ffcc522b79
- SSDEEP 6144:LsBC2naFWCErOoNfKDeoH0dKIWBqeYP/vIJ/TZIpV/0UOE7IGlXhwEMk0A+Xg1B2:Ucc+VBqDP/A+0yxwEMk0Ayg1W3P
- TLSH T1484528107626DB4FC66D40325E33C2CCAB707D41EE05AB0772C98B3FD576659BAB2292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.3MB
- SHA256 3acfb102caf94f747ac77702cc875ff7407df55ca66d9c53609d735d529aab8e
- MD5 4e25f7256265aeffb3a12a0053a667ef
- SHA1 726db1e76f6797ea0853c58a68d2384bcec565d6
- SHA512 234b20c26e0f17984ccca966d816faf7c54f5cd4973089e7b78a977ec22471b7b1ae2086602f86cfa8313f865691af6cb7ca8c462ab14d2c11f70d643625b47e
- SSDEEP 6144:DIJdIasrGhtIavPooFk5BMLyXEkNbm+XXXXESyg9i54KDeoH/4KDeoH84nNs+le/:kl9b3AMxt+XXXXG1q4Ew
- TLSH T11055FA415137E78FD1B66032033A5F8DBB64EC02B7096F16A38D487AD86AB15B0B97D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 4KB
- SHA256 c4c3d607ed4149e552d18cc15d9b014a5c671df6ec21731c6cbfad3d83f5fa91
- MD5 3fd9025dab8cb9938f689442f360b868
- SHA1 d7e732aec022ebe541c24b75c2406b7b73fcc731
- SHA512 af2cae4bc50785247389d3d63779c2db6b2cbe718c26060897bbda6c5289fc5e471ab05567446224fe6862c4c68340952ddd5e8283d8ff12dea17f5319b6d020
- SSDEEP 3:OlH/lz0eMyGhCtlY3mCllltq3mCllltGlslslslslslsl6:KiBhWUmCtSmCtEEEEEEE
- TLSH T1A28192EA8B911622D14A3231142BA79A4722D58EE4005BEBC18E20528E47265AC52B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 71464dffecdc27088409be257aebe66473424c8381202a0784bd044081d3fdd0
- MD5 550ed569e182a5256fb84f28563e8f06
- SHA1 f8a214981d783e3e3ee09e7c5a0545681ab0e7ac
- SHA512 5e2dde88a6bf6b1d9359b7974df7e658d40a7b441acd32d82f15b1b39648493934c83ef3a25a83030e0c1fce7aeff6c204a9c035b25066d4372b4d4a1d79b6a7
- SSDEEP 12288:8N7W9GAT2bhdPmZBRdtpbwAaYTwrJ30aH2TWjEyRs6E39EfFhWfoDeor:cW9GATihI/3b2Ym2aH2ijEws6XNhWE
- TLSH T1AB652307F084265BF45B0330A5FFD1359D125EBC8794B8CBA604A296AA71FC18E7C72B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 6d3acf11755c5724e9648bd16faa6a4001f61fbf5bfa3c5d1794618d17ae156d
- MD5 0ba2dd8234052daec5fecd26e21ebce4
- SHA1 e605edaf4af0d1cb90ca0f1cd3b1dfff1bfdc9bd
- SHA512 630e9d3132295d1db7e990b1cf40079c879e0aab041ff7ce046e6db170ee19ac5cbf3493a55c3ca12ad1df179c2d8c9c9f20e44b844e30c9cb394894d615241d
- SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYo9GATihI/3b2Ym2aH2ijEws6XNhWE:Ogb4mBIBhGFVoAWhI/36YLaWijEwdNh
- TLSH T1DE659E1E22E802F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 2.0MB
- SHA256 4fbdcb90bc1149f64d01b183e40845ea6eaabbfa0b579711e30318b89f49d971
- MD5 bba9c585952eac7d4fc9dc6becd08d41
- SHA1 f02a2734ff8291e7a174559eea462b0bd7eb32d7
- SHA512 635c64b754c01b5e0c77c9be5969da2232c9f9f88f8460440f590399528e313365d83eb9951b78400267d337a6337473a02187d21ddb0d3e849943526eecdc4d
- SSDEEP 24576:5G88u8FpJqH1hzria7/ml9GATihI/3b2Ym2aH2ijEws6XNhWE:s7ZFPqVoa7/woAWhI/36YLaWijEwdNh
- TLSH T13295F155B6E001F1D47BD1388A964663F6B2B8250364FFDF07A88B551F23AD14B3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 23440760971bc36b6af8d74937ee9c60facc7714039000838be303008481d47b
- MD5 054a0f090f1587094fe4ce72c6a55a67
- SHA1 192243be496988b72c8f588c5d0d02c73b390d7c
- SHA512 fe83852621ade35fb8706704bb5f591f7b518a84af4d78648026464a2ef6376bddffc1c360af841851af7f1e3ae5a69fd238e840c22b52fe031d0548edc304ca
- SSDEEP 24576:dPUr+NQR9GATihI/3b2Ym2aH2ijEws6XNhWE:dJQRoAWhI/36YLaWijEwdNh
- TLSH T1F985F11F71E818E5F67AA13C89968719F77178660312A2CF0290817E4F67ED8BD3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 01c44136cedfa7113a3056e0480cfb9754b2ebcdc3adb9e162cd7fdc70acd473
- MD5 109bcae76b994d21df31587d8d345a29
- SHA1 7254b5a3d54565bd76b0ff6b6da3376569d110d8
- SHA512 3aa8f1ccadd87dfd85f7dc5cfc613191559fae0821e3cb97e7d5773a75d48c73e3cb45e120418622f2db21fc05c0bf6912184cae11e9b8e2b3795d080c87bc8c
- SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhoAWhI/36YLaWijE8:LG05lO43ba4I/KYLaZEY
- TLSH T1A2D5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4597E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 e9aef30c391154b31e848332fe5bab25092d9ab889cb5c736ca6b909e84a4df5
- MD5 c6c4bd3cd022ed6396a1b2ee36d7023f
- SHA1 3e197e2fdd3e95bbfd685e76bcabc8b498d984ae
- SHA512 586831fee1f189a145dbf389b73299bcfaa2f1c9c2fe9ac2fca95cdfe2ef0e957ef50346c446e13c845fbb9f3d8d64eb9732c6409df90f02b4b3bbc3878fc779
- SSDEEP 24576:Bfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn79GATihI/3b2Ym2aH2ijEws6XNhr:Ba5POZ3+Jt2pasx2+m5oAWhI/36YLaWq
- TLSH T18865AF5EA6FC01D5E5B9D17CC583861AE5B1342553319BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 6971d03aad8e77da515688b03374d778d45bec2e2fe90ffd3b8a07c877c47792
- MD5 14d7b31881d284561fa0a81628ce9698
- SHA1 930d905d92173e8200f4e50004a85da6e181f519
- SHA512 9a638c1570bb1181725cede128652d99c0ee68fbf404f3a80da2d11d7e1406ec626f8dae3729222f6ab01ea8b18d73f6b395c88b3ac2da66769e7bb580c7bb65
- SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7Fkd9GATihI/3b2Ym2aH2ijEws6XNhWE:uNc/zEOVHFQoAWhI/36YLaWijEwdNh
- TLSH T188858B1622E901E4F1BBE1BE89779546FA71786953309ACF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 c6800908ec887e03701483b496d4b3866e77b62a07905a67510234f5ba639155
- MD5 277c8300c9e3ec3ea29e423881f09366
- SHA1 355d0a8ea7eacd43650b227f7535eb433a69e215
- SHA512 25c3de428a36c6ef3897b384a400251e60054710fabab374e61eea5865094e20ad44c4ecd3207e5af3a55ba672cab2d6d7910d433935bf71442ff7797211a262
- SSDEEP 24576:L8kNvNnaFeYhJNtmZBmB9GATihI/3b2Ym2aH2ijEws6XNhWE:L8MwBtOmBoAWhI/36YLaWijEwdNh
- TLSH T1A255AF6EB6B806E4D1FEC674CD238512EA727861073292CB5390C13F4E679D89E79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.8MB
- SHA256 064a9f3f0ab73ee59ce6fbf7e060b5747a83c5668e48c1686f80716b1cb0cb56
- MD5 9709b2e996f959e41c074c9590aee5da
- SHA1 e5ae74e902e32b38c24716acfa2ab888af4a7b78
- SHA512 186c312916399617cba29b573adc6a7b9554380d5eb41318e0218a412a18564f44b3723c8b783dc8d4cab753b5f7e4213d4623cd8a370b6533bb35b25eea744d
- SSDEEP 24576:MD3FHshBIYQgAK9GATihI/3b2Ym2aH2ijEws6XNhWE:MDVHeBIAAKoAWhI/36YLaWijEwdNh
- TLSH T12E95E16EE65C04E5E57BC27CDAA38606E77138AC032265CB0294C1B65F6BEE46D3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH