e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
Size 5.2MB
Sample260826-ltff7atsey
SHA256 e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef
MD5 079b12cead6f1ab65a927c158840a497
SHA1 3f06fb833e4d4301303dd31a801edb253b063036
SHA512 cd4c25adb1398a07fcdfd1611747382c747950fb5ff601c07dd5a060ff7d93e38c57c4299da7a2dae530aaa7e697d20a7ed9922695ca51921918f744f0bfb970
SSDEEP 98304:EZGsBepsifXXE/qH4Xp0uqOz+JA2WOa9GKFLOAkGkzdnEVomFHKnPvyC7wRGpj3:OGya2hXOuqOzQFWOaGKFLOyomFHKnP6W
TLSH
T1A146BF927F8BC266C0D202314ADDF77DD17FBD7437A5018723C2BA2F65B17814A29A16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5076	elevation_service.exe
948	elevation_service.exe
5860	maintenanceservice.exe
2936	OSE.EXE
5748	PerceptionSimulationService.exe
1308	perfhost.exe
2092	ReFsDedupSvc.exe
3596	SensorDataService.exe
5456	ssh-agent.exe
5564	AgentService.exe
2988	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\AgentService.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\811f7f0d5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\vssvc.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\wbengine.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\System32\vds.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\Roboto-Regular.ttf	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000004a41b3344035dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e8e51344035dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d4644344035dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000044634784035dd01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000796c31344035dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb4645784035dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
5076	elevation_service.exe
948	elevation_service.exe
948	elevation_service.exe
948	elevation_service.exe
948	elevation_service.exe
948	elevation_service.exe
948	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2060	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
Token: SeBackupPrivilege	2092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2092	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2092	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2092	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5564	AgentService.exe
Token: 33	2988	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2988	SearchIndexer.exe
Token: SeDebugPrivilege	5076	elevation_service.exe
Token: SeDebugPrivilege	948	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2060	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
2060	e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3756	2988	SearchIndexer.exe	100
PID 2988 wrote to memory of 1852	2988	SearchIndexer.exe	101
PID 2988 wrote to memory of 1448	2988	SearchIndexer.exe	102
PID 2988 wrote to memory of 4200	2988	SearchIndexer.exe	103
PID 2988 wrote to memory of 2260	2988	SearchIndexer.exe	105
PID 2988 wrote to memory of 4360	2988	SearchIndexer.exe	106
PID 2988 wrote to memory of 5588	2988	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe
"C:\Users\Admin\AppData\Local\Temp\e6531dabd13917a66d47dc7637e9177dc930ba0d92dbc75385a4809f5fbf32ef.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2060

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5860

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2936

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5748

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1308

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3596

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5456

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5564

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1852
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1876 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2872 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2872 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1876 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4f755dc09125f2a333b16f2692ea976e84e0a2bac9169f0171ee7ecfe2c81b43
MD5 ab8f258682024d9fd7a46863e03d4092
SHA1 583fa20095360a99a485378defa361c377765b0a
SHA512 ff0698b97651f1832daff81bb77d1e6148f761f920337af6c982683cf2a9cde165bc20d1560aa5eaece06e97f18404e3ac097673fd53e9b4b3c8bcf43905d1f2
SSDEEP 49152:ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxnNLNiXicJFFRGNzj3:C3q6mjBa7wRGpj3
TLSH
T19DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 72d17f4e0b85ec6a9671f18aee9c16f2f73ee40249e3946e7cfaa9ae7ee08451
MD5 d178eb189f0c3af2921d8fdff8df1a57
SHA1 3e94fa159a653ad2fa4d565ebb45746fde7b894e
SHA512 47b8946dcc338bd699e38d972d1ec66f9a5e375e4ec92b60de336a580c693db389fbb49938b9bec4cdc62a5493ba20e6ccea2a258ba8f7b3b6838252ffaabf94
SSDEEP 24576:hXYfDtczAu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ktcfLNiXicJFFRGNzj3
TLSH
T15775012963D408F9EDBB813CC9B28411E6727C554760E7DB03A4A92A1F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 36ad288e94b1be6bf06bfd973566693d6f3140a2058f07888cfd02bf3f81e58a
MD5 b23803e8f647768200d1805c2641b4c1
SHA1 ade230605958fa8d8f7abc79cb2028748d4ecac8
SHA512 966d3de2904bd76540535747cc6af9ba1287aee26fa2497e96266575cfd826cf2ee10514859deaa2c013ad03c7dfa407eaf6c317e5b13a28d2c32693e8cfd559
SSDEEP 24576:t0Le5ji0hmxhrM1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tPji0AzMLNiXicJFFRGNzj3
TLSH
T18C859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cc1c740fc16d44446367b1135351efada104bb1ff3c96b7688e0f19887e65671
MD5 3a37c88ddb2f81a1abbd49942800569c
SHA1 3ca82338743a4d4c98be90c9eb45635b7af08fca
SHA512 2b3670c030d26baab4982c6b22620e957f126b86f70e31360d92d7d76f4515fb463ad01d120c364697a41998de85a86ca994e9f05b95f1bb14f097625f9d0b57
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWj6q8wyuP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1/ezSC6vUzPv+HjyQLNiXicJFFRGNzj3
TLSH
T141756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c50f557aac5bdde207144a0888f8aa51796b4852474d647d24aff4852fe6f5f1
MD5 f58495759afd3854ba19ea016cf2c696
SHA1 056c2615cba80bea59abef5403f7370193ad5fe7
SHA512 686e43caac60088fd23ff4c309bfc5fbdc1f11400e01c8ed3422a9940b4e9345f3bf8302fc61b984aaf6b8a60b5a94f5ff2e41cddc9f0670dbc9b05295f776bf
SSDEEP 24576:qVbqPb88hv/l+BK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qVO88hXl+sLNiXicJFFRGNzj3
TLSH
T1B5559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 298ea146e4849e277303422e0020d96044e0316c9b0e6a85a3f2a59139025111
MD5 7f36b59ba25ea23bd493cc1e66920373
SHA1 6375ceea81add34314a861a290042f28cf119b2d
SHA512 0f67b52ec58dad2d6bdfe7f7581f538af130cfb0477b785dff1977da735dd6c242c5bb72c9f1f1dfc260ad61b0b1c5bbb89cb5a369e38861dc53865c5593065b
SSDEEP 24576:hGB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OLNiXicJFFRGNzj3
TLSH
T1565523D3468855B1FBFD003A867A5828B5845E2C8A695DE3D2543E5E913CFEBCF39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 b261df64d7a4460f48ad1efa1abcef83502bd40fc67a5481eead88098c9fd381
MD5 c8365ded2d1d5ca57e8f3167c5e7f08e
SHA1 17ffb148a11e1c6d4f93576757e2fd9b3433b5dd
SHA512 db253a809334fd0ffcc5b264e148608f3465038e515219340bacfa7c1986e4127667fccd6884285a05bae330ef54e8436737ba9a02d788a80b1a831a5b2c8c73
SSDEEP 24576:uJIUy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uJIUyLNiXicJFFRGNzj3
TLSH
T10375CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8d619468ea3996529b61c79ca5281c727c453e23c100142d0ad5def375b73c63
MD5 c40b71e751bb4c178ee1b2cc81d57533
SHA1 d1ce19403637f60379b773614a25f96742ed30e2
SHA512 9b05ac2d60b06a77a4478d89b99309bf0bea8b7c8d1bb361fbea97337142fa0735859e37662b7094c9e872156e60b94f20645ccefb4afd578d7c1771ced5ace1
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THc:QQvGAdlCEL8c/WRNw5C/7wRGpj3
TLSH
T186266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7128ad4df935667840db32055af9f6b44c3286723bcb772c5a3effaa580a5daf
MD5 f4e602f7e2cef353f0a08c6e859457c4
SHA1 ac9948e1b1457c085d5cf545078dec2a1ddff496
SHA512 cf69f16d8770f455f2558927a948425ecacd84765be323a686b81c9d2b688f6421a6679546c6d75aec398f77cc8fdc1f7ad69c880715b6cf526598ad8e397ee4
SSDEEP 24576:lfewsAj8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5lj8LNiXicJFFRGNzj3
TLSH
T1B175E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 36dfaf876aabceef2defd67a0d0f1887624a3f0bd5dd2d11e4043b512d46df64
MD5 68b9f500760373913d8fac4635544548
SHA1 8271849520c336dab9da82bb8a38f0a94b0527fd
SHA512 f8b6dd43dad54d253e1c633345c14e3e3f5291cdcca547a75508ae7a5c63711bfe980304d431cc2bf599f78f07fd9992fcd8f58fa05a7f3f15367412d1b1e1c4
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHAF9:gUEtQevvqc2W1cpV20I32k9
TLSH
T145474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 22c5d7dc3edf163e40672ef99fc6f8f86453d98caa2075c12fa3bc7ac94c018e
MD5 7e899bdf47629b7d698eefa97d985eaf
SHA1 6870e36ec396b53b97067cc23339e75111e01fc1
SHA512 84486e9a6683ca5372af72c2f7f9a3b29cccf18f119618dd267bec4ea3b7cf31b591aa63169ac96db82ab8343d05e2575fdc6cddbe0d6217926fbb06eec01af5
SSDEEP 49152:+CbRquA/m2yL5zLfFiV+XenmE3/zcLNiXicJFFRGNzj3:zoq2Vjnmz7wRGpj3
TLSH
T1FCD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 19cf47f0590cf35d03893763bd26e3cb79e8f6c29cd757b2259d9bf7b63fc4bc
MD5 5602ec77eec25a18fc40a7cf42a243c3
SHA1 5e98da6a6beaf9c5506bb19bda4f19ceb3cff8ac
SHA512 d2f1d080550093787ae965c446d55eb0cb38e016167c34438e5f8983cf5a2bd714be62dec418ce094ba078f4602a316fef71321ab89ff2b95baa4232e5a9c351
SSDEEP 24576:YAhGL6IFoiwtA5l7S53T/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YAM5Foiq5jLNiXicJFFRGNzj3
TLSH
T166359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 38859384bfc5bc94cbac3e04136d9f79a6e90da57cd78b0ab272631cd768a1a2
MD5 09ec899c5a5448bb1b37c5a093d92a08
SHA1 32655976fc51a4520782a2ed29a7b8285314dc4f
SHA512 1846ccb0991a5529d6307b1de354aef0a135de0eefcc8cb7708d4f47380d8101adece08f1a8ce3696dfd1dd9c4d10b8547fb311f24d9e917bb59279454ba93ee
SSDEEP 24576:BwuROWw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BwSO3LNiXicJFFRGNzj3
TLSH
T14C65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f0907dec26a2dc1184f9899776a5bdbb16164f44322a4fe786ccd128c3bdddbd
MD5 c12d4cc58b192dedd49bdd4f122acda1
SHA1 78157331d2a544594b4a4398761cb31478be412a
SHA512 5c64d7600715764a4e8003a6d1161e7d042ae5a8aef96253117df5e528c4aea347c6359f0858ef74912cf0805bbec0e4970eee2bdafac27f74f5d18eb02ecdbe
SSDEEP 24576:oZu9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3LNiXicJFFRGNzj3
TLSH
T15355129622D820F5E6FA403DC9F54504E3A13C2A573643CF52242A6E6F36FD69E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c6b40c73323f3ef5fca533bd0ad75a59b926ce662131d24a3fce1e7b2844bfb8
MD5 6ba47c3e544b8c03b05ea4f371adabc7
SHA1 e5e9bdaa50a6afde27f968d92b14d52ac156b33a
SHA512 83e1a13a516b10dc1ef44ed415a5c65c63f9f2fd09c44a733197376e52a8ba5a2e534332dbfb1e79b9ebc9feb52f57556a710662ec6c0fd3eccee28fe1398ae1
SSDEEP 98304:DQRQyi36YOcPDLvw2gAf+PN3W7wRGpj3:SQyiKanX+PNKF9
TLSH
T1AA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 89a5726407b1d46ab760d00b89b176e892845ce2cc88a243b6bc4f61659d5603
MD5 8f2837be7952db7d664929cce7a8610f
SHA1 b0f1306aacabbf6412714841e98b1d9b9907874f
SHA512 9ac5ca25d04f0ad7eb2706586e1dcbb783ab3e5fa909eba023e130896de5713d1fee6ebfc94121fe84d4b3eade6ebacfc2527aec6c6dd2c7747d12e42e1b1f2e
SSDEEP 98304:1QRQyi36YOcPDLvw2gAf+PN3W7wRGpj3:MQyiKanX+PNKF9
TLSH
T1F9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 63cf3882060a35998621a5d7520236daf81f07600b394acc2e74c4ef1c350f51
MD5 608321ebbe47719aee34f1bf5dd03164
SHA1 e7ab8ec1459eb60392c7a1ccdce4130e571227d0
SHA512 ff379faed451ff63a6d905afef5d72b0907c7ace23f281ffe903277ef1920ed79e049a9385fa5f98dd44af2ab54df5737876d2c25e93e17bf51653b25485ccd9
SSDEEP 49152:U68Qg55nhkeWu7PNU3/MLNiXicJFFRGNzj3:+thTRc/M7wRGpj3
TLSH
T113B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 408c633d4df437e6f302498afd58408f3bc485496a8b39e3535952233be7e649
MD5 aabf20e97219767b718708b4426ed026
SHA1 1b6e0005c008199f755fa78762117f692b2e3ac0
SHA512 e6f9fbfd7af4fa28647e7b11c45907a27e98ec87d0697a88d6c280473b5ffaf622f40182264127861be949cc69b1234f9724aa96f257f28692987f83935c5342
SSDEEP 98304:hy5112gYy5azzVvU69nLKnhZB7wRGpj3:8LIHRWhPF9
TLSH
T188167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c594460a889762333594055cd8d42575c2ce1a74fba6ca11a7aad9f391d851fa
MD5 fbafa4a1fa00b75645cb96db20ee3b3e
SHA1 3ac4cd8765ae88c1584df7b265e37d272f8591cd
SHA512 5ae8b8df1d4b96035d102cd0842f296ecf657f172f5f67cff51caca68c0ad22ba919c2541b198752b63432d5abecebb0f11f7b836bae8d72a873237c99202100
SSDEEP 49152:5B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl+LNiXicJFFRGNzj3:vu6JmIxd2d+7wRGpj3
TLSH
T178D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 78fe983a2f77495b50ab189c1fab1b5db7199b341ed98da679ecc21ae63837e4
MD5 42168860f668908350c4ebc601b255d1
SHA1 bd191ad42f73a4ff314a3703556de19783d2322e
SHA512 9b713cf6b6311caa3e5ffb77661617522fdf4ced64f135d9be43ff1f5a98e8a378e34a63df52b6e8ed1088a9cbeea0bcffc032a4056da20ca6ffdf1d12d5c791
SSDEEP 49152:N1hpsNoJpF1A67U44CwH7R4xSLNiXicJFFRGNzj3:NmifPqRz7wRGpj3
TLSH
T14AB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cc74dc66c7e27b51772c280533dc20e0583113563c8795c0f6f64f44c3d42e83
MD5 1dce82fa0266b128fb7097872dd06031
SHA1 8f8096c59703453df547353a1cf3eced87336e40
SHA512 ce4e3fbae391e76911a169f553735f19b738d627e2fb8f30c29bf2444ed76e3a09c317752e88d8cfb87c9fa807156e52ba43eb7e8d978b74c442e889a6bc937a
SSDEEP 49152:LSuZQIY0Be2KkRVtOnks6NMHq9LNiXicJFFRGNzj3:Z5dKqi6197wRGpj3
TLSH
T19FC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ed898ac6a081c9b06ca44e87056255b66667e4d816bc3277388972744f686ed8
MD5 868e76a49de338308f088a382a047783
SHA1 e975e88ae316aeb377d2f138ef31e8333a3bd945
SHA512 e372283a4b0183f30ca9908d8bbf9f434a2975e23d5f34ec43657217bca0676de518cb6d6c5e5fc2cafbcd6e08125664867fe9949426d978444671fd66fbcb1f
SSDEEP 49152:EhtSn8EApI0figjgiDn0AP5wuLNiXicJFFRGNzj3:FX2iWphX7wRGpj3
TLSH
T18895BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2b7bbfed2d7587807761d2901ecdfffb67482b1c3c3b9db1e8f8cfac60ccb9b6
MD5 d69a5edb8d042c1d39b8e68f9b0afbc2
SHA1 489a883826a8d4431d4681e30f37da4560bfd347
SHA512 1a2aa04b313d1c6a90682dfc24c24a56164e3aa27a9b8ed3bdb177123855bdce4a8f3ec0ba6c01484cf6d512768b8e0351e013012cead0dc2be94dbe703c075a
SSDEEP 12288:pFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CE5523D3548955B1FAFC0039C6764428F5882E2DDB5618E3E3443D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 468aa2f474ed52a3204f0ad91c6c3c3617aff0c2f61a10482be3462e0ec47b7f
MD5 0dbba651d49258df7ee00e3ab4484c6e
SHA1 2ee8879f5570c3ae2831e31cfaddb31f13d766c1
SHA512 8ded4b1ddf7299f467d6cf8d125ca1584500dd43e4df89207007ec92f7deae32af9648f00e3a339cf450dc592dfe986add69b547bf44e5ff35046d3c6a2dbf9e
SSDEEP 12288:v+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AD5523D3558955B1FAFC003986764428F5881E2DDB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e968f2940ba69248310caa9c8f2098528cb37252706bf01247143a927af9cf46
MD5 c4316731c491e7687105097773637f7a
SHA1 d925893d30b0f157819d70f063c99e7d55f11d22
SHA512 2ee11727e11f850be83688b4bd918a9424ee3212add96e9c4d420611b0bf834622ab47faa82e730c10dbf9a1bcab67a083a9f96b448458831812e3faa654e81b
SSDEEP 12288:2oiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FB5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d8b8118dc5d75f077977fe18de6e81016383daecf737225b1cd37533500adff2
MD5 75274a0504462c39eddf9ea0a8bcab14
SHA1 cfde9ed3567d74693f490a5b316c3c5771d499e4
SHA512 fd6a39538c39dd4c3126b4e42b45c01365d488b0911545556af2ebdea0afffbc1f523f6ddd5d59112dfd1cfcca67e956091387b316e7f49459d82fc7b64508ad
SSDEEP 12288:mVHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FB552392168901F1E9FD8039C6764424F2A47D6CD7325AEBD3003D1E5A74BEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c78a72a7f0673e0db34eb9a2b22460368921b82f90843e672af55436db293d36
MD5 6ecde3c152db80443c932834187e50ea
SHA1 e1b2606e41870aa835a088d3c831d4f7ace2ab15
SHA512 55c83f24e1e9d7b6715659e633a00c664c1db12bf6444fc285de3a86b86efcfdf33029f8bc485689797ebba1d7739a56faae52907809ebecabdeaf8c617a725e
SSDEEP 12288:v/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10D5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2ff45cc0963486e7da72c3f6a149d5ce7252a3f4a1cf17c6fc7bfac211004867
MD5 7f26f11917cee880d57f7f40c723ce9b
SHA1 c5a176a661c51dd2979cc6af907099512124f6aa
SHA512 6d93cc4af24e98b6686a80dea8624caddf53d7b583a6e8039e13c3b40b500b078120ffb049e4f4179f614f83ca5ffc335ad615fe20ef0e39aff4c1ea55f5bc6c
SSDEEP 12288:7CiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A65523D3558955B1FAFC003986764428F5882E2DEB5618E3E3443D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 33a1ad3382f4157feaf7b2d909c27bb2d68ff2585cdd0c91c07402756a34c0c7
MD5 023162c9062c9087a7d28d260bc247a9
SHA1 ab08d6e247667ec7d031e388a2a739b24a9e6854
SHA512 654df3065a9c0b8e627fb82fac593a9f4f7e1f09b4392ae424221f830a4828d6a3f9084e8ba776378c7fa7c583b4f3ad7049571a1f5843e7c78c9a17eeefe17d
SSDEEP 12288:M2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12F5523D3548955B1FAFC003986354428F5882E2DEB5658E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 ebfd062dac159696efcca6aba63827574c397063472bbd752ef74e453e422a3d
MD5 336c559106353d1708ba04700680056e
SHA1 66fc8ee1a7732c0fe6ec2b44774301332e875e97
SHA512 bccbd0621ad9719447babca07d962f2ab1a907f9e0480fe3086d9cbb2253802eeaeb8c619fd8af7013eb3f3b6a41a01f2e4679fc26fcb608104c9ff627617632
SSDEEP 24576:DZM3zFVSOo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DZM3zf0LNiXicJFFRGNzj3
TLSH
T1DE750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 529f29faceb4dd75cfc5452fd5ff963803a106d11bb69e9ab4f90120499cecf0
MD5 19ecddf74ef182d24fbd50d43db06019
SHA1 8e408810d814cc10b942e77d9ba97452479a6a37
SHA512 b6b3cdae7834a962ed6c0afcd8c6648aeb772cc14fdfc7b97fad7469836433f046df99a6f9f74f9ccabf5cd2d5a372c68cac14ae5f80818289f4f8370b67b6ee
SSDEEP 12288:4BiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f771b8357faa70c28b2f8b66b05457a6cbaf45d00c289ed56ba20acb7f3c3817
MD5 cb756cbe667d3042a763caf4a7b21cb8
SHA1 e958392f738a36f06765af45b098eeb11baf2e6a
SHA512 34ce4325bbefdb2efb51da3f6bb722944eeb72fbb401a6603532eb4a9776ca0e9f58109feae10efbb3e02fe53f43a8d97b1a1813622b18c9214adebb7abb87b5
SSDEEP 12288:MtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1115523D3548955B1FAFC003986754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 07796298db17bf89ecec94c3868982bf223a0505bbf83fcdde3da25246286f55
MD5 441a8b019ebdebaff1ae27ee846bb49d
SHA1 cfed5115b7e0b512c81ff0dc09e5dcc81a640da3
SHA512 19c2d03f0d074d4c5fbb0fa3ced91b76adef2583708c0eb7ec3424a0698b6c68320d99574a6a45981992e2460069e40168e2c8bb3b39dea7c0afaec172abe1a4
SSDEEP 24576:Wzys/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WXLNiXicJFFRGNzj3
TLSH
T1D3650247629530F9E17A8139C9620911F3B57C3647208AEF53641B7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c30420413a464c72a4e7e46728df67d1ad8f02c5f081b81fbd260d988183e5f9
MD5 026f834c67796902ef20005d07f30089
SHA1 4cd01a85e5a0570ea85dfe3c6a9e7362b8d252c3
SHA512 1598735762f84cc5a67e16497d200e9b8e956b19e74158ae9a6a8abf2797f5090f518afa7830208778c145acece320c3a75f9b35dbc230a9fcef763d333e34f3
SSDEEP 12288:3BiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5dc5a6118657a1ac6c550c42ba30f07cd1b47ab47b42b9aaeeee9b966d7db625
MD5 01ae3aabedcf0ecf212197aa2aa299e6
SHA1 1f700b5c1e50bed45105281df3756cca89c414c5
SHA512 d8646ed771f0436bab2430fe51c888f9162bf36faeea9fcb56c43f3c91954b61d522c54bbe48f8b70121fe99879a61924f724a2190ef382fd439fd2d4614caed
SSDEEP 12288:LBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Lt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A05523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 8b09bc1dc5c2aabd2ee8e3f38e08f5cabb39c56eb800c8179d190981ece7327f
MD5 d188d05078399629b9ba50caa3387d66
SHA1 dfe2597ac23f5c1fee0d23dd50c3a7abe1f1584b
SHA512 23b101cb66ac7488447a09dfb0144b761792b70fda9fa41153730ee4b851e40263942fe0837aec3afce8becfc5b0c1d67a63bf1c0ff856ecd345d89da46f70a8
SSDEEP 24576:Nzys/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NXLNiXicJFFRGNzj3
TLSH
T1E7650147629530F9E17A8139C9620911F3B57C3647208AEF53641B7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 91463dfac47d4ff5ecf21a00acc0aaad19f27ac5f26c49f2fb69536683a1d7d9
MD5 9dd3e2620c6de1c0ce0d0a74b0a21886
SHA1 769e7d17725bd7e2fb2fe9c659c7f1268803ddfb
SHA512 7b000c38a3c2757b74133a27eb0779cfa0fed8552eee85d3a49307d182abca1a7fe43bfa58a94e2b0195913b60a0b409aff07cdf60c2c05010340c34592dca01
SSDEEP 24576:PT8aLl3z0zDq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PT7LljPLNiXicJFFRGNzj3
TLSH
T18F7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 5ecc23339365f1bd15ab3ed2ab7f832a5270468724a645a8210cf97d3c48484d
MD5 53c926d5dbfdeb385e445f03e41a5f66
SHA1 f6d523db68f6fcab7a727ff876da49d723419c5b
SHA512 189de22ef072761542bb52bd1541572221deb931e80e8456de68ba2c22f5421be2d26edeea00198218abd8a35570452b53ecb2cb3c9d79f720db67321f83e122
SSDEEP 24576:L3rd9CHKy7GZ2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rrd9CHKya0LNiXicJFFRGNzj3
TLSH
T16985CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 7210a6021d2f9e5a5c60b75564f04497c5eedc3e6e57d1bc350375e59fcd8cd9
MD5 65d45be4138fc2d4a2039091b1965ce5
SHA1 ffa2fa4a5c5ee7772adf85b60c0f47f1126a9218
SHA512 944805959d00980788f2471e5f70ac117555f0a5102e2a06b9a9448a351397baa3690232077737a54ad006466950c44e5a02b69708e12a55d189e6b10cb801a9
SSDEEP 12288:TIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:T6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E25523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 49d3c622dbd5813c0a21ea9a9f3c179e04ca31839efafaa72279c86b8e8aba48
MD5 6390e22c6809f787ecfffe68e043e6c7
SHA1 46f5a893e47251e8bec77d41d85f8489f2dc3277
SHA512 3397a530f58cf55e320204db43c9de68fc70ea2cf7adb538451d966a095a7492f80142bcad2b0790a53d02332df5d6ab1b43b0112aa3b63ec213e53efa7de85e
SSDEEP 12288:yKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1355523D2548955B1FAFC003986764424F5882E2DDB6619E3E3443D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7d75b2efafab3593ab9c3b45c48f41d5aea84f945410649b8f7e74fd63c416f4
MD5 00435485fc7bf4242328a06cff932d3a
SHA1 747218620337262ce171af2a59198cf7f2f7f6f4
SHA512 342d795f2e7bc886ebd33fabdb86f411f4ce512b2a6dadcb1fac40731ebed4b4f35be6d399a1844f0277f7515e88fdbda8ec43b79469ff47c28b2e01188b5643
SSDEEP 12288:pziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19D5523D3548955B1FAFC003986764428F5882E2DEB5658E3E3443D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f00e4a22cc1d7fc70915e8367ceb775aeb2f7a3d37b58f1d927e1045f58fdab4
MD5 c17b5f8e9bcf095c8e9926fb0910f9df
SHA1 dc09fadb0615db7944d62ec10b35af0f29c8da75
SHA512 3ad7f792ce82cbb027474170c263f5c22917ebf26db9136aed8df6a90b9cbda604b54710d401530482d351286c897d5bd099aa8f49837e9a4dd4b5bcb3479acd
SSDEEP 12288:PBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Pt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1255523D3558955B1FAFC003986764428F5881E2DEB5619E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 400a56ea02821d6cb48c0b9633257625ed2c95c28b7602d1e3a0edb0b0f0825f
MD5 8c5cae203492d3f8cd0c8a4eb8ceaa18
SHA1 6e4373da867675af1b28c8ab058108d27e9958c1
SHA512 24cde612a50bd2100b1dc0df684a53201541d32e6455612fc7944468b8c9201637390959b9af8bbce8c12578a3e9bce5af46e3266e0bc49363e57730a0f0bfd5
SSDEEP 12288:PIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:P6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1435523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 00691a8ba54337f46ecef75e4ea9a9897e41d452530b1f6babac03fe0a0d76c1
MD5 d6a7e77f569a20d0d135c49126e65186
SHA1 7ce8c32dc805c6b41c50ca19db276f0d8ce4b93b
SHA512 9da8465f0e55996c2507d250461100cee161dd4530684b999020e32d97bb89726cb586459f511ad43112bfdbec35f5c9d27f13f01cc710a1e4371f21de9fa590
SSDEEP 12288:fZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1885523D3548955B1EAFC003AC6764424F5882E2DEB5659E3E3443D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 59de5590fb216b886c8769fd2e890d453444c01691f34ed064f1dedd553e0058
MD5 0ab8c62f8a7c0d2fccee9bbb10863b6b
SHA1 c7da2bb084dd25b3dfab569845dd45f40fff6e67
SHA512 2b7c5cd328ec15c925817f9336b66191e264e410b5696a9060812e4cd7b59974ba7f81eba769c8fcbc63fad744ff2c7e1a4c0f919de542858721d7c15ec81bd8
SSDEEP 12288:1/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1185523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 07023ad4b4a133ba3b5e090e17b05b97a699b7d5b9717eef7f9b495b6ea37de8
MD5 b6beb8ad1f3b55520d544a289fb054f4
SHA1 dd51f1d0bbbc87675b44f40efa206b637dd27d1e
SHA512 91c4b05004f9f04b2f5abe1f8b9254ddc497be043fb9b5f97cfdbe4d825deb3650904f07783c98da576598731fcab72e43cda8b78cbc706cacfcd55ba7eee99a
SSDEEP 12288:twiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ti/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FD5523D3558955B1EAFC003AC6764424F5882E2DEB5619E3E3443D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 455f318a8873e582c97793bf59021e294d523d85909def8cf6e7e68c615fb3af
MD5 0c053aefdc2a5caa409f7b172e6c6a11
SHA1 bbbe24549d5c1db904b40f2e065f62d1c2fe8bbf
SHA512 4e0e8fb76457eb0265ea11a22544b13192df3a5470dff2d313880c5b21e46b9d07be159e0dc72b356934befa8758ca4b440887583ce9d999de7b9f5cd411aec9
SSDEEP 12288:r/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1205523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 b64c2278d97de91fe4f545ca4416c5242435ced7c0828d7cfdaa4de909e46bfb
MD5 642d17569d63ce9ff0fde5a5e2c2045d
SHA1 122e5c250bf58006a83988f2d8a7bed423d07175
SHA512 a952828f939194a2444c1c07503b1af5018b5023edd30f8b3d40a4288b8e776b5899db95cebcecd73726876a53674af148e8a712bf17e5c174618de92bab302a
SSDEEP 24576:xfwvzk9RX6wkyAIh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wMnYIhLNiXicJFFRGNzj3
TLSH
T18985DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0637f8009518817e25c648913bf941f98744c80b8e73638e3e0e2b13875caaf5
MD5 f013a7795504b3a18a0945011139451d
SHA1 6b50732f95e7bd11d7ca16f1ca6724b5178aef4b
SHA512 32ae7fb81df787f8b593cb6b8cc1662cc32a796ea6e116fb7b6cddd2eb651eed829f5b8b6e66e5dbe7466af0cae89bdf146ebf71b575b9562ae674696887aab8
SSDEEP 49152:oYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0OLNiXicJFFRGN:nySzP27wRGpj3
TLSH
T173066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fd3c8d715b59c11ab233b2bda39917123819eaae90be81096cd438a5fc153ded
MD5 7a1db933a74f61269cf93aefd7fd42e6
SHA1 224e9de7f25fef6f272732eb3d570b7d4c7f7bfc
SHA512 0242a97da783c9d7a3f14969c32a80c782a760b8982d2757141b9314f24740ca0e3d50ee95a702a94d185973367964cd020e3937cef8a61ef624e1660fe9ab61
SSDEEP 24576:A47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A47JUQjqirIhCnDHUPfF/+LNiXicJFFS
TLSH
T13D65AE1EA3EC01E5E1BA923885154A1AEA71782D1F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 5ad665a2027a37c8d2304bb386385cf4cb1df2ba89413cc498c934abed4a41a2
MD5 c063501788efecc708b5a5ed5a8aca95
SHA1 b7225ceeb87ed764fa0f8ddde2ca9c0f561af9c5
SHA512 da12965a955414607be1476f8d8ac02469aa357aade78684ebe1ebffbcf3693ee34504af7f33ff1f4501cb5b2eb3cbe8e4d4f508f99371800700dd2515adf174
SSDEEP 12288:bpsfxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19865F15AD28802E8D1AE5139C7664900F3673C2987E193CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d24551b1a15377c8acadcbe7a9b2371c02be53b394dabd2e7b711b7557ef1761
MD5 cfe023895572fac9c5f60b1e216d42ec
SHA1 7154b1e6fa39f30ec062542a336f50e25538906a
SHA512 d90e28e17909cbe1411b119203412cde97272f7bb029432cfc684d57653ba98075d6b2c1e7a31506a534e3802816028d39d8adaf7b592563d8e16b85e7833b71
SSDEEP 12288:tHN0PTU3fQlFVSHqhIgsiqqR9NoO/rOd4uG12tS8ZY81LOmzZ:tH6LUPQt+gsi3qO/rFuGwtS6YoLOml
TLSH
T1703507407667C78FC6A940321E36D6CCA7707D01EE49AF0773C9873F9576668BAA12C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ad1af520c7e7114a4ec9ffd7116ba0aa81b87cbd9ae2ca466096de427265ae00
MD5 6029ed0c5eb7b571ba0f5c7d3b50d099
SHA1 67f732207861fa14fa898bba81f876dc243d010a
SHA512 90c2e61a8926a31f28de2495b6b5930fbb4dfd9fc581aa0b6f6dc5f32766a10996d512fba536948ae6d20a4bae0e080567c2e7a4d776d8066789758dd48e3424
SSDEEP 12288:/YSERLzj3nrblJN54EzlQndKk70Qb2G8UBGkizdAscpAZs7Z2ymw6i4k:/YS2/lH83KtuGkbpN2z5ij
TLSH
T1B3653A4165B7E74FC9AD9037463286CDAB745C06B7493F0173848A389877A7EB6E23C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install.log

Path C:\Users\Admin\AppData\Roaming\Toolkit\Log\Install.log
Size 2KB
SHA256 2ef3a7b51c1069d64aaa1bc6728bab5a82b166c32bda874afa31cce21dfc265b
MD5 30c293adbc9471668a0e55bbac3d3c7b
SHA1 91afb32d682e33d3f997f4ff34eb46c9f237b591
SHA512 03fac38f5187851062857a2d2330d7e75ec01984f84613d4744557295bf44859571bf898c9f53659aa7d054ca2784766771f38a995e2c34fe51a7ac630a81612
TLSH
T1FE415CA642FD8E1F7E62956AA3754E4C7C6BF609BA4F7575B7205C8C2100834FF81207
MD5 SHA1 SHA512 TLSH

Submit Download

Install.log

Path C:\Users\Admin\AppData\Roaming\Toolkit\Log\Install.log
Size 1KB
SHA256 f280cbd436937d2645b13ecb2364f01e8bf876abd030e90ba03b3e637bf5f698
MD5 3d4d5fe977364f23682053220fc749b1
SHA1 4ddeaf9a856359280385ad94e38f65708c20ad9f
SHA512 11edcca7d8a7fb6d186ad8f759b06fd270b9aa3651ebafa01d885b486077e38d2d6d8938ff8871899171efba4f5c00a633bf37048692c05609dd67bc916820c2
TLSH
T19221DD6552FD8A0F7992947672A55E0C68AAF9097E8F7A75FF2488CC2340834FE81307
MD5 SHA1 SHA512 TLSH

Submit Download

Install.log

Path C:\Users\Admin\AppData\Roaming\Toolkit\Log\Install.log
Size 1KB
SHA256 692188ccb6a3a157c1938194ef1caddb45470cb67ef3f87d4d68829a7ef69e06
MD5 11e57041855586f0732c92fe796a0785
SHA1 3709ae817b0a40a314e69a1e0781755c3a93eb34
SHA512 d859e43d93fce2421b25b0016952e879091ce359e55d125741839c91e217514399fc694d4750e9dc9a6ae7dca8c964e24dad42b6fe8208928444ddc240ca98ab
TLSH
T1CC312EA592FDCE0F79A1957672654E4C78ABF9047E4F7575FB2098882240834FF82207
MD5 SHA1 SHA512 TLSH

Submit Download

server.ini

Path C:\Users\Admin\AppData\Roaming\Toolkit\Temp\server.ini
Size 13KB
SHA256 3a2a761c87a2436f0f99582b7083a61bd34035ed01f6a041526b912060bcee5a
MD5 738a4962c390b776a19a6c444702110f
SHA1 4c6a15cbb7e0ec4452c9312369eef707e4efe59c
SHA512 eb252ae4fcfa3cf4fcaea6ff82122225499837c419ebf4939c153dffd56b409b3c9f1c3a44416ff099d303d0edb00de1969aeacda161819d3b3d478e8cdcff4e
SSDEEP 384:2YFpJsHODf4bVMNaa2zEmLeRnnK2d2rCE0nHgVuc6/hhBJbiSJ:2YFpJsHODfg+aa0EmLe5KA2rCE0nHgVU
TLSH
T1B45204D32275D5B2F8B08C5CB52F87F6E7C2935DCE8A4094E1D981D6BD83029E96E0C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c48842fe548c4580e9c017c25a4f4fd3f19ab6643e1f48256dd98657013b8548
MD5 14a47fbbb383ec2f2925aaa9c8be7f9b
SHA1 f095cc8ad54325569e6857db973d6da0bee14b10
SHA512 1d9c273f6aeba3b8697afcdecb377ada3daa2c10110a3a336a2b3067943bbaedc47869d765b6e435a08f4c78a27098cfa1a6fbac0629577e3efedecb7665ee67
SSDEEP 12288:eF7JiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B3552393468959B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8400aee2ca0d5577a392b4c44370eb2674a8eccc3a9bdd3002263c9dcabedd56
MD5 dce29c5687c5b49792ad07b1d8d5b85e
SHA1 25edd40bb54026c789f467065d7521f8f937ad02
SHA512 c53051ececac669fd05f5d630d720794eee69eb009516768981c98c2864a9bd13cd355418e86a1bc6f89390266effd4047f4dbfc1d65518490c4376531099490
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Lgb4mBIBhGFYLNiXicJFFRGNzj3
TLSH
T1BD65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 7e73550a046bceed1f0d3e52efcfc52f8950586a1549aeefad8bb58c2adf464f
MD5 6d28a144538d23e1cddddd26d08cc712
SHA1 8e11c1981d684ae410b0ce34a45dcfb7b4ec286f
SHA512 2c8184a6e12e28e44c80c0f91435591504d841e05d874aa008e6ed2c0a52b9a9cba5275fadb1083f9c1ae1449299ad172351f4d8807be6ae29b9e0ec9e4cddea
SSDEEP 24576:aG88u8FpJqH1vzria7/mo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:h7ZFPqVya7/nLNiXicJFFRGNzj3
TLSH
T1A185F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3027c1ca72bbea90ab23f5a1050b5530c176b974839ca14fe525bad8d06869f8
MD5 cc5e77e2f62853532b73d63c059c6d4e
SHA1 f118e3817a720ce2d65b1e04be08a0e1615037db
SHA512 5e9f5560f93b3b3141c44d294fa2174f1b636316b9f188d0367346ed84f1025f7ef21574c0dc951cfc34de63ec891cf0b81595e1d4e33fa90c4e95b843a20b25
SSDEEP 24576:LPUr+NQ0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LJQ0LNiXicJFFRGNzj3
TLSH
T19F65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 26049704c580a870b011f8f5311ba9d317fa0283306ded128bc4bb88d80984e2
MD5 03d08daa31aa7665695ae9d9c44aee38
SHA1 e20f8b8a4dfac676630c70b80eb283c08bcae2f1
SHA512 b9c812bd6f9911efc6d6bed674a935751fa62c2dc2f711452d4d957e276245ea09a4bf34aade22ed82a7efeec77c668b07095a23ff5e3e85032132367a4e03fd
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjELNiXicJFFRGNzj3:MG05lO43b57wRGpj3
TLSH
T1FED5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 be6d12a6602b58664e81310902df41ca8e8185fe2518e9ce6673620718e5db55
MD5 85e2de1c96a6d4096f1eb1a6cf9b9781
SHA1 09af5e3afc5d5dd997ee8936d13ad68e5b3bc9fc
SHA512 fb1f861081517224543c2754092fe8524e161fcd83f67ecc740e3d2a9cb76c5f2c9cc8e10d315653ece60ce94e9ee0fdd0c443ab36a7ea8fa39590776c5cb392
SSDEEP 24576:afa5POZ3dpyWVM50JicR2hG0lasx2+47eidnO/TwSfVcYG3K/cJHlnFR+IGNe8jg:ya5POZ3lJt2pasx2+mMLNiXicJFFRGNf
TLSH
T1ED65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 005567855a836fba157db6feb9c771969204334690a4751f953c636643b3badc
MD5 16ae2eed4f555e679b9f49b4d9bed002
SHA1 1becba450de6cb7c502059ded52195b9dd636ae4
SHA512 bdff9f9383734f06f019ece4fe75f83ec3b8c598f303d091943cd0226984e4fda2c6d632b80b30c13672f8d8cab0b302911f232279e72f73cf42ea03fbc752fd
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JNc/zEOVHFHLNiXicJFFRGNzj3
TLSH
T16D858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5b7f9c595e1e3e8ba1a74c0554a784af652f3de0d460ed9941d56db72835a562
MD5 f628c50d8c8d14e1e7cb8fa7422416e2
SHA1 8dcad30aa553f37547e8dbacf43479dc79aeb87f
SHA512 a175ac8b7daca1dcfbcd6ac86c831b8036087be7d9833e47b00b46073d12e661a4c6eac927075af523fdbbae7ce0337a56998ad3665957f01edced533ba80d6d
SSDEEP 24576:HzkNvNnaFeYhJNtmZBmi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HzMwBtOmiLNiXicJFFRGNzj3
TLSH
T17055AF6EB6E806E4D1FEC675CD238512F6727861073292CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9eb6f8926562542cecbb97d89f4a3829feeeea66e1dc7feee0f79db6f85c7a60
MD5 79eee4089307e589f1c863a5e0673d1b
SHA1 6e851955755712e37e4e931947236b7cc6e82e56
SHA512 89d7e34cb2ffba47a50a491cede57843e907fab541cf8f5586e55464a244ec8341f4ea375ff5e1a9b66e7eb8a3baf000ebcc02f3f35021fb7e74f208778a05aa
SSDEEP 24576:7D3FHshBIYQgAp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7DVHeBIAApLNiXicJFFRGNzj3
TLSH
T11875E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-199-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/948-43-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/948-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/948-51-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/948-50-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1308-116-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/1308-110-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1308-111-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/1308-418-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2060-109-0x0000000000400000-0x0000000000944000-memory.dmp

Download

memory/2060-0-0x0000000000400000-0x0000000000944000-memory.dmp

Download

memory/2060-376-0x0000000000400000-0x0000000000944000-memory.dmp

Download

memory/2060-1-0x0000000000BE0000-0x0000000000C46000-memory.dmp

Download

memory/2060-8-0x0000000000BE0000-0x0000000000C46000-memory.dmp

Download

memory/2092-419-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2092-162-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2092-437-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2092-151-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2092-439-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2092-145-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2936-78-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2936-77-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2936-84-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2936-343-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2988-425-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2988-200-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2988-423-0x0000000002F80000-0x000000000321E000-memory.dmp

Download

memory/2988-207-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2988-201-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3596-164-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3596-163-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3596-156-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3596-420-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3596-422-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5076-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5076-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5076-170-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5076-37-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5076-38-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5456-177-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5456-179-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5456-424-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5456-171-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5564-196-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5564-194-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5564-189-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5564-183-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5564-182-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5748-364-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5748-96-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5748-88-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5860-56-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5860-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5860-75-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5860-62-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5860-55-0x0000000140000000-0x000000014022C000-memory.dmp

Download