01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Size 4.3MB
Sample260805-l2jhtavcqa
SHA256 01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b
MD5 b439dc2e1105384179cd1e427b411acf
SHA1 02223fcca6029ea9eefcf59fd380027f20f64d95
SHA512 960d85030abc34cc5f567aaf3187eef49129e26dbf9845bf886431d89043b3abc16e84c4a5484077f7bee7f2fa7a923db068c5389868aeb16905217cbaf7eda4
SSDEEP 98304:zyvdHlud3m86VO4zCRSSh9hNhroFk1GXFv8Lm:EFO4CcSjPpvU1kL
TLSH
T1D026D012FB8180B2D8530271966757FA0E3BB910533AE9F3D7942D3ADE212D16A3F395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3124	elevation_service.exe
5900	elevation_service.exe
3028	maintenanceservice.exe
2596	OSE.EXE
5336	PerceptionSimulationService.exe
4868	perfhost.exe
5720	ReFsDedupSvc.exe
5184	SensorDataService.exe
1936	ssh-agent.exe
4240	AgentService.exe
2000	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\System32\vds.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\msiexec.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\wbengine.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\AgentService.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\vssvc.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\811e802583806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\System32\msdtc.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021e30db7c124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b8d4675c124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000759355b7c124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074fcd776c124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002797f275c124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3124	elevation_service.exe
3124	elevation_service.exe
3124	elevation_service.exe
3124	elevation_service.exe
3124	elevation_service.exe
3124	elevation_service.exe
3124	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Token: SeBackupPrivilege	5720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5720	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5720	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5720	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5720	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5720	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4240	AgentService.exe
Token: 33	2000	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2000	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2000	SearchIndexer.exe
Token: SeDebugPrivilege	2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Token: SeDebugPrivilege	2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Token: SeDebugPrivilege	2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Token: SeDebugPrivilege	2776	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Token: SeDebugPrivilege	3124	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 6080	2000	SearchIndexer.exe	100
PID 2000 wrote to memory of 5856	2000	SearchIndexer.exe	101
PID 2000 wrote to memory of 2884	2000	SearchIndexer.exe	102
PID 2000 wrote to memory of 4604	2000	SearchIndexer.exe	103
PID 2000 wrote to memory of 2888	2000	SearchIndexer.exe	105
PID 2000 wrote to memory of 2552	2000	SearchIndexer.exe	106
PID 2000 wrote to memory of 2808	2000	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
"C:\Users\Admin\AppData\Local\Temp\01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5900

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3028

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2596

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5336

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4868

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5720

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5184

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1936

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2884
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4604
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b70286809a828e7d1e778b9bc86b5cd2a80238d82536eb688f68bc66915383aa
MD5 15b886ec73a7465894d25b6023bc7ab9
SHA1 d709390efe298e7c452a23bb7a716ab242ac1d4e
SHA512 3f13480bfbde86f9429a9c74264941570ed368cea75525cd064d846c10e6fa540261ab05ef3190a5c6d8f4471f9b7171d9ef5f52ee7821aeda7b740636d5d39b
SSDEEP 49152:Ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxnIQ/lFTjN4:Q3q6HjB4Lm
TLSH
T1B3D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 68031a0a13a2f6eaae862ccb64b3aa305d0a6f30d1dc6e9217d0766c2f2d3a43
MD5 4b2946363bb5a9e61a8b6f4a0bd5228a
SHA1 4ba2038d7675a2d0e68850b7dac618fffabd03db
SHA512 face11b5dfc2233aea7ac51cfb5c3d0d4ccead57e9b50092a097f3b5020d9b2fe525c75cacd676bf002da5cf8e2b2a49740711067cc8f2be9e4d18209168570b
SSDEEP 12288:t1XLsswWkxy2lRq2czAnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:DXYfDtczAHnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1B465F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f06f1f483ec3cac8ef29bdab3dcae294d3abacef1d1e293d4e481416a3be5b69
MD5 ead9196faccdf1995967fd024b6d0d8d
SHA1 8367379691dd3df50e81c200b366d17a26867e25
SHA512 c8bac62cce1350d6d93f711864c133f9a6ef88cb5943b512e538991151f31cd319fa39b8823c69ea9e68ca6c65106ba9212cb3fc744aa19193367d57b0f3e518
SSDEEP 24576:10Le5ji0hmxLrMAnQ/tbw/2Mkjy6Fr7g0o2:1Pji0Al1Q/lFTjN4
TLSH
T11C859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2ac20c8be91f32e4e572af2d812e092172caf567f9574995b0bbd40e158cef59
MD5 e4c86ae17c9385eaf077cf8125cd2dc5
SHA1 2df82f29b3221fe0c05b217c7e5b79eff7822308
SHA512 feabaad2da02dacef9c236aa1219b4bd66b57981ff75621323a21cbc7992e60a2d985e57b2491c99bcd7dda7525448404226ca283bdb9358c615b9aa3f4f6e76
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWE6q8wyuinQ/tbw/2Mkjy6Fr7g0oK:3/ezSC6vUzPvxHjyJQ/lFTjN4
TLSH
T1A0755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 169f41e03924b476d70f10cebb150de4273884def71cef8b5640b86187187ffe
MD5 3faf665c4f478a2d8bd15a369eb03169
SHA1 0038628b5cd5b13c7ffb15332b036d728be6bffe
SHA512 b0a2ff803e648cf68e1e23279a2bd271b010fdd1f00e080044fbb2c29aaba9450a918cc5c00573c458599f688f512ea1fc0210a3d15123010535fb3b41300031
SSDEEP 24576:vVbqPb88hv/l+6jnQ/tbw/2Mkjy6Fr7g0ot:vVO88hXl+0Q/lFTjN4
TLSH
T1EA559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e3afb205aa00b817e26df5f2ac736d179451c4a9e7e405a482a3871e2ba8ebec
MD5 e0308e3b79e2d0b0bd26638dd0f7a287
SHA1 455a6d2a6dee8f4b755e0c01f3b7ea73466557b4
SHA512 87631dd030a6e70a4f93a63c8104bd822f54687442192b2401cf473004e575ec8c4172a498a2dc93a53775d825fdce6cf8738b95d7b245fb4da9c101e5d37919
SSDEEP 12288:oz8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:oz8nQ/tbw/2Mkjy6Fr7g0om
TLSH
T1045523796A24F897FF2B06B15CC284826B7B0EC1BFD4AB4E6744362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 9b9d16e60b45f786beacc35204e56ed6cf0e7f66de8443f09e632a732eb08d6c
MD5 4aab43b4706c0a92d5de714be725f6f3
SHA1 5802c44632f86c2dc3d820b348d0226cda4d99da
SHA512 55c70208214a464d627be63b86e36f6d46527f2c1b0475a41c023743b71b1be48cb8b7ea0d8996840568b5a38ef8a8a856bf0fcfe7d9bad00a80a1a11fd128aa
SSDEEP 12288:zeBNUbTVO86ULGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:zJIU7nQ/tbw/2Mkjy6Fr7g0oH
TLSH
T16475CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a5b986ba32f44b12ea9838936123ccc09f175f9dfbd9073ca05aa86504af4edb
MD5 bd278feb5c5802f96d184c2f3d01b02d
SHA1 9fc1ffc60567a83fa0267e038eb3c42224b0bb84
SHA512 1f20f71a1489ad903a00768bb9d1058074626fd43b9ae79ea4c01dea54d90190b4378c0b6d1c6d363c5c7929a34d9a479d420584a14f6c275626e7b24b957ba9
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:aQvGAdlCEL8c/yRNw5C9Lm
TLSH
T1FB267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 73e45712654abc7a462b9c57be6a7b1fcb2bfee7613f918b7ec34f38985ea810
MD5 32f0c9ef9d43548ebfcc49703eda0e62
SHA1 dc9d5fab0c474fb655d412f83a9e94820d4ca7bc
SHA512 15187d5478ab9423a9c788af8527513631897193ac00658fc9156e806355e2534a67b5096287bdc22c7ed317350894c84ce902fc13e7cea7212bab3298f90a50
SSDEEP 12288:+AwSfxL/2Dc39DLLmt0LDQewsAjlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg+:jQewsAjFnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1DB75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7c4d59afc726609c65d33d2bed958680d3cdfe90f2969bef0a0e828abf306a4f
MD5 0e35f870491bc6ec3a3bff843ed74a5a
SHA1 246b281aa4a8300fe16af1a88ce0c436817ecda3
SHA512 3dc4f34d367af52d45c27c500b998a307505de40c5d69876c73f0e8ae8b7732494644af0b2b8307a8d4e2d6403de0e51552d5b49e56ffabd7ec15c70674e6be1
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHiL:eUEtQevvqc2W1cpV2EI32
TLSH
T17A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d94097fae9fcb98aa9a8c447bd60f3e955630e4d77db2067fc31a1db7af79b23
MD5 a88b086fce1616605bdc32d97c80086e
SHA1 70950d1658b0c0e47da4732edda74b8ca4964a88
SHA512 89063371fc24262d8cab6dc770e840bf880450c3091a92d847c1b4d7db2fb56ba906022de2fa9550c8870f56da39e9ef607a4b302780ea0592347dde547727d9
SSDEEP 49152:dCbRquA/m2yL5zQfFiV+XenmE3/zlQ/lFTjN4:aoqtVjnmhLm
TLSH
T105D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4cc1f569d0a1863ec65970090a2fe102b1abd2e6583ed3a01de0a497db49d68d
MD5 150e4ff06736de61e54f23c2cf163939
SHA1 7cc1192bd5b51b156d6b9d4a1363d5b04e1d01ed
SHA512 7a0cca0cfef3a79fd3a3bc4ae4ff4a82e5ddf8cb70bee8df10f04e0980ea55e43f624eec3dbb25e1e8088aae03b8e9c3b0462bc137dc20ac738f9a07316d0b1e
SSDEEP 24576:6AhGLJIFoiwtA5l7S532nQ/tbw/2Mkjy6Fr7g0oJ:6AMyFoiq5mQ/lFTjN4
TLSH
T1EE35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 312d640797d89c52a6727baf450f633a56a45fd6419cebbf329a81ae2b6d88a7
MD5 f725c5f53fe012b4d421d22264b634e5
SHA1 456c2771b0361bcaf3819141570961071e446609
SHA512 18589617350c1323a883b7a79dc120d0e208bd42ae57df1e61325266b7eeea7b5274978bd2cba64613a0e60b54e7b92ec554b0e18d2445027300cec20e575027
SSDEEP 12288:dmw5HEjsChN2BFgl0WDm+CCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMk:YwuHOWpnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1EC65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 bffe6fce31d63c790ee53b3dd0bfb786fac70cdc7c2fbe18f742178ea0c1d1fb
MD5 b19d1a538e1981c54be3ea0fc4194e96
SHA1 b13d845bf324267cdb7cdac1ad76fd5183962967
SHA512 a12ca9e635060ed88594872ef95fd2c1ce2f32214f27abd2d3a3ee8f8e68df92024848983d8dc212549fdabfa254bee69a321c4fdc783c880fc43596e1189d25
SSDEEP 12288:cXZ1Iy1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:8ZuYnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1D955126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bc3f0eeccc0a67a718c85fb41e3d52f0df644d66b1a6129755d214c4d65d6ad5
MD5 c8c00e68d9e61593519276725a1cd824
SHA1 6724a6a1b9bbc7f8258e2f479b57bfa7d0306e4d
SHA512 da8b93252a50d546ce1b8dd5cd8e2f544073c304895c5763dafcdf466533419b363eb28b27a559ed41e733d9177b4b9e82316c2f09e5d0a2237caf224f308276
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:hQRQyi36YOcPQLvw2gAf+PN3ULm
TLSH
T1D5666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 564d4d4b3b658f6ca7d123cfb2929d5f587d549be1d1c76ca9ac792c4f170eda
MD5 d4fcaacceb0812e750df5a1176cb160d
SHA1 feffa2fc0a4caeb95f3e23cceda75d84884b371f
SHA512 1c0129ff235eb9f60244c2c6870338e21a78178f9a3b5f6c23ed7c1a9c0c1e36b9e126397d9e65db860bb08ed68007044b02642d4cf004209aebe12f2aac37b5
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:kQRQyi36YOcPQLvw2gAf+PN3ULm
TLSH
T1C6666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 61c39d9dbaa3929e3961f8408c43153a7f845e6c69310148e0ad140963f19a34
MD5 a411fc7d41b35721b37c943c009245e0
SHA1 ce3fc11db4348b25d09a067b3ef5f410080f114b
SHA512 18ee96978ba304a3ee1d7bd45f336f47fdb7a2953936982ede24090c4e31d5d398adc6178261903274e3e23cb87e8fea1ba8702cce2401e68391159a8c7dbed5
SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0InQ/tbw/2Mkjy6Q:I68Qg55nhheWu7PNU3/1Q/lFTjN4
TLSH
T130B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 925fa32a619843bfe7afc5ac5f60f487bba75819bc508cb6455f4e8bde3e52e6
MD5 78480abf92953bc8e60ce1245bedb022
SHA1 d324c464b21a45ceef1d4cb18b56cc0b862ad406
SHA512 fc624fca5d9cc02b92d5512c1b2f17437a2e94f077dced22c8d73d5beaf177731388ad33a38f69152c3904f7fd9596744f26cdbf53677a3d5cb86943b1febf4b
SSDEEP 49152:T3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk991:Gy5112gYy5azzVvL69nLKnhZfLm
TLSH
T1E2167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4da021f0313d01970d2e08178f6e2d541714f69a0f5a2336b131214565243bc5
MD5 39a69fcd8566fffc6834708a2d3a6dc7
SHA1 a8753822a305d7b988bdc45e7a8633e8ecca152d
SHA512 3bb699b2bb99e9be9ad0bb12fecbfeffe01906cb248d999422f03ddffc35955ac5193067907395932c770452e76f54849889f953869885e015cf3cd4bc7c971d
SSDEEP 49152:SB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl3Q/lFTjN4:gu6JmVxd2dcLm
TLSH
T149D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1df3cf49187c1f214b11cc442d611e41819bbed0f206b9a3b1fa23f64b8f0162
MD5 92abf2e54938f4049d2ddc7b4fba6f46
SHA1 6c8753924b1386cfae9af0529f97a717e2e58c68
SHA512 ce967970ff28493f90e995af11db4ff7d45603acd9c1fb10c65596dd46cd099f7bee7b755c61621138db802c4aeec747f0d079592c5edbd4b84cc90b866138b4
SSDEEP 49152:J1hpsNoJpF1A6UU44CwH7R4xbQ/lFTjN4:JmifPbRhLm
TLSH
T1ABB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e3280b97f9c84bbafffed022bf0a3e4d2063cf8b912062469e90463fd947c98d
MD5 e8bae07b7b2f4b49c7c48e91d172e00e
SHA1 6724ceff91a5c2f3b6afb10b00a56e0ec67dd303
SHA512 ad067de625a7c595ba42ecc6aa8e4eee962a91e07fd838fabb589b8495f3bc10a8501f839bd78e0bffaa73c02f97fe705aee748c5908b55e03e2146310ac9bdd
SSDEEP 49152:LSuZQIY0Be2KRRVtOnks6NMHqYQ/lFTjN4:Z5dKTi617Lm
TLSH
T1ECC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9e2405ae64d832993a63cc3c2949add3264d81d3c339ee6e908a731633a2ff7c
MD5 3078ce391dc22cd10ea639010b1e3ed8
SHA1 e806a5793cb9fe4038363914ce22476a4b565239
SHA512 414398bf13bd3eb6e83f0e0be609209e1855d031d17ce760a07655c080099c9b5f476bdb89b5c411da57417b15c57e53e34e9f6b56efb82d5406f1e59ff7d1b5
SSDEEP 49152:RhtSn8EApI0figngiDn0AP5wHQ/lFTjN4:AX2iyphVLm
TLSH
T1B695BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 79ed9f4d0321593bb0dab86b10d83d593f0ccb0442f23df7291df3c29af514e6
MD5 5595d6138f491b6b2a5b3db410fe9f08
SHA1 a8789863bf53abdd9150e1e05570efca064d6820
SHA512 c2cdfb0e41fecb618880cf77f532a5c2629b58bd1011e3b914e5da860493484b54d93866f82a50f9d892068d1a007cdddee2955891ed26cba0e5d69bbcc6beec
SSDEEP 12288:iUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:i0nQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1505523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 bee19d0d0700eb916ad856dbfb8725e40a339cdfd6e13f69a099c2e0ff072b7f
MD5 25602d803576d8850e3c111c618e24d1
SHA1 ae4d7fd51f2bffe599c477278fe7a8c6bbb9e7a9
SHA512 ba930de13311ac5cd284365f4aabe895bafc51bd5822b800651ee11cf16420bd96739dec3bee1a4171b0a0043dabca7e089a79f5819859c21a4b09443c9db95d
SSDEEP 12288:dhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:dxnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1755523797964F98BFA1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 bac2f12a641e7ee9d9d3c3c3e398f4f89736c6eb302abb5b001a01c1fbe165be
MD5 34b80c80891fc3b64ce0b0e21106c37c
SHA1 9903c4afd804710552ed9498a34b42408fa6ed4e
SHA512 158ed349dc76880ec9fb9997ed752e7b4fd062e7445e8f359ffa10b633b1b19c24b50b40db80d913b322e53df4b7edabe942e673999d27c2fed3127dd2ffdafb
SSDEEP 12288:OjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:OTnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1995523697965F98BFA1706F14C8281829B7F0DC6BFD1A38F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0b2bd85959e92d366293ba818aea303eb29abe7ae2d298e548837942a274c104
MD5 c03be2095e72916e996c01f7ed7379bc
SHA1 30d9a7f34309662096c8e426eb57d0beb7192978
SHA512 8b3c6c3f8a8028cc00da5b859074ef1085c7c6da6113e6fd840b5f77c877ac4cd5231673556b1fff6e2b1201910ca111e7e42cd9171d0da57fec80e827e5ce49
SSDEEP 12288:KV2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:BnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1315523693A69F4C7FD2742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8b61b9f9422a97990a029c153e23282f3d9645874dd7b335a7838a10822dc25a
MD5 aabe004a474a54cb65e1e39810138511
SHA1 ac53810809dd0436b75a0d308fa84e9c584e2c0e
SHA512 3c0295acc6aa11ca913d18ecb9120e30be0dea7cc609e8b8d8f012fdf39b3221086c90c87dd92399e29254a30f5feec0f5b638503a0ca177fed83499421af35e
SSDEEP 12288:EeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:EenQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1A95523697964F98BFA1706F14C8381829B7F0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3329d778feefbf16cb45bc609b13a3fffb5cc9651f96e3db400078ced36d3cfb
MD5 615f4a33f90165bea11a8ccd9baccfd1
SHA1 bf326d5474d7b8992ad3d000ff445b65f7176d86
SHA512 e299917266135e26fa39d9673a43e9184bacace5a47985f0f3ea7736bc5acfc3a3142f1463e95d65e51428daa0db72bef01d293f754e1aab53e80bdf36960964
SSDEEP 12288:wdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:w9nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1EC5523697964F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e34f1aab2e435533104abb79a93933f8c3e6832053b94c1874155a5814e66e2c
MD5 ac766adb9d94f12fb4c7b2cc5eb0a1c8
SHA1 47a64ef264521f67770417630b39e7e108f06dd9
SHA512 8a95bbe3594184e10d769ce03b634b1e44800b77531708148b300d73127c96065eaa5747c3bcadfd6d3984f479a84a3a7a0a62521c797731a484e2d0a50678ed
SSDEEP 12288:ZJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:ZZnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1DB5523797964F98BFA2706F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 74125db9cfead6fde1b2a1bfa48057a5e51a7b28d08fb8cddf972c9f80eae06d
MD5 4bd929ad12fdd48013e8caaa2ea83788
SHA1 767d71e9530513e6765baa147e289e58b122615f
SHA512 16007d996f49b86c5c0774e4fdedf8de4835a2255addd6ea04d6e6401382b8527c9675266bfdb060442f5aa08e3cc7e1175ce2f12d4c41ff2af5f5bc1e390a6b
SSDEEP 12288:MiZwbDzzFEoS2cPvyBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:vZM3zFVSORnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1C07501A5B39058F9EC67423ECC518906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2404fd031529af3d0cd5eb40f4d57348ffc485b513ba722751ae11ebe65df68b
MD5 f40360b370c856c93b648426e4321b11
SHA1 06447d1ddc40abccebaf65c0e4b23f53fbd1193d
SHA512 6c4c5792a79d294617aeae1c51319faec8ebc3e90047607405216d538d14cb7dfabc2d5087673242385f71ec1ea8474d20d8a999d8ae63be96f0cad547706e17
SSDEEP 12288:uoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:uonQ/tbw/2Mkjy6Fr7g0ow
TLSH
T12E5523697964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 988033b78db4a7cbd7fa165971f57c1cce6ff9b93c5f20a311ab45b5c04cf6a7
MD5 4f9d2d947a5eb9b0fd473f4f7473eaf3
SHA1 b926c371a80b688898fb761bde0de1e950aea4f4
SHA512 40ef8a2eb8a9ff6af5a39d185c1c24c75ff9f1c0833d14fb6394374608bf5002d40c2272c4410b5f00021e1abb7d006eb8d1a3b2834b2f64a50f5849e2b9bc09
SSDEEP 12288:MMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:MMnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1635523697964F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 bdc4914c3c1ac517ec300117dbf9bf12312f38f6f55efe7941051bfc7572592a
MD5 20a61106781dbf2572168841109277f0
SHA1 8639e07a81a641b40fbdb458e5f90ea039295230
SHA512 8776765818d364488c231bfaadb5d48197771abd50e6a47d10bbdfbc0541c0ebfece7149e4bd7a63af42e9e88f79c53add7bdaaaec311baefc60efa6ce99634e
SSDEEP 12288:HyPz5L81GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:qzyVnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T13065021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b9c5f567a5ac9fa35b05d31de46277cddaa8f57fbb25391e7aeac5cbd6517b38
MD5 59e191b015168789cd4db512c847b163
SHA1 22b07774e1a3af136ab81cea98f5375bb6084f85
SHA512 2a11f48695a0af046cba11e68e11814e490e60f5f52d3067274809b81a1ac5faaf6cb45bb1e127c674930a2327d96e8b753e850327611cdfb12a85cbd970e1d9
SSDEEP 12288:xoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:xonQ/tbw/2Mkjy6Fr7g0oz
TLSH
T14E5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 67dc02c9d3bb6cc7d4c1a037c70f9a43b5ba1dc10e7f44907122b5244e54f20a
MD5 f9ded3115d6cd578353aabae33c12f2e
SHA1 24cdeb9a74923502cb9904b5379d386aa65ae51d
SHA512 16ac831445b98c044a90fd9d9f01ebd031c85a6dcb09ff06963d3ce9ae30f996a10a1bcf5c5954cd89250321edb80dc9fc6d7dcdddc820e7995c50ba6cfa0295
SSDEEP 12288:OoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:OonQ/tbw/2Mkjy6Fr7g0oz
TLSH
T12C5523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 cbcf716328e53e98bb8a8935af411daced3429adac02f6245c3f6107b5f83594
MD5 ccbe57eb414d6739ed5b18a4ae395258
SHA1 647c943f6d7427b0fcc58c761293bb268d73ef8b
SHA512 d1f80c9074d3e89a1085d283b4381fb7511b54c6f69b4cd2bf6a7d19b1ccdf546c10544c3f1d5908e74fdda0f96b45e901021e90361e66d3f1a1c7db14795bc3
SSDEEP 12288:ayPz5L81GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:HzyVnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1FC65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 d84176d20814376c169ee8ba1dbc3872defe3f24280c3de402e9756307c9f35b
MD5 0fdc242b4da1db3891661d360168d3f4
SHA1 272d40f6276c6ccc3281bc1459af34a783b2baaa
SHA512 95c6e487b748fbc6ff521fb7b2c1b3c611b0ac8df1fd0378f9968b00c1aef685b6153e26c80fbbacf8c89c0066ead2d82e6d0e0bfc26ca454a28eb91f4f557d9
SSDEEP 24576:cT0aLl3z0zDDnQ/tbw/2Mkjy6Fr7g0ot:cTDLljiQ/lFTjN4
TLSH
T1287501A4B35058F9EC67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 056bb5ad8696c1c83a141668b23bb58c116d1fb7111094b19f766dde058dbfba
MD5 8e015d2c705dde026605c82a957c51e6
SHA1 49a5601bcd7da36cd6e9ce66642e185c31110afa
SHA512 745579710c81afebf10029b07e7bf3485790b3a85d02ecff06a5877381c35531bfbddffcce1d4672058b35d77a69bef2aee59d5d5fb7246f55432980b1a7912a
SSDEEP 24576:r31d9CHKy7GZ/nQ/tbw/2Mkjy6Fr7g0ov:L1d9CHKyaNQ/lFTjN4
TLSH
T10D85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 cc11c3ed637dcf6324c1210f3e4d489956af994631f5dc17cef7d836509439c0
MD5 fa1fb911d68515e89f238643e1e93ea8
SHA1 ea1612bfc5e33404d16432f617765fd9d4ef8031
SHA512 85da15b0dc78da7a038691156c6e9a432a98a6882c9139d1aec9ad48fb7a7919032cc1f6b82eeaf79736624b429742707ead6b17e432bad604e70b953bf526c0
SSDEEP 12288:gDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:gznQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1675523697964F98BFB1706F14C8281829B7F0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 dfe0755aa8d446385427dc3575ba63b717afff0630079ed0b6d0901762b6ba55
MD5 8809cc30d9714f45b05d69e0ec8b7abf
SHA1 2c0d8ab56a83216470a3f7c9ea45f56002c3851e
SHA512 fd32327926db67b1b6c4b5f75a8c177a4bdb56a3b065201eeee9b29d479239e21062376292b7d65724b8ca93cea080b3ac52d3944c3fba2d69589be9ca1ad056
SSDEEP 12288:MVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:M1nQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1705523783964F99BFA1B06F14C8281829B7F0EC6BFD1938F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 dffb5f3616b7236fa4a628abd41dee141f385ba6d3d91aa2f802153e02e39d7a
MD5 346fe595bd32f306bce4b6c7935f4fd6
SHA1 7ea6812f3a1dd37eecf160c32537295a7d6b99a0
SHA512 45a0e9b143bb91966eb8fa50f2d5101462749ce9e82d8ab60c8541b5f6a92c58135bba86c418a66f76f1ebe8015a0ba5684eb8f07c91454ecf5cdcce755461bd
SSDEEP 12288:WqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:WqnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1DD5523797964F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f3f6323b9fe78397de34c6fd18c42f16fbaf0bc7c7b5629e4de26211728f0f4c
MD5 8cd1db7241f51e1a2a8b8bd88df8cf39
SHA1 691556d3041a0d6cd4995ab38da8b63e3ecb3381
SHA512 8d24066b5bec8d84b64778577db200406534afc5daba880f0f8409563ae8a745805a0dadec8a8bfcc901e5a558c0172be3c608dec3a147c41e1b039a7548e638
SSDEEP 12288:HoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:HonQ/tbw/2Mkjy6Fr7g0og
TLSH
T1945523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f86c8801d1123298377a0f09c66bc62f486e001e2d5cd2de3b0ce86504af1d86
MD5 4c21afcb0bd45fa9fe2b3befa552f5c2
SHA1 d2eb3f85cca26c1529d64b538e43c23f07389225
SHA512 f7b938dbc5d3ad4d60d59a96e75489cec0b0aead9d879ddc49ba2a62eb5e26b1acb91bf3efab1e8dafb2a91491fa8709eb9772ab484153cfa86684bf2a9eb0b5
SSDEEP 12288:DDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:DznQ/tbw/2Mkjy6Fr7g0ol
TLSH
T17E5523797964F98BFA1706F14C8281829B7F0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 710875c067a3fb0db7684edbee8c2a36f40744707234ef0d97e515e14abd42b7
MD5 f9859fe29a7c1291ed7c825150004713
SHA1 ea7fcead8af8c29084b69e700acfdb26974f3dc9
SHA512 439ae4f6eda9c9865207e7605c2be21845ff3c3b86f8538c5fa4f31da949e1e2b5d07021cbcb40d389c860d61a1e5e846fe9b1c885d4f9f005dec3ce5b59874a
SSDEEP 12288:fQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:fwnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1285523797964F98BFB1706F18C8281829B7F0EC6BFD1A38F7B481119967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f912fcf3c22e2f92264e9a480cf956f5e05588d834f61657db9b29d73df74288
MD5 d70bd9f20fcc362456c78a725b195d90
SHA1 ac04c40f59c1fae65e87ed7ab8360ae5fe2d6ff3
SHA512 f3945118ef3b9063b3503cbafbeb8eef23b0a6d453bec5926098640466b7c2c341785524b2b9fa6d11a386e610ee25889240760de0249a7eaeae2db2e01b8b19
SSDEEP 12288:UeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:UenQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1C65523697964F98BFA1706F14C8381829B7F0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 17f9b27406028dafcaee33fc283b2981188edb340deb9fe8aea4f438c32194bb
MD5 b383c1d57f90f902a3d0e56f177fee44
SHA1 77f09b736490da3d535fcd5434ff173c6dd64231
SHA512 b80bb65a8bf0824a614aefe985d7fd3a2c0b45283f30abadfffe834c9e221a807a58189eb238b41eb5400b7abbe5e5e53e6a116703749a18a91b58f705c75028
SSDEEP 24576:Ffwv/k9RX6wkyAIcnQ/tbw/2Mkjy6Fr7g0oc:0MnYIcQ/lFTjN4
TLSH
T13785DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4d53a9df7ab3f0aa23ee6fb52da0d91f4fb31a0b0159a40dc3eee35bfc5ee113
MD5 bdcb7b39182446f5f28d251f17cc7589
SHA1 8ffdf5cd8f3ada41a48fdf1d31d4dd9da271d368
SHA512 cdee8779521ca06ef1e6389f8873dc518f603c44366a78a64fd379e4f5973213cdbef1aecf98a23bef8e1c185315840ce9965ac20953b6accfc25833d98a038e
SSDEEP 49152:CYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0nQ/lFTjN4:8ySzP0Lm
TLSH
T1B7066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b7e97042426852c3049c0375427dd64e0606a14544c60395d44bee81b587c545
MD5 e6906ec46c0142cbcf6606385edd14d3
SHA1 cbe71a1057248325393d37a0ed6f882349c83338
SHA512 3abf171968670caaf78bf6a541f71d585f948e96495047f3dfc6758cc8cff1f5ce7dc01e4f9e5e50fbacdfe1c2306526e6490e70db9e171ea58d07962747375d
SSDEEP 24576:n47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYhnQ/tbw/2Mkjy6Fr7g0og:n47JUQj1irIhCnDHUPfF/3Q/lFTjN4
TLSH
T14865AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 359bc005394b8f95e0b2e86060ad83698802ca40bb2feab6d4e1e994156f3f90
MD5 18307f0a335f3b1a920898d332f0d5dd
SHA1 c3021ee40b7fb60a2eb416201f1f75e6efb8f744
SHA512 5c4528954b2a86ad80552e4e7416dc905fa148482b0d9ebd4a2587279536d4d3f7956ee62b817c6ee9d4bd16fabcd8efca412158c78ed3dc301b466fa266689b
SSDEEP 12288:vssfYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:DYnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T14165F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 2182f60e60e14fef609aaee4525dc1999fb179ba2ddaea30f85c851ac2f9a303
MD5 0a8bc3d8d0541921f992260014305757
SHA1 e487dd728577ca373c1087254bde7addfb09b397
SHA512 152aba8f77b60d936e15a2160c08d0ed09ce082a3314c5b84751e33e51eb390211a9d05050d8c6dd286703f9a575f305f4947ce1a789dd6d628b659a30c9bbaf
SSDEEP 12288:nRqkU3f/06icVcBiNwSuB9UWzWobOmsuD7vEBMDyj5Cn:nRDUPXnWS/NuDzEBMD3
TLSH
T115351840766AC75FC6AD40321E36D2CCA7707D51EE05AB0372C9873FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 ded4181508d8fa5e8d37f63ce324c96b6a528a306420938e82db52810a6c43b9
MD5 b38355ca07e87aae21add4719d248344
SHA1 f9ad2727f027667df72a7479f3e2de8890e246e9
SHA512 6241b0b9a0b67de36bc35c750bdd610e63a3c5ca86202d92ab00d6d713ecf1855eca03f06fc1f7235c2fc6b32e07260b3079af9ad8f3bc6bb7c5e2dc05f366bd
SSDEEP 12288:uiNwSuB9YiNwSuB9xB9SiNwSpB90B9ViNwSKiNwSNSiNwSuB9hiNwSv7QJXV5Oij:CWa
TLSH
T11355A8816537A38FD1FB6031072A5F4CBBA4EC46B7055F267388453AD82BB25A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b3f4d57f1bfdc87e1bf18b3bfda3eabb13dfb3724adc20e03dd8dd343a614711
MD5 1c87f25b57d39fbc86cb096575c678bc
SHA1 63bd7ab456bd20e7e90cdbd75dc7be1b57c1c7bf
SHA512 56fda09ae7dd219de5201bb5d359a3b1d79f73ad33baa3c5dc9cb9941a62563d58b550c9327c7d940ebe3ef65d6107abe9eb1a8f1be17781e96f471ad87def0c
SSDEEP 12288:k67AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:vgnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1975523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c688e5280ecf484dfe59e8eccfe12aaa945267b10beb8ea94fd76c28a299c4fc
MD5 1cd0619231fd6768b0b8ba52335b7be8
SHA1 6ec256feec948f9a268f580ea1cd3e525ae4f0ff
SHA512 be40c1aafc54c98f4027b84a6d6de3f68e1a424429dfb2e8535b0e64ca3d41b93eebffa0cef87a01a914cd913d1a6b36ea16f8cd3c01b1bbf34c6d9035c365ba
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYinQ/tbw/2Mkjy6Fr7g0o2:hgb4mBIBhGFhQ/lFTjN4
TLSH
T15F65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 38d7d9f0d2c4adb358e0a06b25f8fd38a7fd8de0784bf9a7845f55a1053a6314
MD5 4555e438b2563f2c0a76d1225bc5d342
SHA1 a7c8e81e7b80eda2c090a2c6959895db0c2e58b1
SHA512 89b76e60925f77bc8cd335e7b5979f21006ae8aae0d592ad434a699c7bef79649c650148c6781905a2ce3e51624b9d121375eab9d7e8a02d05ccd13e96cf5d49
SSDEEP 24576:jG88u8FpJqH1Qzria7/mRnQ/tbw/2Mkjy6Fr7g0oTa:S7ZFPqVva7/KQ/lFTjN4
TLSH
T16585F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7f0d9df4aaf8c4df6bf64f9e9988b569655b4055d1977c6d754e8978de3c4a53
MD5 5e217188d36d06329e94a29d907be36b
SHA1 fe6b7fd13521c2f5b2d3bf676369aa30387a3d6b
SHA512 bc82dfa9aa6a95870c6285280a6f7b13950c6932d8487d603ab283c6000c99a2bf4bad3eb88fb1447e04d77a126f4baa916086e1847d8c0f52a582f2e2a364c0
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9Q/lFTjN4:oG05lO43b3Lm
TLSH
T104D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 13e6fe9c39c568fe5b3abae79acefc69bd2f306b745e2daaca9865706e0e2275
MD5 a7a4b60eebfbe7da59f42130cea1731d
SHA1 b0185864838e6138b9a88e449e483c7459b82b72
SHA512 977dc5f5889d030db70b965f821aab33cdff627c8907e8c4f1191b2576450490dbb7e518511f30fbfcb387b46b4dcb6151beceb18d99fc7d0eda74edaadf93e6
SSDEEP 24576:Xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnnnQ/tbw/2Mkjy6Fr7g0oH:va5POZ3+Jt2pasx2+m1Q/lFTjN4
TLSH
T19265AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 607ec0118419a66827a6c563ba33882ab4ae511785ed42122e38f595e55aa57b
MD5 1254bdc2fe1f7cb5f9181cee70982145
SHA1 c2b2811e54c761d3a1ff874f9dc2dd7b5da3a32e
SHA512 cb24979204cb83af0e37bded2447091e4f8f48b3710ce9d4f6f90d9a06cb41a5a21ebcd86a172014713ff3f246ac1a01f8528e3f738e82138e5e97dfe1735833
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkJnQ/tbw/2Mkjy6Fr7g0of:RNc/zEOVHFqQ/lFTjN4
TLSH
T167858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c27126f17fd1210fe4c1a72f4a7641e9317c7fd2951598cf619d0106c5a32e3d
MD5 dc824fddae7c1f6dbdd0968f765f80c4
SHA1 f1aac747a83d10317ed107a8f1d6e5d5c53c3390
SHA512 c0f4bbb8ad83859f84e56e882df66bf6d8866b910ce20542a81d9a6475688792269b98333335f51903be313a758917ea417b3a44fd832305bc26196f607dc6df
SSDEEP 24576:b8kNvNnaFeYhJNtmZBmLnQ/tbw/2Mkjy6Fr7g0oo:b8MwBtOmLQ/lFTjN4
TLSH
T18855AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 5e666727aafb93d4000d19ccde7a063b619ffc11361ca65f5fcf4084d7dbd4da
MD5 94cd087d39c371099bc55b497b8e7fc3
SHA1 defa246c2b953386c1222d6a1fb49cfb4bf84a68
SHA512 ceeed070d0a84c6d4f3055973dedab944f0cdf14d4da8c48cc97f8384959e64268610e233cc885f29e33c45c92f973173c632340717eb1b8e3c6987ace65a560
SSDEEP 12288:rHvUrBFrEjwaQtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:rPUr+NQNnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1DF65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 039523e5035442be02c51ba6ee9289ff1e23202a32aaf5a02deb5ba427e1c76d
MD5 79e4f39a5a15e83d711eba3ffcdf74f6
SHA1 8c69c2f1899b9e1194b94f4e245390246747a31c
SHA512 f1230b304d91f8da3b59c216e5a183015ab5cbaf330aeab84a2f4210b9ffa844203f7759a69ddc6453eb3a5bdf8346c9c8cc3c3e3568e667aec7de0f35a2d1d0
SSDEEP 24576:cD3FHshBIYQgAUnQ/tbw/2Mkjy6Fr7g0oe:cDVHeBIAAUQ/lFTjN4
TLSH
T16E75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1936-311-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1936-121-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1936-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2000-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2000-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2000-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2000-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2000-315-0x0000000003030000-0x00000000032CE000-memory.dmp

Download

memory/2596-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2596-292-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2596-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2596-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2776-1-0x0000000002790000-0x00000000027F6000-memory.dmp

Download

memory/2776-6-0x0000000002790000-0x00000000027F6000-memory.dmp

Download

memory/2776-8-0x0000000002790000-0x00000000027F6000-memory.dmp

Download

memory/2776-76-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/2776-0-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/3028-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3028-39-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/3028-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3028-49-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/3028-45-0x0000000001E80000-0x0000000001EE0000-memory.dmp

Download

memory/3124-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3124-13-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3124-21-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3124-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3124-20-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4240-132-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4240-136-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4240-126-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4240-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4240-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4868-77-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4868-78-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/4868-83-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/4868-308-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5184-101-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5184-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5184-312-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5184-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5184-107-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5184-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5336-66-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5336-72-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5336-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5336-307-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5720-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5720-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5720-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5720-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5720-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5720-328-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5900-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5900-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5900-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5900-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5900-112-0x0000000140000000-0x00000001402D4000-memory.dmp

Download