a7c44526c063619fc3bd5234a5a9fe95cadcbb6691eb4eda7ee0febd79c2f6bc

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Size 1.6MB
Sample261113-fdgresfw8v
SHA256 a7c44526c063619fc3bd5234a5a9fe95cadcbb6691eb4eda7ee0febd79c2f6bc
MD5 3f4da8a1b062b36c9cfb677b9179cb9a
SHA1 2a9df50fb6a2eb9d12b485b2f0c7fca388d13b24
SHA512 8eaf854733390a595359dc4848755128968b9dda46e34e35020c48eea34e607665ac1a10c254a60b3613f577a4590890e424a4ba43407053edeb44390c26fe7b
SSDEEP 24576:DIy/kLRKgXe4i7ojhsP5Lgrk1TWb4AN5:sykfe30jaNf1TWbdz
TLSH
T12075BE2279CDCD62C212AB3485B6896C62577FACBEB5CDCFE644BA3E1F332D14514206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1472	elevation_service.exe
5288	elevation_service.exe
3104	maintenanceservice.exe
3424	OSE.EXE
2848	PerceptionSimulationService.exe
3084	perfhost.exe
4100	ReFsDedupSvc.exe
124	SensorDataService.exe
4380	ssh-agent.exe
2120	AgentService.exe
5108	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e0c93b0325f2ba71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105218\javaw.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009ffd02d42973dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006524d2d32973dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4ab20d52973dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fca93cd32973dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
1472	elevation_service.exe
1472	elevation_service.exe
1472	elevation_service.exe
1472	elevation_service.exe
1472	elevation_service.exe
1472	elevation_service.exe
1472	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Token: SeBackupPrivilege	4100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4100	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2120	AgentService.exe
Token: 33	5108	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5108	SearchIndexer.exe
Token: SeDebugPrivilege	472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	1472	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
472	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2972	5108	SearchIndexer.exe	100
PID 5108 wrote to memory of 5452	5108	SearchIndexer.exe	101
PID 5108 wrote to memory of 4396	5108	SearchIndexer.exe	102
PID 5108 wrote to memory of 1136	5108	SearchIndexer.exe	103
PID 5108 wrote to memory of 5060	5108	SearchIndexer.exe	107
PID 5108 wrote to memory of 5912	5108	SearchIndexer.exe	108
PID 5108 wrote to memory of 4936	5108	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5288

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3104

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3424

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2848

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3084

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4380

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2251218687-1689653882-3767565116-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 1500 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5912
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 1500 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8170d1f01f21d340553005c80a1f0717dab3617202bbf045eec90db11405a36d
MD5 2f9f9ff4da4707980b5bec969ce9efc6
SHA1 d0e1c62ca0d4666fa74abf38992cfaf415d9801b
SHA512 ac915716560c0c019d168711e85aed429c85cd38a94c8ccf61b2a32fcf583e8d79801a7f07af554a13589fe7a0ecb531b0b67cc485ace68744bcd69bca79ac1a
SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnWe30jaNf1TWbdz:x3q6HjBLU023W
TLSH
T1E3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 390482a04333091f697f5cfdc7737e8a996bd87de9c2ccf370a87348604e3b8a
MD5 a0f19c4c9b1c6f66e90becfc463d7bb2
SHA1 90ba0003d82070ffb3690c2b8af604f090e2280d
SHA512 1cab0e14fd35b2d0c5b278998cb799dc700b2cdc06a94019a9347707571a3a6aa3f7cbb5ec8347b64a8436014968e77ccea063f2647aebd175508b62bf836564
SSDEEP 24576:aXYfDtczAwgXe4i7ojhsP5Lgrk1TWb4AN5:Btcwe30jaNf1TWbdz
TLSH
T12765F12867D409F9ED67827CC8E2C611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 823959c16b57e97e6a6066998d0cf7f96cdfd7d993603919635f97ef6a85d238
MD5 4396d4decae05061448e7801ffb5872d
SHA1 1ebac87312c09397a29333a008172770b7cdccd7
SHA512 358527f1f9f5a4a82d7e2b81fb208b70791199ae1fd7dc23d620de76a9c1d3d54f74f074108b91cbf7103c3984ea27170919447aed6e60a6b76bd7c5c1c90b7c
SSDEEP 24576:b0Le5ji0hmxirM3gXe4i7ojhsP5Lgrk1TWb4AN5:bPji0Ac9e30jaNf1TWbdz
TLSH
T1DA85AE26F6748735D073C0B9C5D2A68AED71308257308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9ff74bc2df04f3b26bcf0721dddb40e10325f612d3ebc5f256fc4eeed66ea25d
MD5 779671666c8174bf15a54b244b11274f
SHA1 67df2e4735b9ff4a1d52fbed74f6dda1ffae69d9
SHA512 1c969c19efc94cd0b292523202d56797df0e61f9528a4f11bc5bc6e9060a730277231d22a0334953b822fe9449d86823cf5196e76a8a827d83a588f6c7764ad6
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyuVgXe4i7ojhsP5Lgrk1TWb4AN5:W/ezSC6vUzPvxHjy5e30jaNf1TWbdz
TLSH
T10B756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2b168bf0c11d2dda909b55c775153e13154d9dd53858c231fde01493a4ef758e
MD5 b98c77f6ff4fc98fb9cdacecf688bacc
SHA1 f30138fc4d560510cc2ff236b15764085f235b71
SHA512 85cd513abda2bd98e2a51f1ad0bd0d4b6d4c16330a2ec729b0277beb59c0bd6c6a5f438ce3c2a458d7200870a53973f6f533ab7550f02bf4188da07a38031075
SSDEEP 24576:kVbqPb88hv/l+6UgXe4i7ojhsP5Lgrk1TWb4AN5:kVO88hXl+qe30jaNf1TWbdz
TLSH
T159559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2bbada011bad976d90bf346c50d4674b78d29f0963286bb4e746f5b54d1efbf7
MD5 93b7021b8058d778ceffa7e64bcbf859
SHA1 6aade5c71c4ee5ed81a7912b615044a70f64966e
SHA512 19f317adf4c475161e762e5b5f387aafde473800c7903736a25302b38df139c1e4e5fa6c7f049038a702170b91ad01db5106c50254236bb362052a520055f313
SSDEEP 12288:0RC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0RbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E94523919F5409C6F38FC3F0A0F7CBD1E9E11EC061448E6B47E0BA9359BC899DAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1eda16e9866138315c93a9b0b88326d060d832a1bed4401f0f7cf1d0b21f0838
MD5 1612240b2e42e8e9cae51a610600e354
SHA1 631d97f2b1b14d641b32048d419098fd66ce3253
SHA512 fc3365e890a021acc87ef716eaabc7025f9123f259924d1dab030deaf3427955fe3297ea7f183963af202289e8b73f263f2276ca5a4930261465eead5c0405c3
SSDEEP 12288:BeBNUbTVO86Uf0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BJIUMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13765CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e0dffa45bd2a4100a44c7d720a9f224492b0d25c6b39cfc463fd76db869f6fda
MD5 23f40dcd739107663c35ba54bd8fd3fc
SHA1 7f4c4902e1492a5361707f6051d99bc4f145ef59
SHA512 e12b0242c5b94825f1084076f2a32fb273cfd97cafeee04dc2caf8da8650d26d7b5147018ddd564c0649715cf12317742d6689c5684678e99d393953d2de2e58
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:xQvGAdlCEL8c/yRNw5CQU023W
TLSH
T132267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f041a111c394713ef2b5a858bcd6a7b81f6330af8d41c1ff83769137d02f1a57
MD5 bf296e80461323101fc081b472e06e32
SHA1 8a1921925f3b8e61b2abb764f7712906aa881a3c
SHA512 ee46c676b6934a4de89ed6de7c46eefd21f813967e35e5f54222c85f94487b507818270a7b62ca7ab32c38c11b6a4339c28ed0f2861144ae4976faf9c31f57df
SSDEEP 24576:cdewsAjqgXe4i7ojhsP5Lgrk1TWb4AN5:EljNe30jaNf1TWbdz
TLSH
T1ED65E031FE74E036C3BF0DB21B76C706586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0d49db9949a1af9144fdcc3f5c51eaa440fb342b03c1bc99898b9e82a9762c63
MD5 f9f16b298d95fa1353b71696595c3684
SHA1 270a205c97a387db57cdc3ae9340dd66d8c719c4
SHA512 3612cd8dd7cd8ffe7fa558aaccebeb6219e5bf8e373619731f7f7b7899485c1d18a7529c0bc64d5abb29d3df18defd7a40cde13ddf48e7149e4d79457a8b8e90
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHFp4W:PUEtQevvqc2W1cpV2EI32X4W
TLSH
T19A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 da5c479531f074bf0b0e2891d7eae684d265344d36d5c5ce3e8bf68db671fbf4
MD5 5f201b01b616e6c0bf2bddd9237480d3
SHA1 9422c7b7688b756f6ee65712f0edf269ceb7ee7f
SHA512 4ab1269008c1274d0bf6e8166e37842de588f0be9f3450fee1c2e99938ab02947be77599b5cd366190a3eed9758954591078f21f29cc4ce90eccb0598ef644b5
SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/zte30jaNf1TWbdz:OoqtVjnmcU023W
TLSH
T1C2D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c99947bfca90f888a5e2e6feaff107efe34f93e2535764411bb344687cdc4300
MD5 ef676a8cb26d9974ea34654231184ad6
SHA1 6cfe783e55313051a6f85e2a7578d10fea283dcb
SHA512 df69fa5cc6295149252cd49888f787f0c125a4b8fd055b19aa578083bf390a62613548beb276261d0732c5f6367bf5bf98e6d2bc0699ecf91184556c31758f51
SSDEEP 24576:oAhGLJIFoiwtA5l7S53BgXe4i7ojhsP5Lgrk1TWb4AN5:oAMyFoiq5se30jaNf1TWbdz
TLSH
T127359E81EBF945D4F5B3AAB899B68571EA76BCA65E31C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 b047155bc9a1181ac8308541453a7b18ed0f06ac7f3bbd819484d0ad19bf40bf
MD5 b567a5078bb5e24eb51f8268366aa0aa
SHA1 60e11915774c4dc388b770d0332eaa82643b857a
SHA512 f5cebde00db8fdb75783cf6a55d1b26a22b7683a33fab98218b2d2855124f335038ec0d828cbfe3de234869019580af9b623c8c043426b7cd53e664bcdd8edd1
SSDEEP 12288:Amw5HEjsChNVBFgl0WDm+CU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:dwuoOW2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15765E14677A40CE9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 6fc483d8292b70574598ef113d98b5fac50896b9e4849dcb7ea395444d5e7ba9
MD5 b79ce7378fa90b2bb4b969409642c9f5
SHA1 ffb78a15526587fe2de416c806f6334fa959521c
SHA512 7439f216a06f2fda8efd47bca2a8c7d052a7434340ffbaf480f0067166df611d86ba0177f7913c60f395f184420da87bc7ed6b467d84ecbe321eb9952456ca15
SSDEEP 12288:n+BZ1IyN0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4ZuvgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19D55129627D421F9E2978278D4F68741E7B23882233147CF02A096A71F76ED65E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3cac169aa5c497b6fc40ea59e56d31d11e4eb19876b6dc40fc7851dda9d3aa56
MD5 162fc6f2aaf60b12814b23e365566c49
SHA1 9d5c363cf8f9d7d5e955aa3981b9139bf4348a26
SHA512 369d62f36611a5a686780a690fe0dbff4dcc5eb861b8fbcddaeb9a313187cb058d83c587ec754d113ca215721b3f5694836df40733039cf95110fecf43079ec4
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:hQRQyi36YOcPQLvw2gAf+PN3fU023W
TLSH
T1E6667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4152d569bb798efed99b6144ed9e5f601c89e8896eee20185d77104cce3b53f6
MD5 d4b7b453a63f138080807caee913ee72
SHA1 18d6710c2ea30200ba3fe7b9e490f8b5b817b010
SHA512 8b720c83ecafd64e73508d927cd63fa9ca03c033adca4bab32923c1e29b809243523d50997cbb9808471c3844bcbda4aecd7957bee7d16efd1d4ab9b3ac48a98
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:nQRQyi36YOcPQLvw2gAf+PN3fU023W
TLSH
T1C0667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 369bbf71b95a7ec76a483ee9d6727aaae6cbbcef49455d96b7e44d38a0dcb561
MD5 53af2293028253893345c0090dea4e31
SHA1 b170902a50aa17583d2a43c2bc7856dd612f85a6
SHA512 471a73aa1d2d96fabfa99b7ee19a0fbdb01ca9571c7e8be7adaa7861a5d4830e8af7c4625b475be69bc4066d80481750bd5920dc0f11aafa514771ddccbc9c3f
SSDEEP 49152:N68Qg55nhheWu7PNU3/9e30jaNf1TWbdz:LthWRc/9U023W
TLSH
T146B55933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a25db2f48fae8f02688a61f19fd5e2a7acb793dd56d15c5cf2b76c8812dd3dca
MD5 0c4100cb6059e9b976c03983dff52481
SHA1 882b8eb4afc307f8d108eb7d3780c16c4c87e9d4
SHA512 c8a0d68890b364eeeaabe62c9d41ac313bb8b7f4fccb67629fbe1bac990b1d31d17428e41f37ae560eeb012ac00e119acdd11d8daf733be36a20393e1f4f09fd
SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99/:Fy5112gYy5azzVvL69nLKnhZCU023W
TLSH
T175168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 662f9537da46bf6745d164c5ffdaef5372902e86bc61c78fb0c174c83b0e110d
MD5 750f553b42bb0b9549c7a00056303b03
SHA1 0e0758afa1b49430794838c675a5c8bb0a932a09
SHA512 8a71c490727caf149ed6dff34d06b8b2c637f0f82edf7a91f0c72642a57601aa40495085a0cfa81b30de3496b4ca53479a293727b6aa982b08b3af8c260d1e1a
SSDEEP 49152:bB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glHe30jaNf1TWbdz:Nu6JmVxd2dHU023W
TLSH
T141D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ccb78361d45275c5d4ecd9846374ecb18f09f332824e678258a1980e98ec8af1
MD5 b0f4085ae567b55157931e4651fdd9d3
SHA1 e5d27ee19877ee035549ef1a85bf9554d3133a2e
SHA512 cfe6fbb9c88a101e4cde6a91cd28db424098fb652ff3bf99c6ae68ff270fdc76b92f44ec06c4077f4fd7fe459ba9b671ad6e7117bcc47465c06f56b4ca2c633d
SSDEEP 49152:J1hpsNoJpF1A6UU44CwH7R4xje30jaNf1TWbdz:JmifPbRcU023W
TLSH
T1C9B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f326fe4f57bddb947943607d21b6b207e029cd02a96a934aa25a44b4f70fb335
MD5 9f5ea22ec63fd63ee2eaf198446cd651
SHA1 cc94c700b37872ca64eb97e38a360a8a4f45763a
SHA512 015a91d2de2be13d98bfa4d5ed305c6c3f39b77c023ed125ed8a23f73ed03e6f06d7afdd45edae129ad4de291423114adc1e444de0f87d48a7c87eaa50cf4130
SSDEEP 49152:7SuZQIY0Be2KRRVtOnks6NMHqme30jaNf1TWbdz:p5dKTi61mU023W
TLSH
T16CC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4c2a65902a6aba37260a9f5ac645e91b02756892629db963188e7e8f5d243951
MD5 94551cc871233368d50eace6d54e3f1c
SHA1 bc27dfd07b86b62cd9b079e1b449b1c04833fd09
SHA512 6b11f14178d41961c586016c85c7e9b1137af6c4295d5f111ad889b339422633c92a9b59e312c92a75695542eeb0fb8118ac8fab9890213e61b1a84c659c1872
SSDEEP 49152:IhtSn8EApI0figngiDn0AP5wXe30jaNf1TWbdz:ZX2iyphIU023W
TLSH
T12695BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c3e3a00d2ec71bbe4d0db50bcbd27b1f6857705ac174bae788fe34b343ab0509
MD5 fef86f0bf5f0cf5197ac2eaaf539fc39
SHA1 c7d19752f8817e63348937a4d2827aade85cff5f
SHA512 9f11bb0ff7579c2e7deb0748f9fe78f7eda9ad3fcf4ee429f8a2c15f10edea5edd124e87b93c07b92e42b8f8cfd2b08f39b4dc67325d63dc0897907bf1ceb16e
SSDEEP 12288:660DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6TgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1104523919E550ACAE34BC3F0D0F787C1E9E11FC272444E6B57E0B9531EBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e986819ab8af11baab2f8d1749609b091027b6b5bf45ddac17737819090289ec
MD5 96bb2b0b725e30953203b4a58494264c
SHA1 8acd5cd56375f9094555c5bab6b8cbc79afc115c
SHA512 9985b899bf41e557c2d67f06509f2554d8f8bb44f0488a90dfe5f256ffe1aa65e53a73299923f87f05b957839f56792e0cc56c6ebab80ae2397d4e99734c50d5
SSDEEP 12288:yR0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:yegXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T131452391AE550AC6E34BC3F0D0F787D1E9E01FC272404E6B57E0F9535ABCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8fa9aeb784acaa8561de4bfd27eb0280552a0599899ad6e0d5bb33ec5c3b0014
MD5 6d9e45fd69e25e3edeb6ef8c967d26ca
SHA1 cb8d17b29cd8da043beb2db34d817cea373007f4
SHA512 afae822138dda7b6c30d1319647744795ca61ca2d4c10d17f03794c04b636efce63087b7f3b9f7687e55e5aa7802afdf3fcbd5d19f70244e6a210c2a1e453f09
SSDEEP 12288:D30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DkgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E74523919E550ACAE34BC3F0D0F787D1E9E01FC272404E6B57E1B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4ba6656447a168c90af346f0a226879ef229c198902d683cd7019aece0b945e4
MD5 848f85478acae42ec5c0b15949eaa0c5
SHA1 3974acaea72cdce15df9de16a24b2cc0b8b1b015
SHA512 6367f287f573ad99f72a841688a8b543c6befec9a051f41e99173bb2f6ae07ce6300a6208fd60dad216d463d63de0b6473c3da244e47a00b5773520a5f8fcd1d
SSDEEP 12288:IVg0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:EgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E14523916F5905C6E18BC3F4C0F38791E6F13DC1B3118BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0aa708e814437760919a5fed4c753c1d61f853dc2e2a0ce410b4a1d113cd523f
MD5 ab08fc2c11a399dbe777312acc89095d
SHA1 4edbe15992b032ed627896ac8842401c938e11ae
SHA512 3785394adaf96724d3f4bd946fdfa42549a9fa86d9c00fcf0438c3fc05ffa7eef6e1abd86f6a055aa80b606b5770099ea474b4f7d8f3644385ca2c619f4ec037
SSDEEP 12288:cI0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:cpgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17F452391AE5509CAE34BC3F0D0F787D1E9E01FC672404E6B57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e49d08889d4758fdaa01da38180366351ad3f62591df0bc6a73ffa6cfecf09ad
MD5 a7fbe788dcc35dd1953a2d7347d79000
SHA1 e74d1a73e5ea4ed485e236ddf2ee626933bd1edc
SHA512 e74802a8fd584847f420f150607d39e1d51d65bf27cc969668ac73ef97f20a2d1ed0c4aefb7dbd3f3e676ce0ab831f71baa472d930c723f1cd23f679f7ebe62a
SSDEEP 12288:f10DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fCgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1394523919E550ACAE34BC3F0D0F787D1E9A01FC672404E6B17E0F9535ABCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2c772190dbb6832b85a763a5c2b93689508e3e26a5af09dcb8d6766570b847db
MD5 ad1717431e42448ab143d9c7956efba4
SHA1 971d41c71deb7cf75f462c124ab3f917d8118c31
SHA512 b831d95ff1e1604c3f2d7f3b108d2bde8440463591b6e35de722f6f64b2c4b5149579bb341b1a301bcf157816d327e1bd837dea1aadbf22836fce4a64f740cf0
SSDEEP 12288:aZ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:aGgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1154523A19E550AC6E34BC3F0D0F7C7D1E5E01FC272404E6B57E0F9531ABCC996A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ac94f9b225827783f9a721300ac3c1bbf680a9c7019ee8cdcf0a361c91e78cee
MD5 4c115692c60fdf6482b93e65ec50bb15
SHA1 6a88ff8d2d9378c173a2a86b3ff9828fb9f48aa3
SHA512 e494140a974a15d8449357496b619bef51d1007059fbb1b42f1af833c93cfbda48957d8d79170669da0e7e467efd39a6d65b9c9f833c714a4241ea9e046ae053
SSDEEP 24576:lZMSzFVSO+gXe4i7ojhsP5Lgrk1TWb4AN5:lZMSzfle30jaNf1TWbdz
TLSH
T1F3650195B3900CF8ED67827DC8A68A02D6B27C561760CA1F03E436671F773A11D3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 50139f390bd416f6cd0ac9ff916f482ac53a8333c98cac56044905022e5a30ec
MD5 5aedb826c0c3785618d57005d1f06df6
SHA1 093f306f03fb56f79c3a805dc05afe1f4190fcb5
SHA512 19a463e549ce85778130f1f521d26c199ae1057c1af496c42d3a4a735ab3f08ea3d3bc29987d61dedfb0e8334a26d96df74c564c161008719ba552755ce36d56
SSDEEP 12288:NG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DB452395AE5509CAE34BC3F0D0F787C1E9E01FC672404E6B57E0B9531EBCC9A6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 342f4b620be7fc1678df05e6c4486e4c61cedb18c8cce2f83d790c3706cc6719
MD5 d9386818b980666f7a99777b01440dc8
SHA1 d1aade398dfc6c66d688fa1ef05c45f42a55d5d9
SHA512 ea2bd24942d2532bbf2de174ec72db4d39eb5d2f605f4701524881e288775b593c82fa0576c86a0eba2b6e1abea41657eab3f5f31428b2b625c53db3e04d37a5
SSDEEP 12288:xS0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xLgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CB452395AE5509C6E34BC3F0D0F787D1E9E01FC272404E6B57E0F9531ABCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 4648831af3752a1b2accfee48acb22931058ff7773fcfffd62919cdc1f9c07be
MD5 0636a93e6d320306b7ae5dab61f3f229
SHA1 a39f8fb5a2b6d27e91a73ffafb8df38575d8b6e6
SHA512 6e49c34eee80754aa75057f01ca811024a473ec32dc97aec03a2feede935a894b5ea6795d4d149af4976e8df9c8cfd644b4376731e2fa816bf46fd0a1b87e2cd
SSDEEP 12288:nyPz5L8N0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:KzyagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19A55025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 55cd3c86a7eea16456b1555d7ec7943257761791df2d9350408c15944a7b023b
MD5 21551fb5e287a0ad5296b2bd5f4255d0
SHA1 ce597f011e2b6bfde1f75b3c0e7bbaf66c418616
SHA512 34e46faf7f6446bc83a969714b66d860442fb15b1dfa927cc6edca88f6c487ebd0cccad692f5c3544302d8d87d1419e0e670e82b3b3bc66ac1e0e52a3a8261e6
SSDEEP 12288:aG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:afgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F1452395AE5509CAE34BC3F0D0F787D1E9E01FC272404E6B57E0B9531EBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 86ac842c9d68d20bbbf1496905a19e72959dd1436ae18696ae40da2e63f4f65e
MD5 68cf0a9bac44e6de599bacaf6f4ce8b4
SHA1 c49b858d82fa1da1cf33f40c2385c6dbb90a6b51
SHA512 1e9e782d44e887d30d1b655d3a206a9f427585874e3f9c7c46e9c476f0e2636aab105982f1ce46b5d84d6ad00fd432d47be34cc8338e14f70648cd6111290942
SSDEEP 12288:gG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:gfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T184452395AE5509CAE34BC3F4D0E787C1E8E01FC272404E6B57E0B9531EBCC9A6AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 cc560c418c3c8a952a418209d9a401a924987e4df3c2d0cdfe2ea28003e0295d
MD5 4fe67e752a3f690920c3c002f18e74ff
SHA1 934c20308ac9d8bd1f079439217b5370f483b46a
SHA512 572cda5dd1dd95d548da365e05c8e58a79f9507d8bcd4a408076f88a27288d2d1ab583fc06e7c52667132adb5253749fe61b26cb146950bb38ccf08d4d8cab3d
SSDEEP 12288:FyPz5L8N0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MzyagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DF55025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 9514d99fc4443e5fb1f0dd95dbda097286545ce5ba41f1d81cf18a4ec58e4b75
MD5 4e14a6a8b1b6b379f11aa394a49676b8
SHA1 0ddfaeaa9e7a350098b8a2847a559dfcdae71ee6
SHA512 3651b31321eb42d73a2de4f108d8cdc3b745d7d066bd6db521d9b8ba3fd28c1d827f91cf58c1a218dde39f46a77c080a49e1f28ca60c92edca7b0b9ba138136e
SSDEEP 24576:GTHaLl3z0zD0gXe4i7ojhsP5Lgrk1TWb4AN5:GT6LljAe30jaNf1TWbdz
TLSH
T18A6502A5B3500CF8ED67827EC8A68A02D6B27C560760CA1F03E436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 4f7597a0435ecdd143c1863f635f8f2a198319d57e520e28a5a80c25a5215aa5
MD5 f7457d354646a6239085066f92031c3f
SHA1 974296b0a8fca63768c8ee41e40b75a8450bd3c1
SHA512 70155e7c09552004cb568c82d9498b84a057647c37e102c9143efbc2ccb6d630a18bf9e25e7dda00abb730a16f3203c533dc031fd906148333107aa8f21c0be5
SSDEEP 24576:q37d9CHKy7GZIgXe4i7ojhsP5Lgrk1TWb4AN5:M7d9CHKyale30jaNf1TWbdz
TLSH
T10D75CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fd4fe59d8da6b62b1b283c666b457d49edd1467d385370d74267fe92fb7ac2a0
MD5 02ba6341d4af28920fdd2fc4d2153afc
SHA1 9e26646a74b5b87cdb356df971e830b26a4a9ecd
SHA512 106a3f35eb63378e70bf99d48b6325bca0dd25c225e87dbabbfec1f65686e54990df5d9e7391d002137170016b7deb96001e32b4d09464032eea2af22f72327f
SSDEEP 12288:WX0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WEgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AC4523919E5509CAE34BC3F0D0F787D1E9E11FC272404E6B57E0B9531ABCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 854cc8126870ce603de979eedb48c156a94f3e328c36ccddc20373adbe3a34c7
MD5 25b9f36ef48b3eb6e5f1ff0c596696f7
SHA1 b67fc8eb0676758eab169257c0820372f93adcd5
SHA512 476cd9f88d10128bf117968cfd4bc43fc4170fa0f30407b4042953089640314d4eeb9e8af44b66f7eeceb2e4feadef57cde08462d1a00fadf261ea74834fd6d7
SSDEEP 12288:Vt0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:V6gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E44523A19E5509CAE24FC3F0D0F7C7D1E9E01FC272404E6B57E0B9531ABCC9A6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 500426256106cb1f432586fc2f90f9a2741fa4d79acb022c08633d1b86541665
MD5 b95492d1868109f3998f892dee1b4b55
SHA1 caedd34851f8f3dcf6694ac3c51a012bbe413427
SHA512 80fa863446b9d0ea73bf6ae1275937ffd642f3ac1469127c952e56f65fee17979fb649b4ffc4651cc563333f1b1d39aa6e0785d6b3e59c792d90e531bef2ede6
SSDEEP 12288:J80DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:J9gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D6452391AE5509CAE34BC3F4D0E787D1E8E01FC272404E6B57E1B9531EBCC9A6AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 704b3f5fa37d637f952f462b59415188630a81ea74a57a396b4a8f1f038668eb
MD5 0f14aaec5887b4011e76b7d9d0fe4f98
SHA1 1b6b8d195428d9627bc8d4dc194a33bc74a9cd98
SHA512 576240300c405dcbbeb5a61ce7cd2c0171c7fc8afec8fc0327b9f401a5ddc264fdbeb4b9420d3276541aad03ef2b2e4a2b73feda37213f5adb58c708ee99ed12
SSDEEP 12288:3G0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3fgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T160452391AE5509CAE34BC3F4D0F787D1E9E01FC272404E6B57E0B9531EBCC9A6A9846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9fa631e7541ea1fc4b929f93cc96c67bb5fb95e0b269d7d57624d74b0355448d
MD5 dd4761e606e0653fdb3eb3fe7cf8802e
SHA1 5defeb18e3b20f3ba10c7c9ee6b780167a0f46c8
SHA512 6edb1da3d74cf6790ba48ea0557989867751d2de362a4652ff01477edc092a4dc6795f305f13ca6516ecb8e7f4e439740175c0264dd43a55b6a81e64418ab500
SSDEEP 12288:vX0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vEgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T152452391AE5509CAE34BC3F0D0F787D1E9E01EC272444D6F57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 648fd28921eab47a6535384200deef59b1e9ca9bbad1adf4feeed6633a60944a
MD5 4a5d52a205e72e8662e3a20733202b36
SHA1 70becca0bea4e8593cbf66fd769f14ff247f2625
SHA512 8ddd0857fcf69d70dd22edba8a5ea1e1bab7977e8255e6b7c0f8db18d5322f40de53f032d769cef3a4b01892fdc7eaaeca7373b1c9295aa5fb1dc83e36e8d886
SSDEEP 12288:5u0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5HgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AB452391AE550ACAE34BC3F0D0E787D1E9E01FC272414E6B57E0B9531EBCC9A5AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 24f4c8845cbc33a527462139a96c7a9a36f33cba9a684a9cbf7112a624a74012
MD5 352dd9d77b4404ec0991c74f068c0b67
SHA1 eb746bc90da273f93e763c17279e7a8e4528526d
SHA512 3e1d6880d27e240897964a663ece6a7c6a27e5b1e052314e20d9a3c54344cc01ab71bf4e40ef3bef590207f13565e998e2485de4c8eeeb04f97ae9afa1d50246
SSDEEP 12288:vI0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vpgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17D452391AE5509C6E34BC3F0D0E787D1E9E01EC672404E6B57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 a557ba29caf507a394b6941c38a0afcce576493acffff4058018696c93687add
MD5 617b313820e1ad481ad3b3ab1523707f
SHA1 02b0d6ec888748fdb1300d2566411893c9308a35
SHA512 7fdeef17fb969bdf9b4d70962378c35b90887af09fb01f14dc7c68d94f4f105cc11b644772560af8159ed562122ae547677d34bc299361b83c1d99cc36c72c4e
SSDEEP 24576:Efwvok9RX6wkyAI7gXe4i7ojhsP5Lgrk1TWb4AN5:kMnYIie30jaNf1TWbdz
TLSH
T11D75DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cda881e69b808657e16bdbbd07881449b5016d34fead84cc65d28c092d235638
MD5 169839ea8185932c8f0392491ec80143
SHA1 ad727d43c2a872046a64ac7f9eb03f635fa24982
SHA512 4caf5bd930a8da0c210f3954f6df13f762451d09a87ba44fb29fce776af8e654fe8cdf0b1676f738a1e953ff4a7da3434a7598f766c364e5b353d078c35ac7aa
SSDEEP 49152:cYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03e30jaNf1TWbp:CySzP/U023W
TLSH
T116067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 495853dcfff80f326f19c9357bf1062fde725523dbb739debab8b09e7afd823a
MD5 60d98abacc6e8ddfb49138cb9d7830aa
SHA1 c7ceca0f868ab908f63ec5d7a8bf0d4100e3d8dc
SHA512 35760c4dc57229e451c79dbe07dece94f2eedf233bf240ebbaee0fdc30c39b3dc0d15b32d86a00932b806645adc08b10872e630c92531e67285a9371532f9de0
SSDEEP 24576:r47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYugXe4i7ojhsP5Lgrk1TWb4AN5:r47JUQj1irIhCnDHUPfF/He30jaNf1Te
TLSH
T12265AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a7bf9dccf55cbdcbb143204b6e23a02dcc5b1ec1c97a1a166149fda691cf3f01
MD5 ec57069af67578175f26d0069299c2a1
SHA1 11836a4cb98098c1df1f748fc16dc083a3f6b5d0
SHA512 f484ef6670b591c5dd566a837b09e1289001210dcfa783cb7a81a64969c9cbc36075064659017bffb38dc59736dd8024b4ffc1be256d23c54deae55c089eb0a3
SSDEEP 12288:ENsf20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:VvgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12155F15AD29802D8D05E92B5C3968A81F3733C5193E1C7CB13D0F93E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 1db8ab9f232ecb924a44239bc9b038d3bdd6445dc1a88d753e4b0f9b56abd0b0
MD5 a595c38a7b1e8205829e1591616db348
SHA1 c946a64800f0929604d43f81c616920a5941f8df
SHA512 a3c3ed47dc0d26d44eeadbe5e3b0bb5158ed7b1ef0011a171c80e225c782c3816949cfcfa9d79b0656ad2601447597dc3bda218f1cc2fecda179c3fb17714f20
SSDEEP 12288:WtGtU3ftoCyLmKW0KBiCg5xzCriAJGZz2VUWRYrmFlISR7tRMtZMX1:WtuUPtobmKW0KBiCa4GZIb9McRRMt
TLSH
T1D2353810766ACB4FC66940322E33D6CCA7707D01EE45AF0373C9873F9576659BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 f789e549e4e260fde44202aa83845f06958e41c6f7d1ad0dd48faceceef34208
MD5 72c98e3b4e39a5a9211d9444e877c188
SHA1 74918c230489465e0e0636f601cedec04c277ab6
SHA512 18540348a764f17e5a4e743da31efceb5ff279b73301b706844e86d8b4dff8b1e89660192a46abf5c7d0b2dbeb059046b31de0502c09aafd832cb69869daef69
SSDEEP 24576:cmKW07Bi3R8mKW07BiFmKW07BiiTPPKleI:cmKW07Bi6mKW07BiFmKW07BiUKEI
TLSH
T13F65D8416137E28FD1BA6032073A5B4C67A4EC17B7096F22B3C9453AD82BB55B0F97C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 187c5828f9d462d0507113e4f16603167df919368669a2ae4ccc47d0bfbe907a
MD5 aa0af3acceebbe51b923acd0053ef96c
SHA1 25634421796f36c4ea70607c09fe9761cfcc6a87
SHA512 06bfda9ccfa4ef27c82d501a1fa4130929ac106d76046985c4ad6cc4741b9556f47e02014657addd7fb1a2e1b1033db0c4ce71608b7e2b9633157d418266910f
SSDEEP 12288:bM7e0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:AXgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DA4523629B580DC6F29FC3F090EBC760F5A53EC0670089EB96D0B69319B8CD99EB451D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2c6f8ac2b683a55c5d8ad6e3ca83913fcc248731288d1868384131c45af948f9
MD5 ac57eda60fac095ab45cb295c226ea11
SHA1 39d49b55a63a9ecce631b13b8a7aa8ff97bcdfc8
SHA512 08ee681b57b02a45db0b0d4623ca55ce8cbe712382488cebfd2c1cdba60ed5938961c987bf31eb6d80922ae74ecbd8949f217e1bbb0a91b7e7f69a069ecf9078
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYVgXe4i7ojhsP5Lgrk1TWb4AN5:Qgb4mBIBhGFhe30jaNf1TWbdz
TLSH
T1C465AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 4dba1c5158e34814b6b7017a8bbf519a97f2a5ba488f8ff1cc8c723eda797577
MD5 926c61f40f793090a35a3a984a531de0
SHA1 61f06927ac36659476ad94c8eb50a5cc7a7452ef
SHA512 051d74092d5335f75dfed4d0bd26456c10a38805c5106c4bd8bc185c955896f573afccfc2c5ed723e2cc73177d1107a7d2b88190a8939b89b4bcb4a9e62220a7
SSDEEP 24576:bG88u8FpJqH1bzria7/m+gXe4i7ojhsP5Lgrk1TWb4AN5:67ZFPqVea7/4e30jaNf1TWbdz
TLSH
T1DB85F16577E101F1D07BD138898646A3F6B2B8111364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 01ac538d2fcabe619de7c8e6420d142880999d86e989a5a8213dd2d40d78a261
MD5 56ce2320207e641675fff2966059b73d
SHA1 f443532175e40d058ab9137e813e10bf71898587
SHA512 0ffddd7212b359933bcc9e496b92ed3ea4e3f53dc08c21e80a914587ebb8b8a73fba22532d471259046d6b24661f40611dd66c3daead9d36a8e755b99bac272c
SSDEEP 24576:rPUr+NQygXe4i7ojhsP5Lgrk1TWb4AN5:rJQle30jaNf1TWbdz
TLSH
T1C765E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8efd6943d2af63df2914a5b95c05cecc079c0863417b010403fe47a6f2a509e4
MD5 10821f51b064b339113e49379a5ac463
SHA1 adee4a7d6af9bdf6d1bca6d10d67e4f5b64c83ed
SHA512 91cc8952c8dbd7185f1cca9f282a6a57e1a865b988b1d55554fecfe5b02dfed652e5be02ac0738a600704a87b6c7cbb9d0c391fc0eae3dd94b0cc026e2204ad4
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVe30jaNf1TWbdz:cG05lO43b6U023W
TLSH
T128D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c07703b4d7a95c23d52acbbb75de7577b43f2bb92c7308e53a7752b02d0d8a06
MD5 2e2104fe8553478248f1785b1b6767e8
SHA1 b37e0525f465c293681e7685318e909dabfdc4e0
SHA512 c342d14d1e3e15d4ed7c634497749f67a79fca2d29461b8947f54e55e220e360134932c50a44077caf12e7c3a69d0d3afbb6f57c935b7ab8e923cc9f5a6f5790
SSDEEP 24576:ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnQgXe4i7ojhsP5Lgrk1TWb4AN5:qa5POZ3+Jt2pasx2+m9e30jaNf1TWbdz
TLSH
T17165AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0fefa3bc51885122285bcd139996bb46485fdbb9e13ed2baf57d41dbfe1b4899
MD5 a31892cb6365dcbee5aaf8f11ea1e6e8
SHA1 5703d6f13bb68e8b97b7750ce43772c1fb9d39c9
SHA512 54da95de61e84d364f4fffc1ccf106eb4d74c16b7114eda5a665ba4530357f95cb3e242235043996016d12bd82d590aa6ccf79887c2d034b4d0eb8a1f6bd32ad
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkWgXe4i7ojhsP5Lgrk1TWb4AN5:4Nc/zEOVHFYe30jaNf1TWbdz
TLSH
T109858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f8a7c8de517c61b68848caff403612c3afaee7b676c34aacf8ef6ef12e80bda7
MD5 1a2e99eea7c70a00667c1ffc4533c784
SHA1 f9e4708e80c86f70e0ddc34aee73bcd1561a292a
SHA512 3fcf1f366882651f2d965976249803309257862d66efd1cd12f728983287001663b69f64681f06b6774970ca9094ea2dad1ee7c3e924cde8ee8a74ce14c826f1
SSDEEP 24576:b8kNvNnaFeYhJNtmZBm8gXe4i7ojhsP5Lgrk1TWb4AN5:b8MwBtOmTe30jaNf1TWbdz
TLSH
T1BE55AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 64517a67faa3005b7fe13d01f5d7e164ad9794239db7f11893cca40a9aee043c
MD5 8e5024c4c2048322e6ff0bc2e6fd1f86
SHA1 4bbe36fd29b861f094bdd9be8c3cb3182a9aece4
SHA512 0d54e730ea59e179880d179cfb82073e17782d3399332db43280b37ceab110b2342fc81a45dcedbb40f22ebd7aded650e667ec66b55dec7d0f0f7a8178c3594c
SSDEEP 24576:iD3FHshBIYQgAzgXe4i7ojhsP5Lgrk1TWb4AN5:iDVHeBIAAKe30jaNf1TWbdz
TLSH
T12275E17DEA5C04E4E57BC1BCD6A38A06E77138A903215ADB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-101-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/124-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/124-311-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/124-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/124-107-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/124-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/472-6-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/472-0-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/472-76-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/472-8-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/472-1-0x0000000002530000-0x0000000002597000-memory.dmp

Download

memory/1472-14-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1472-22-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1472-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1472-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2120-133-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2120-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2120-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2120-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2120-135-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2848-267-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2848-72-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2848-67-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2848-64-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3084-77-0x0000000000400000-0x00000000005C2000-memory.dmp

Download

memory/3084-83-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/3084-280-0x0000000000400000-0x00000000005C2000-memory.dmp

Download

memory/3084-78-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/3104-38-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/3104-45-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/3104-39-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/3104-48-0x00000000016C0000-0x0000000001720000-memory.dmp

Download

memory/3104-50-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/3424-221-0x0000000140000000-0x00000001401FA000-memory.dmp

Download

memory/3424-53-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3424-59-0x0000000140000000-0x00000001401FA000-memory.dmp

Download

memory/3424-60-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4100-88-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4100-294-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4100-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4100-94-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4100-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4100-325-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4380-122-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4380-114-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/4380-310-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/4380-116-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5108-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5108-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5108-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5108-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5288-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5288-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5288-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5288-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5288-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download