Overview

overview

7

Static

static

3

Sherlock.W...ce.msi

windows10-2004-x64

7

Sherlock.W...ce.msi

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Sherlock.WindowsService.msi
  • Size 6.3MB
  • Sample260819-ph86xaar3x
  • SHA256 81c1d9902934de79ca9485459676740c0cb9dd0c4fb021670490d3235a852eca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 17 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 64 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Sherlock.WindowsService.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4120
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5160
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4452
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9776D01B1B8FB753BCED7EF8170F61A5
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4712
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-384e9612-520c-4f0e-b4f7-6576b1beab46\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:5852
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:3640
      • C:\Users\Admin\AppData\Local\Temp\MW-384e9612-520c-4f0e-b4f7-6576b1beab46\files\Sherlock.WindowsService.exe
        "C:\Users\Admin\AppData\Local\Temp\MW-384e9612-520c-4f0e-b4f7-6576b1beab46\files\Sherlock.WindowsService.exe" /S /VERYSILENT /SUPPRESSMSGBOX
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1648
        • C:\Users\Admin\AppData\Local\Temp\is-KC41E.tmp\Sherlock.WindowsService.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-KC41E.tmp\Sherlock.WindowsService.tmp" /SL5="$90246,5629339,791040,C:\Users\Admin\AppData\Local\Temp\MW-384e9612-520c-4f0e-b4f7-6576b1beab46\files\Sherlock.WindowsService.exe" /S /VERYSILENT /SUPPRESSMSGBOX
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2324
          • C:\Windows\SysWOW64\sc.exe
            "sc.exe" stop "Sherlock Base Service"
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:2976
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1324
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:5748
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:5444
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2600
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3128
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1624
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1108
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3276
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2628
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1724
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4840
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3060
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2240
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1488
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:464
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5020
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4152
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2560
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • Kills process with taskkill
            PID:1932
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • Kills process with taskkill
            PID:548
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2792
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5436
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3248
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • Kills process with taskkill
            PID:3268
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5352
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3448
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2744
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3552
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4740
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:6092
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2420
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2004
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1388
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1380
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4760
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4248
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5840
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4112
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • Kills process with taskkill
            PID:5556
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2368
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3288
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:6004
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5112
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1324
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4168
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:468
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1164
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3768
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:4216
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:5788
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:3020
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2420
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • Kills process with taskkill
            PID:2916
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • Kills process with taskkill
            PID:1384
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:1380
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "msiexec.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            PID:2432
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              6⤵
                PID:4760
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "msiexec.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:4248
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "msiexec.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              PID:1752
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                6⤵
                  PID:5840
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "msiexec.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:4260
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "msiexec.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:3184
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "msiexec.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:2368
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "msiexec.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:1472
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "msiexec.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:1208
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "msiexec.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:5444
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "msiexec.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                PID:5908
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\system32\sc.exe" create "Sherlock Base Service" start=auto binPath="C:\Program Files\Sherlock.WindowsService\Sherlock.WindowsService.exe
                5⤵
                • Launches sc.exe
                PID:3248
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  6⤵
                    PID:1624
                • C:\Windows\SysWOW64\sc.exe
                  "C:\Windows\system32\sc.exe" description "Sherlock Base Service" "This service manages Update,Install and Health Check process of Sherlock application.
                  5⤵
                  • Launches sc.exe
                  PID:2600
                • C:\Windows\SysWOW64\sc.exe
                  "C:\Windows\system32\sc.exe" start "Sherlock Base Service"
                  5⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:3040
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:2248
        • C:\Program Files\Sherlock.WindowsService\Sherlock.WindowsService.exe
          "C:\Program Files\Sherlock.WindowsService\Sherlock.WindowsService.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          PID:1164

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              System Services

              2
              T1569

              Service Execution

              2
              T1569.002

              Persistence

              Create or Modify System Process

              2
              T1543

              Windows Service

              2
              T1543.003

              Event Triggered Execution

              1
              T1546

              Installer Packages

              1
              T1546.016

              Privilege Escalation

              Create or Modify System Process

              2
              T1543

              Windows Service

              2
              T1543.003

              Event Triggered Execution

              1
              T1546

              Installer Packages

              1
              T1546.016

              Defense Evasion

              File and Directory Permissions Modification

              1
              T1222

              Impair Defenses

              1
              T1562

              System Binary Proxy Execution

              1
              T1218

              Msiexec

              1
              T1218.007

              Credential Access

              Discovery

              Peripheral Device Discovery

              2
              T1120

              Query Registry

              3
              T1012

              System Information Discovery

              2
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Service Stop

              1
              T1489

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              Autofac.dll
              • Path C:\Program Files\Sherlock.WindowsService\Autofac.dll
              • Size 224KB
              • SHA256 ef44110310953e54a099840c4c1f9a42ccd014259a88ee435ffe1876ea955242
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LiteDB.dll
              • Path C:\Program Files\Sherlock.WindowsService\LiteDB.dll
              • Size 478KB
              • SHA256 450457c3886494fd825ace41b15d87c7cce5bef87cfbab436eedd79d5d8c3312
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RestSharp.dll
              • Path C:\Program Files\Sherlock.WindowsService\RestSharp.dll
              • Size 164KB
              • SHA256 589b9fca00bfd1271552fa30fdc03b52501a2394395349c723e696c90958af07
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Sherlock.Core.dll
              • Path C:\Program Files\Sherlock.WindowsService\Sherlock.Core.dll
              • Size 77KB
              • SHA256 7a5aae198a4df6a6f80ab43d406228907410628f9af1af219a5d9493484bfa05
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Sherlock.IoC.dll
              • Path C:\Program Files\Sherlock.WindowsService\Sherlock.IoC.dll
              • Size 9KB
              • SHA256 259c7e327eb1e33108cddb3c45c30bffff8de3bda8064a8c6b607b484ad7a96b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Sherlock.Model.dll
              • Path C:\Program Files\Sherlock.WindowsService\Sherlock.Model.dll
              • Size 79KB
              • SHA256 a87f0a42b5f8e29729c9067847cde4598e734749e6c7792b8bb5348178721fca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Sherlock.Service.dll
              • Path C:\Program Files\Sherlock.WindowsService\Sherlock.Service.dll
              • Size 35KB
              • SHA256 b474d535102cf798ebc2ecc2148471c40896b1b06aeae259b4171fbbd652b9a6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Sherlock.WindowsService.exe
              • Path C:\Program Files\Sherlock.WindowsService\Sherlock.WindowsService.exe
              • Size 55KB
              • SHA256 c59ec5a0e7562d82114d10414ed37c36e675725de25577dba919554c92d0d91a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Sherlock.WindowsService.exe.config
              • Path C:\Program Files\Sherlock.WindowsService\Sherlock.WindowsService.exe.config
              • Size 2KB
              • SHA256 79b729b957d1ff6765f0d0003b03c69cefe5ee49a925c7585954f3beac761270
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Sherlock.WindowsService.pdb
              • Path C:\Program Files\Sherlock.WindowsService\Sherlock.WindowsService.pdb
              • Size 75KB
              • SHA256 cbf010c9f3ba032074b4e30ed3d2cfea5b8c6c9e1001046542ad6fbcf2f7322c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              log4net.dll
              • Path C:\Program Files\Sherlock.WindowsService\log4net.dll
              • Size 270KB
              • SHA256 af5610c515d2244db98c662636264c8177e89b1afe407f88fd18a41d66f6e7e2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              log4netService.config
              • Path C:\Program Files\Sherlock.WindowsService\log4netService.config
              • Size 863B
              • SHA256 2f088d262be07ef6c571569bfe2e136848e4ce9e2373b98da5df0a2bfbdcae93
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              files.cab
              • Path C:\Users\Admin\AppData\Local\Temp\MW-384e9612-520c-4f0e-b4f7-6576b1beab46\files.cab
              • Size 6.0MB
              • SHA256 d91eeef1c7b193391fa2c10f4b8a89c825d8bc71ea1b86ade8620cea4250d551
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Sherlock.WindowsService.exe
              • Path C:\Users\Admin\AppData\Local\Temp\MW-384e9612-520c-4f0e-b4f7-6576b1beab46\files\Sherlock.WindowsService.exe
              • Size 6.0MB
              • SHA256 3ada056d50b76d693e3ba46a238185d916598d9a5159b63e0124acfa02480c2e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msiwrapper.ini
              • Path C:\Users\Admin\AppData\Local\Temp\MW-384e9612-520c-4f0e-b4f7-6576b1beab46\msiwrapper.ini
              • Size 480B
              • SHA256 6e7220fa45e578f92fe654a7777eb1283b85eb757f453f342f15451bde1cf3f5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              msiwrapper.ini
              • Path C:\Users\Admin\AppData\Local\Temp\MW-384e9612-520c-4f0e-b4f7-6576b1beab46\msiwrapper.ini
              • Size 1KB
              • SHA256 319bbfd84466a36ee2cd32c0c7a0c3cab82cd428fe498889c6aea708ef9fb166
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              msiwrapper.ini
              • Path C:\Users\Admin\AppData\Local\Temp\MW-384e9612-520c-4f0e-b4f7-6576b1beab46\msiwrapper.ini
              • Size 1KB
              • SHA256 8e4f3fbf889fe419ab45540e3edbc77764bd3871ba4ec58973c377be4ed9e26f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Sherlock.WindowsService.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\is-KC41E.tmp\Sherlock.WindowsService.tmp
              • Size 2.5MB
              • SHA256 a78feddc5cdd217622b6c11bf2025476b14b59d31c320af27e21b546c74fc75e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI9A81.tmp
              • Path C:\Windows\Installer\MSI9A81.tmp
              • Size 208KB
              • SHA256 d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              metadata-2
              • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
              • Size 26.1MB
              • SHA256 0b6a6d828a3351fc5e903d8f17c32a493f8363dc13c514afbe34c818efd1e8be
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              {071f1c5c-79f2-4d78-ad22-72ef464f0e53}_OnDiskSnapshotProp
              • Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{071f1c5c-79f2-4d78-ad22-72ef464f0e53}_OnDiskSnapshotProp
              • Size 6KB
              • SHA256 3d3ef8476dbd9b8f8c88e7f67ff9029f65009d65358077267aae700fe9959e3f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1164-355-0x0000000003AA0000-0x0000000003ADE000-memory.dmp
              Download

              memory/1164-381-0x0000000003DF0000-0x0000000003E6E000-memory.dmp
              Download

              memory/1164-359-0x00000000014E0000-0x00000000014E8000-memory.dmp
              Download

              memory/1164-364-0x0000000003AE0000-0x0000000003AFA000-memory.dmp
              Download

              memory/1164-368-0x0000000001510000-0x0000000001520000-memory.dmp
              Download

              memory/1164-351-0x0000000000230000-0x0000000000244000-memory.dmp
              Download

              memory/1164-372-0x0000000003B20000-0x0000000003B3A000-memory.dmp
              Download

              memory/1164-391-0x0000000005180000-0x00000000051B0000-memory.dmp
              Download

              memory/1164-376-0x0000000003B90000-0x0000000003BDA000-memory.dmp
              Download

              memory/1164-360-0x0000000001520000-0x0000000001542000-memory.dmp
              Download

              memory/1648-386-0x0000000000400000-0x00000000004CE000-memory.dmp
              Download

              memory/1648-179-0x0000000000400000-0x00000000004CE000-memory.dmp
              Download

              memory/1648-66-0x0000000000400000-0x00000000004CE000-memory.dmp
              Download

              memory/2324-385-0x0000000000400000-0x0000000000685000-memory.dmp
              Download

              memory/2324-196-0x0000000000400000-0x0000000000685000-memory.dmp
              Download

              memory/2324-73-0x0000000002300000-0x0000000002440000-memory.dmp
              Download

              memory/2324-348-0x0000000000400000-0x0000000000685000-memory.dmp
              Download