dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
Size 6.1MB
Sample261003-ntssmaxejh
SHA256 dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69
MD5 0339742dfd6f6a86de7b45eeed68a4e1
SHA1 f9408779e67f91c6bbdc7ba002444155cdf82617
SHA512 028044a503f0fda59c6d9c6c376c45945e97446f4fb15a053d0ac67b4692436c14367d4ddbfe60ec2e45da9d683f15d1ef15f6c82e96fcdf06f0c348d8e8163d
SSDEEP 98304:OjTa1Tc4LQ3aRP0LyvHmVUX2kdWSk5AF2qcANsRc/Sy:Ojm1A2pPvg0V25nq7Kby
TLSH
T1FE566A13F29500E9D059C178CF5A9232EA72BC990BF171EF26507AE62E76ED07B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4376	elevation_service.exe
4828	elevation_service.exe
4468	maintenanceservice.exe
6020	OSE.EXE
240	PerceptionSimulationService.exe
5708	perfhost.exe
2824	ReFsDedupSvc.exe
3692	SensorDataService.exe
4764	ssh-agent.exe
5472	AgentService.exe
3972	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\system32\vssvc.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\system32\dllhost.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5a658da5e4fea11e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\System32\msdtc.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\system32\AgentService.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\system32\wbengine.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\System32\vds.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaw.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e7cdc372c53dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069a53e392c53dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fae7a47a2c53dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb27fb392c53dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe
4376	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4952	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
Token: SeAssignPrimaryTokenPrivilege	5472	AgentService.exe
Token: 33	3972	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3972	SearchIndexer.exe
Token: SeBackupPrivilege	2824	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2824	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2824	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2824	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2824	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2824	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2824	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2824	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2824	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2824	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
Token: SeDebugPrivilege	3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
Token: SeDebugPrivilege	3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
Token: SeDebugPrivilege	3216	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
Token: SeDebugPrivilege	4376	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 3216	4952	dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe	90
PID 3972 wrote to memory of 1340	3972	SearchIndexer.exe	102
PID 3972 wrote to memory of 5160	3972	SearchIndexer.exe	103
PID 3972 wrote to memory of 4108	3972	SearchIndexer.exe	104
PID 3972 wrote to memory of 5908	3972	SearchIndexer.exe	105
PID 3972 wrote to memory of 3528	3972	SearchIndexer.exe	109
PID 3972 wrote to memory of 5436	3972	SearchIndexer.exe	110
PID 3972 wrote to memory of 5256	3972	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
"C:\Users\Admin\AppData\Local\Temp\dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe
  C:\Users\Admin\AppData\Local\Temp\dccc022be43dfe9572192df35a9301522e7b290579cb64a1875c5b2930a3cb69.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=101.0.4843.43 --initial-client-data=0x308,0x30c,0x310,0x304,0x314,0x14054de18,0x14054de28,0x14054de38
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3216

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4828

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4468

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6020

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:240

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5708

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3692

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5472

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1340
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5908
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fb79fa3fb6306fc09f773caaf07915df72608c5a049aaf75a51cb36a9770dcb1
MD5 ae4285d3b14ecbca07e7ab27e041425f
SHA1 0975e7d1ae96bc1c95dc5cd35a1837a9ea5178f6
SHA512 58fadf871cd73854e46303a690f1618682fbc3188a84e6df4d435be97007b54706e781e13304336cebfb37bdcc67f5ca919d7aa6d56d6aba72593594e0576db2
SSDEEP 49152:Nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnz3cy1NryByocSuSy:T3q6mjBQcANsRc/Sy
TLSH
T1CCD58C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 ea99f0147f82c26af93e3d9c92531de633176a58558fd2983213bb11b0ca2990
MD5 a50777f1f535ecab19466c20231d4116
SHA1 c0e6e19789da122b6da4469c4f276c897a9aedcd
SHA512 68a4258ec1be5f74bee75abbb987841a6711b298953afda062c65a7d3572c5a27d18b8f8cc66350cde5c108c335d31e411ce2aad3353ff10708ee814099220e0
SSDEEP 24576:1XYfDtczAM3tnay1F3zryB/HIPoaRGd2FSy:gtcV3cy1NryByocSuSy
TLSH
T1EA85F22837D109F9ED67827DC8A28506E633BC558760E79B03B4AA250F373D81E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 fa1c095f3f1097ccf2fcccc4d98e5698af3169d37becaff5d2d8cb825bf8efc7
MD5 d6c0c8f1053c5d5ff26e2e20790f032e
SHA1 c86ff691af2a443739bd2618126d52629a7f4347
SHA512 d7516d3daa0d00baf5f6c3d935e99cca5646eefe502676deecf0885e2ccd334c0afa96056f7ddf162beffc0eb767ffa05118ed9029ace1c6035fc97976d1f94a
SSDEEP 24576:P0Le5ji0hmxhrMb3tnay1F3zryB/HIPoaRGd2FSy:PPji0AzS3cy1NryByocSuSy
TLSH
T1AA959E16F6748375D073C0B9C5D2A68EED7130825B308ACB4296D77C2F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2d7f0b43d9ba5cee95e36c0d868384045cf303c34d9c8b24f2d8372b241145ad
MD5 57d1d32a728fab3fdb5ab3906c242d9c
SHA1 8280406e93420eb9edfc82eb8204f41e4d090db4
SHA512 6b9ac6b1a3505d355c047e9eda2bfe97251493b9d658fb510dd1293a382187e39e94701bf53014474f86f1cbd7a94a0bb42415bce413d131ae3f0b8131b2c932
SSDEEP 24576:ga7/ezSC6vUyD/aqgrvWj6q8wyuF3tnay1F3zryB/HIPoaRGd2FSy:X/ezSC6vUzPv+Hjye3cy1NryByocSuSy
TLSH
T187755C15F5788323D0B3D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9e1369160f1a75e45e0dc8269d4fce121bd5612c9da4e6c5d3df63ea7e770876
MD5 0d161169d43f4f23662ee94d716cb7e9
SHA1 0989ffa602b6f1a51f36bdd872913566bb21d55e
SHA512 07276b3c65e6cb5d0787e433d8c95a33760715594bf796284cc0f8dd86be022f615063a0e8cba39ab708369918d5eda281486da3bc274046273d8ab3fc091a9e
SSDEEP 24576:OVbqPb88hv/l+BQ3tnay1F3zryB/HIPoaRGd2FSy:OVO88hXl+y3cy1NryByocSuSy
TLSH
T1B4559E66F5B48331D073C0BAC4D29A9EEE3234425B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 003e720394af95fbf20f2fe56b72f32a5852b67a0fd65fc92fa8a77faab1c78f
MD5 fb5045a3380c29d926db2ffb7f6a370c
SHA1 0f669858404fe4b1cbf9295fc1334e70beb4a97f
SHA512 f6c8f7ac5f4b544203cf421f96861fea8bae52cf0e661517f85b662e23808fcb9c0042f224700f2da8e3c86105ca4d77ec1eba9d8ca6f41587c94a9e863980a5
SSDEEP 12288:XGv4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:XGP3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T1A16523C127C15AF4EBB3077754E50C8F9820EF84EA686769DA36FF0A053C57C49262B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 58379232e986523167351ff7da7c7cf8c1c7b8cd7193e0867fa0a898fb1217a8
MD5 6684fc67853fdbe786d0f27810254298
SHA1 e1664b2d120bed037729002b99844f0cfe4e19bf
SHA512 11671f114d0856ef037d8e0784318bd78e543b96fea66d70e343636b97d32b18b816575248530d18ef8b8505d1d183d22f6e7e517af8c93b606dd4f6351a2b8d
SSDEEP 12288:neBNUbTVO86Ui4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:nJIUY3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T18B85D07BAE28FCE1C27A4DB956918600D77278308F61A3CBD175D30E8E275E41E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3d3e0870da0b6f31eceb26c279b46c443ea7865bc8c90b238b3700cb6ba036e3
MD5 f032865ec128e05ab1a757af7bd5bb8f
SHA1 1b4d9b421fd1c8d877e27c6b1d1ffc10ac83a5a2
SHA512 0c414ee0db6d55b1f8d420ca51f03cc986053910a54c53ce04d029b8984af7c0dbf0ff0b695a7fb9430bcd374205fa99c453713fb2bdc2a03546a8e7dd2658fc
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH4:TQvGAdlCEL8c/WRNw5CJcANsRc/Sy
TLSH
T123267C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 417cef87d606bc55b1d6445455ef1d7bb1e665e3f424673775aa1474f4025330
MD5 5e9e9dccd2e6e9150c9ba4426134c818
SHA1 8d36356cb99a530472645a113bc367e8f180a9bb
SHA512 f9152edc0281dd30c095bc110459082ce797a81e2ae7aa689b64b568ff1338047642385595dcb0c1cafe89cf90da46c11e7de530a890f8deb4dab07b60b4a682
SSDEEP 24576:afewsAjC3tnay1F3zryB/HIPoaRGd2FSy:AljC3cy1NryByocSuSy
TLSH
T1EB85E031FE70D436C7BB0DB61B65C716543CBA204B511AC3E3B8AE9E49342D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3853f5e8387b63f5507330d6505e87a33c73e1a4976f17be5361dd1d8ebe1a3c
MD5 551fa1e1d7527dfbf944f98a8f37df2c
SHA1 e7395b7d8afd47d7c796f99de643036b50fd041e
SHA512 5d7f2960a737d626fb098bc35b946f6afae1525ee84990c918b47114cfa1e042c2a5b4c707b3f96360008c7f94e5b2a3381fcb48a9e678077b8e7cd81ca7602d
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH+7Kby:sUEtQevvqc2W1cpV20I32+7gy
TLSH
T1BA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e795e4764eec7c42bfb8bfa711430d95f8541b6f8873691fdc8554b0e9b81831
MD5 71da24cbdbbecc6814bb5f5ce391e5fe
SHA1 b36a222da6e386bcf4ca7ca305cd6d7d2612c111
SHA512 c78cb4ad6eddc5c1019ae58e7bc4c89bd17bb261da3937eb61295ce4597904001b6a6b3db39e57ef64dd75215fed86406350d06e8e1c773b3ff6046fb1067ebb
SSDEEP 49152:aCbRquA/m2yL5zLfFiV+XenmE3/zi3cy1NryByocSuSy:voq2VjnmFcANsRc/Sy
TLSH
T1A5D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 649e8be6a8ef874da4cd4bb59ef4b1855e586d5842af8797e2ef63f4348e83df
MD5 7696d1ca7c6e6c45daf648937086011d
SHA1 0e85479439822e08e399b09f90a9eff79d84c363
SHA512 2f228eee78dc635287089cbe095f1589626b2e5ac03a3f5690480be146cbf70e8cb7726ccae60d503f7d6f15c24c5d3060da906ffdc169a6bffb977ba56ceec4
SSDEEP 24576:iAhGL6IFoiwtA5l7S53h3tnay1F3zryB/HIPoaRGd2FSy:iAM5Foiq5x3cy1NryByocSuSy
TLSH
T120359D80E7F955D4F5B3AAB899B68571EA72BCA55E30C20F2160D21F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 bbe70ba7e43412be261d9137ad6b6369e99c86c126d32902b76e80c46b57b959
MD5 440b82aaf41d3a053e6c4ad6380342ff
SHA1 769d995dfcd1fd573e195db49fa1dd690579eab9
SHA512 7aa5fdb2653b5aea049b05d8c66a86baad81926b204aa4ca79a9f208b3b90e97de3b67bf20bb057d501b1d14b9c523fe6e2a5f17bebabbd4efc119141c42d107
SSDEEP 24576:TwuROW+3tnay1F3zryB/HIPoaRGd2FSy:TwSOt3cy1NryByocSuSy
TLSH
T1C875F08536E50CF9EAA3823985978536F7B2BC012A25D71F4770D71B1F3B2616D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 8b4bff0c39e9fbaf84747f538f721e15c0dce804f2b88f41e8bf03af5af2fe1b
MD5 ded3f5f557177d7fd6ad935b8d30fc36
SHA1 b32c0c3792d66c14b4b0a5cfd0dbaa57264a0d11
SHA512 bd7682658ee3d022bc90b836a89a165ad4602b9186bcac10b8b1239c6b362339115a3f08942ae1568f68d4fafb9422a0c8f284839206e1daea9ce215ec58f5fb
SSDEEP 12288:byZ1IyM4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:2Zuj3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T1D365128933D021F9E2B3427E88E1494AD731B852A73553CF5635B75A0F3AAE91D3A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f22472a7ae47197af1c2bbdea7b691f805d1544d8620349be6aa93234552680d
MD5 85a02a4e4f8d09899ba5fee22a53ab9a
SHA1 23ae4a413c77961c0c6d6509c7f128c75ed6b19c
SHA512 8fd0946bc05399f328bdbfd1d3239a931d30015f61731a8557674919856674c4cca5bd298081d44414172fe736231bc623888ee81fef796bb7e44f10ddc8bc76
SSDEEP 98304:cQRQyi36YOcPDLvw2gAf+PN3EcANsRc/Sy:DQyiKanX+PNU7Kby
TLSH
T158667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6252d0339bd6e9a3341b565d37405650f76ceee5ee368fc74503feb2e50d2378
MD5 9577e9ca1e184320a4a3632a37c798e9
SHA1 7aa2ab6d63dd54e7403228f942eb66a5ab19a17f
SHA512 5d78384f94bfe615c8850c93ff14f2f07683fde572b842b786ceb9e2ecdf1583bb9b421d9e20f9ba8518eac94e7cc66b4d67af1bb260aff5902c6c57a1021472
SSDEEP 98304:sQRQyi36YOcPDLvw2gAf+PN3EcANsRc/Sy:zQyiKanX+PNU7Kby
TLSH
T15A667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a2dea2fcae7b4141c894189340e4d3e803c2cdbccc71b4a06cd9ed571f57adb0
MD5 e157f0da3ffaf48fc92069c04265e77d
SHA1 86204d87e21871c2d535f5576410370fd44e9361
SHA512 c2ab41a3c28849b3e5199e4a7ddc7632ddbe39d30247523cc953f4515c83e51f20c7e6a0a1d30a8b79972a8e36db84cdb3cf14c769d4a09d4869ba6b89286d12
SSDEEP 49152:k68Qg55nhkeWu7PNU3/S3cy1NryByocSuSy:OthTRc/mcANsRc/Sy
TLSH
T113B54933B2F200A9C45DE1769F4A872196D17C75CFE0E3DB8511720A1BB2AD47B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6cb562fd8c9d95e152c4e0f5844bbf4e25ee0b58a6de8bb0fd4d8d06c2f99f33
MD5 f7879e4e1de577f065b9e40e51183781
SHA1 44ad9cd18c29a57b70b952aa2ef062f3888f013c
SHA512 7d0dd07f3e23e575d9ad02a77ea14de532f359644f18df4412694487c49d51ea4394474249319f02fab0aba4fcc15eb4c23c2ce72fd280d45516f6619d668fbd
SSDEEP 98304:Fy5112gYy5azzVvU69nLKnhZPcANsRc/Sy:oLIHRWhN7Kby
TLSH
T1E8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7f1ae1c253729e9444dd61cb3107fdb3270847d99c23aa5b0039a13ad92aaebb
MD5 68585cb97018b5f5e4aff4c9d89c0ebc
SHA1 067116e5cd6da26090f862e67ba91685dee1d0b0
SHA512 ffca27c3b76beafe7bb8a99e73395666768d955213891c4a82ef40fe103628a7ccd91c0b6d98f7fc8a279aaac4c4d957997be021e9e481a2d3af1b55866b6add
SSDEEP 49152:MB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glc3cy1NryByocSuSy:Gu6JmIxd2d8cANsRc/Sy
TLSH
T11CD59D13F1DA01E8D06AD578974A9233F962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2a2297d4f2d7578be8c6265ac27141895e9520899df1ed639ebbc956a6af3ab3
MD5 28ca33bded546808d8b1a7b24e89a35e
SHA1 3d3974cb13605946ae49c73af6b81859a430f81c
SHA512 f24bf155132b8101104b94a624c12beb6b73caf0af90edc81fb26d091c72bd5da3d34d890e5e5bec4f8ae1ca4c72d98129a5d656128f72ac6d877266185756d6
SSDEEP 49152:w1hpsNoJpF1A67U44CwH7R4x43cy1NryByocSuSy:wmifPqRFcANsRc/Sy
TLSH
T1BBB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5072f348d5389fff4429a886a7d94cbc3fa4ae8a3bfe8da5af664665fadca4e7
MD5 a483497df09a3cb0a44df0516498e782
SHA1 2b699d8354630d7a4c4437c94c5a52fbff21b5b4
SHA512 48d2567330b56efac96200b647cc773c44974c7d39ddc9f912a99209dc790064d8f8ac54698813734433b824eb184570c6980bc66f32cf08f1ff8fe23e52e43e
SSDEEP 49152:cSuZQIY0Be2KkRVtOnks6NMHqj3cy1NryByocSuSy:e5dKqi61zcANsRc/Sy
TLSH
T1F7C5BE03F2E941E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6959cc738c8ac37e15c034a3369f7c7d12f5f636e52eb6932d46a36314472f82
MD5 93af9eb30eb7985d14d8d7f1db5c478e
SHA1 714970abf8edb56d1bee07a89bea13063bfed1db
SHA512 2ac3b4080eb9872d21d29ce18cd3cf86015aed1976f042d3ecf9aac3475f7ca8662a5b410e1f7d317e10140b9721154bf8fc8b558e4fc034f84287c6130ebb7b
SSDEEP 49152:ThtSn8EApI0figjgiDn0AP5wM3cy1NryByocSuSy:SX2iWphxcANsRc/Sy
TLSH
T10C95BE13F2D901E8D06AD179C7468632E962BC160B38B6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 ee246f2a0029d352694f1d6e698bf7096321a71ff3dfefad2735c8073aa9039e
MD5 1744efc3e75de2542f7b69122f7d2fca
SHA1 d2fbdbe26e0a3ce7093a22e619e46eecbf4e2d62
SHA512 3fc391b71783cd3caa5320d37d3f94d3206c880931dc9f952e6a1245207876ccb3c039c2f708018ab8412276f8e4c051a15eeaea3d468b066e7a4355b307e45a
SSDEEP 12288:f34PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:fX3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T11F65238436C24AF9E7B307B744D5088FD820AF85FB552369EB36FB0A067D57C09265B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 e57fb6939745d7350d8d46b122617447963ef99cd87cfa7660401c208aa64398
MD5 fbe86bd8ec1dcbde7506ba91d9b88397
SHA1 a520dc05acc7040c910d139d5d16a8485c600044
SHA512 95bc1159d3941b71ee933aa1383cf138296549c53d10f67c7111dd14ea75f7bf2ce1f00dd207dd4033f27f74c88870f8074ab96b2143d7192d70ef7444f2652b
SSDEEP 12288:Go4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:GW3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T1A36523C436C24AF9E7B307B744D5088FD820AF46FB652369DB36FA0A067C57C09265B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 67538b3627a86cd6ea08b41ef712353d2ed9136ffd981ecad9f04cdff57ca0d0
MD5 2713bd88bcdd05d98ffeefc604a60ecc
SHA1 52590690671cd78a230c48bba616466ce2004250
SHA512 bf4e8954ccc2c9cb58b13db8ad4959cb0f702dbc5339ef51e582774b5933414608db9c8641148a48a83a052a6a5118ace6a5db779b8197ccaad9afcf51bf0689
SSDEEP 12288:IK4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:Ig3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T1C665238436C24AF9E7B307B744D5088FD820AF86FB542369DB36FA0A067D57C09265F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 e5b495a82d517a297090992bfd71aa06381bc71219bcb9f56612781766ae89e4
MD5 bed29a4e856f2e45496d3001fc433cdd
SHA1 6b4bb4e53ffd783b01054d47ec078a6c34c1f56d
SHA512 11b75660c0c9c5962d3674f8999cc01a14054d0b7b050fd7e3cec2ed3c267c1b149b241f54365c8ea2293f3f9facd84ea18d81477bf4bcad5355423dca4f05ed
SSDEEP 12288:8V54PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:M3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T1AA65238137C206E4EAB3837684E1084BE531FE95F73563AFD7217A0A0A796AC1D357B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 94b4040c6c88fc53609d210de140fd64475c70cd04a7e79468d3f99efe7c46a8
MD5 a2529af5da6dee9d1d47c70cfac05fc2
SHA1 d7375f10eb9fcb063da2b1ea09da66878e7a125c
SHA512 fab377429d783b2eef4cce6c3465a4f595d8813c87d1a68cf9abd3ab28e341e2a373744780df3f3651280afc395b288da83d90fc6955d7b679335f6dabaead18
SSDEEP 12288:Zx4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:Z53tnay1F3zryB/HIPoaRGd2FSy
TLSH
T16865238436C24AF9E7B307B744D5088FD820AF86FB542369DB36FA0A067D57C09265F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 dae9e66c118b80ac1e63ef63910b01592710e39dc098396722714124bec33058
MD5 4c678b6c5f877921a68a74541debcff4
SHA1 55c850e8b0b3b4a7b57b4227ac1a2c4fd9b02c81
SHA512 e8ca3eb7a7d95d24fcea03227f4fd8a61cb23b76f7700aca344bcce532ac4685330b3247b9fb5d75cb1fc56ad7482d07e495e0c175035a57e9d5d64b54a5d92b
SSDEEP 12288:bk4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:bq3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T1AA65238436C24AF9E7B307B754D5088FD820AF86FB552369DB36FB0A067C57C09265B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 0cb539dbb1f98d12e2df36f6b417d203280db23601b3f3c109a1d91be174a815
MD5 e04d7e8377c7696efc963279e701284c
SHA1 ff0d11014ef8e9a1de1c05e1a4795e6d598f7759
SHA512 4ca5dc75f1e75ce279868361f7b47b73f52f8df5a91475fdfb4579b1ee6109b77002de6b661a94b97f762ce05bec78275eac442a435e1b3ea7d3c01ea8b82d30
SSDEEP 12288:tg4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:tO3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T1D665238436C24AF9E7B307B744D5088FD820AF85FB546369EB36FB0A067C57C09265B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 4105f29e8a167854fd3d8ab0a2ab5a67c2ce8991b59bab9586db29a3ad5bc63c
MD5 b50e253ff3f4191e100ec4e84da038b9
SHA1 90da49bc1f0bb57809b84b28a52f7a0320dfa7ac
SHA512 3ef3cca39352f809cf667d5b9f426c07f355a52e6e7254edf94bf3ae6e0f154163c7310fc38e30e71fab9341f727ab4e99d160da809351b465f755fa2e40c749
SSDEEP 24576:vZM3zFVSO23tnay1F3zryB/HIPoaRGd2FSy:vZM3zfa3cy1NryByocSuSy
TLSH
T17D85F195739018F8EDB3823EC8554906D6B2BC5A5B60C61F13B4362B1F373A11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 0ba0193b1431312fffc88b88d3663beb33c2bb3cad773ffef835f74fe6abdaba
MD5 57c0c30840e01f4cb787ccf1b76da889
SHA1 d47451e0bce9792029238d4fbcafe27c197f824e
SHA512 39477b79c434e3c1b8128d61d1f434dc3c65c0f42ac0ff366d4719aa0e7e23a5734b6d0e4697a2c2543b14e135b730cbdbb51d2f2162394cd65de46202927123
SSDEEP 12288:e74PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:eT3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T1DD65238436C24AF8E7B307B754D5088FD820AF86FB552369DA36FB0A067D57C09265B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 79ca97ca340f964b65037cdfae80f410258a436f9dd355de01a76aaa94642ab7
MD5 b170253078859f207f466bb7847c795e
SHA1 c06583ec587e63c09867adbeca7fa289fee25e08
SHA512 4c7eba62c9b8a3358cb0d6ff890df1c2111d7eab22abb4c8357c511b730c73bb458ef61a6836a53d485f6de7b653abe89dd41d8bb4cfebb5f8ce4ee7406d8980
SSDEEP 12288:df4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:d/3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T1D865238436C24AF8E77307B754D5088F9820EF86FB556369DB36FB0A067C57C092A5B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 0685f4387ffcdc22582e1447d6ffc54451cfa2b52c27827abee0bddafccd4cf1
MD5 0fc9a6060c05efe56d84785900940699
SHA1 d619128283feb19d98de31f68065fe2dc6f63927
SHA512 a2edb2f370be1a9d3ca9cca649704689f66d73ffd73c8fc52c1c2b153e787bc01f98a3b2226b4c6e42912d6a62c5dd5313b78c310e7c0059c1b774530b819499
SSDEEP 12288:gyPz5L8M4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:Rzyy3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T119750247339121F8D173423988A20906F771BC369B249BAF5774673A1F3B6A45E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 15a22abb32313ef3a7098dc9299bb374d592f05a006f82abaf5ba1bfc80bf28d
MD5 108a97a60489d511694f890456a29717
SHA1 5df6b31ca6939cd3337dbea917ae7d0d671f27f1
SHA512 eac747e74bb9565f8e26942f423a6c9ead44d83f58f1485a9e005deb6aca5d3a8172e0b05be9edc5a341229dd2d40a76276a821b3f604446a0c367a766789c15
SSDEEP 12288:I74PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:IT3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T1676523C436C24AF8E7B307B754D5088FD820AF86FB552369DA36FB0A067D57C09265B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 146e7b3a8dea5f8241b74c1c4a2109c8067bb2ce9598aeaae9a9fc58bcb66889
MD5 c6a00c3b7661e1261043c00cb63adb06
SHA1 884c6227141c2a20a4a603b7fcfba37aebbaa3e0
SHA512 d4f95cfe4ccee3447ff24fc19956a1921438e90f1727f0431842130e303301f099533866e0745559f9dc3e9208c90cc8367abca338150b4eb4450aa2d91499ce
SSDEEP 12288:c74PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:cT3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T1C46523C436C24AF8E7B307B754D5088FD820AF86FB552369DA36FB0A067D57C09265B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 085d474a29a92116dab583e90fc8fcc4c06b097353e2e4c16fe0627692a1d027
MD5 79bb35df5c8830633199a51e3fe4ce02
SHA1 b70053009667e64ab11cbb407a9f734160727fe5
SHA512 fed7ccffa9222908e3327c1fe6b9168720546e9a40f3372354f738c3ffaafbbc71a1f14bee06f141388addc431b8a6e896e1366af2114eac29bbb7416ddf5a31
SSDEEP 12288:cyPz5L8M4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:Fzyy3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T174750247339121F8D173423988A20906F771BC369B249BAF5774673A1F3B6A45E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 a1d66b33b72c8a8ef1323007b591e1ffaeb3bf8f1a628d76903518ea3e7323e2
MD5 fbc311ed17e178b99a6468c2fea13467
SHA1 cb7d50d134dfa73a16b29a10f290d83b3e0d6e46
SHA512 00a0c960c9563c94568dc3e12456fc81cef7266e856298c272a9356ed2c850964318457b1f7934e81289b54cd7f4d774bbf6bfc8ef3f796145ca2f7b7879e209
SSDEEP 24576:xT8aLl3z0zDw3tnay1F3zryB/HIPoaRGd2FSy:xT7LljF3cy1NryByocSuSy
TLSH
T15D85F194739018F8ED63827EC855490AD6B2BC5A5B70C65F07B4362B1F373A01D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 f2b96ead4525eb944f91bd934c7fbed62ba7d651183f1ba91717c8083f8f70d7
MD5 b0c3af52be3f054899ec5e3880ddae8d
SHA1 7594019ca989f4ebae7b667417dfe54956320a51
SHA512 fb9c37d2388c86bb60f7d11d095e058af4ef4d3f8ad6a7e3f1045fd16a5b69e9a647fe9f3bca23b663a105bf21c91649e72101f9bbd6397d3f8e4694650d493a
SSDEEP 24576:q3rd9CHKy7GZU3tnay1F3zryB/HIPoaRGd2FSy:Mrd9CHKyaa3cy1NryByocSuSy
TLSH
T16B95CF90B3E414E8F1B38A358D764512DA767C5A5B31DA8F03A4661A1F33BE18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 bc8247d87787009032751c9c9abd76d41c47a8ff361d9a6307faf2dc85722b3f
MD5 058f3cc2a6a0a96bbb85752574e3c544
SHA1 304e7f171fee566368b68c87124b80df732ef19e
SHA512 d19a36f5764c5cb199f871b3a353eb39498eb3c2d4fc03bb73dcbedee54520f907aac32d3f5fa36fc33341be0ed3cc8bf75ce4d084dc4881d29f26d1f3bed284
SSDEEP 12288:xq4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:xA3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T14D65238436C24AF9E7B307B754D5088FD820AF86FB542369DB36FA0A067D57C09265F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 f5b1e049c2b8b4941a1ee14ce28a87cc2d708997e4582057a38f28b0d78ed80c
MD5 c92a7ab33e25ca33a13d600da83bdb1e
SHA1 8a0679503ed76697cfb130ed9e23f3e20fb78e67
SHA512 1f772fa95c104616bf4b64dab32b640a661b1f7783e8a79641accca6b82bcb74c91775a4a6b6beca590f3c9405ae009deecb7839cd1a30e5664a70c241591ffa
SSDEEP 12288:Vs4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:VS3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T16D6523C436C24AF9E7B307B754D5088FD820AF45FB652369EB36FA0A067D57C09261B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 66e1b7e209a5d98e97333c3f807b60d71e895676ce57f8f68486382d39b1448c
MD5 01275874e7ac1c761156fdf04d0f9985
SHA1 46022f9ff8df1fefeaef13769b6270915823380b
SHA512 e5701ba7135fc66abe1f302cbdcafab6363066197ab23ff5f666559989c0f59ab84705278b6cbcb49d078e6494b0ba3f9e68544a605e413ae76c190381211ea0
SSDEEP 12288:Ld4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:L93tnay1F3zryB/HIPoaRGd2FSy
TLSH
T1C06523C436C24AF8E7B307B754D5088FD820AF86FB552369DA36FB0A067D57C09265B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 a64fb282630b57d3c9a8f9daa31a239f6364313074c903912b0100b5a5b3da21
MD5 e4afc6d58e30c2a277a839e4d302a93a
SHA1 3a7198a6b142efb78cc5aa3d668ce0810ce26b0c
SHA512 35650ad443dbd99f66aa6b827255c99cbc71d7d76ec4894df58ce3d9b2790c005d90fab6b398015c32a18287eb4e820369044d1d303dee6d699cd601bc47411f
SSDEEP 12288:l74PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:lT3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T1DA6523C436C24AF8E7B307B754D5088F9820AF86FB552369DB36FB0A067D57C09265B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 797b01dff5b51ef19dae4794bed09ce621d8bb0c0448133df7c06f3647fa1e82
MD5 708569f13aa7ac69ec1b246d42a26e2c
SHA1 1c2ee38513d4f2a793aa29838749ee9029be20fa
SHA512 e734bf2b68c34d495527e5a7f677e5ce597b5393a836a363a8f5af0e81142b031da0442be43493789647e02eff108427d5e0a4056b852d62c48685fcf034d051
SSDEEP 24576:Afwvzk9RX6wkyAIv3tnay1F3zryB/HIPoaRGd2FSy:TMnYIv3cy1NryByocSuSy
TLSH
T1BB95D029EBD844E5E1B7923C89F3460AF6B178595B31C2CF025A636D0E37EE45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d5ccbbfece83fc16591d36c81b3a987eae471773557e71d5435f7d748dfc0ebb
MD5 8d364ade19a15a5a86387d61473267bc
SHA1 44af0bb572347de8ff7743216c39cfacd6616ae1
SHA512 5c130f40012d5719131ca7f9b8ece607c5f5b2fc98fdaf839fee7ad6d9db46db07d2b7850d77f2019d84a05585c4c4e97f5e5f8fccd92c079aeee2dc24ead978
SSDEEP 49152:qYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0s3cy1NryByocL:VySzPkcANsRc/Sy
TLSH
T1A4066C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3e647d4c0330b2f9cc1c645bfbcd7891244f2921a6a9ac7b0e0c77c517a74a14
MD5 07419b30042fd768ae70a46be01cc1aa
SHA1 199863fe7fe08d38f032429ce0221ffcd5b7c629
SHA512 4209658745bb411cc2b97be9b3b4fb10ee6d48f0e0dbf947aa7c8105dd9a489998ed6c2801b79ee0578fed058df60ee0c5deeae262db377573e7604d0ead1a00
SSDEEP 24576:m47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYm3tnay1F3zryB/HIPoaRGd2FSy:m47JUQjqirIhCnDHUPfF/c3cy1NryBy/
TLSH
T1C065BE1DA3EC01E5E1BA827885154A5AEA71782E5F31CACF1270937D6F23ED44F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 74e5053542b23e7ca8c8ca129fa6e1bb19db1c980cf01444c07cdfa61e43c474
MD5 1f5b713f7315e23967bff1efca6d5c5e
SHA1 4d2a26189bae8a7fed0146d4e6d82e155411a74b
SHA512 3d0074902949916ea4a49deffa008fd2e002fcb49975d07365881ef8143d8ebf9cf03fab0e890b656a5e7ce793826f768bf95386a90dde9bc8204789bfb0a248
SSDEEP 12288:EpsfL4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:Vj3tnay1F3zryB/HIPoaRGd2FSy
TLSH
T19C75F149E28402E8C16F527AC7910A46F3337C6597E193CB52E0FA3E0F396A45DEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 461f448bc13698090cdc315844adc929bd15d198695f64004a896c530f3b51cf
MD5 3cd3480ade75022af45df5271e41a288
SHA1 7281fe613ebddb62d71aa98f943f8536308ad97f
SHA512 5c6b5d2cabd2908aff0a0eedbdb44dc7a5f14e87f10cd7f8ae92b0cc5b0db9e06891fb571cc44da0956238c3c32e642c5bf4b52430d414c1ed63768021222720
SSDEEP 12288:5+q8z2U3fWYJtnh35Db+HRIgOVZt5tpXT0O/DgLZ1bBjzYJR:5386UPWYJGRWh/Z0mDsZ1bBjz
TLSH
T1F34527007626CB4BC66940325E37D6CCA770BD05FE45AF07B2C9873F9476659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 a1e22c8b8ad0d60b4e32a6cfbc9579a573a7e51c10193c8d93bdccc8a2aec6fb
MD5 3739329a7ff2ffd81b441637bc2f819f
SHA1 a78aba9e18f9dc261f056dd6962f44570cc49ed7
SHA512 8d3126ca9b47623565b8e35a9dbea5d944707dae8606b52e3972d845046df1b27f65478048f966fdf5d8d231c0719d91aa4e1328aaa76c5d36e91ff2ccc04178
SSDEEP 3:OlH/lrlZ0a/lt4q0QPTt/Bl3y9Gxtg3mCllltGlslslslslslsl67va9l/:Kuatt41Y7QK0mCtEEEEEEEd
TLSH
T1888192A0CB118660CD36DC30281A4B2A4B62C2806487E3AB1A0633F20D03254CC3AB98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 1e366163620b31ffcd206037f630d7897cdebb1ae34f49b0c584aa3bd6d9720f
MD5 9c901a6abaac7f258d93e0f5604d9429
SHA1 8cab35eeaf2cefda4abbb686207ade7de88665e7
SHA512 e7acd36c15244333944ddf1e801fbfaef183e2082a98810a900937408236d2794e787de7673857609d3124a2ce6eef6a30a02d27c26070c84ae74a7b2e9bbd31
SSDEEP 12288:Dml/JOPOM0RUtywqZ8P0uc+zWexYrRRcpDVeWEmM577Mq6gzGlvEa3z:qhOPONUtywwDOTOdZ46GxEKz
TLSH
T178550A0055B7EB4FC97A5037073286CD7BB49C06B78A3F057345893C8867A6EB6E62D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Local\Temp\debug.log
Size 244B
SHA256 0c00112acaca590b0d2596651387bedecb4da00e4831b99e1a567ba2d10970a3
MD5 6cfd02400d3be0d44316d00e6c34f7c0
SHA1 dce5b8f3c2c329866177c9f5fd10f70213de350d
SHA512 466ad9949c457ba2c3cb482d97e40f06102e14624e2cea719d74bc76b6707950e695f05094af06ed866449faaa9e0817605ad12f205a7d0cf46bc1c7d9228c73
TLSH
T16FD09B775F151A7C255A40583745E5D15955004C41A876F0529700C17A5E861635BB55
MD5 SHA1 SHA512 TLSH

Submit Download

5a658da5e4fea11e.bin

Path C:\Users\Admin\AppData\Roaming\5a658da5e4fea11e.bin
Size 12KB
SHA256 9a2ea2ef149e25a8677d874c0fc44aba4510114ebc050f10fd74b44b2b3f12df
MD5 279ca9573c38026ec5ddd785a23d6676
SHA1 ce614e1c82ed60b5478fafccb60342749cff6d92
SHA512 ee5fa500e4b009ddd73b0f4324976e9648950baf1053fa88a9664e1b0c9fac1c9b1a5c6dbc5e544e288d19271baff6c20cf6a05b15832196e63323a4343817e5
SSDEEP 192:EGrVonAXmzhQa85vZ/r8i8drQ44n+4EoEdesrbo9bXPVT6mVwyFvHk:zBoAKvsvCVQ4uEoxsI97PVzdk
TLSH
T15042D1ABF6442113BA38797284B23467B582E033AFDC9DA78029D0DD4276F6829746DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

449abc6e-9874-41d3-ad54-d457c1ab2244.dmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\reports\449abc6e-9874-41d3-ad54-d457c1ab2244.dmp
Size 287KB
SHA256 d2e069818515a02df2c764e47957e6552140943e98e38322fa8a7931a806ce0c
MD5 234fce5f64cf35ceefae619f46739fd2
SHA1 c7acebef4254dccf90da42edba6a49a0c8250627
SHA512 a4741d6112e31c7bc7a81ed63cdb4d3ca5c9a8c422ea73db6278e6cfceb91ce6b8859473ce73ed88ef4e2dcacc43587bdc35dfe45abaeb527f1f4420deb13c08
SSDEEP 1536:XhZiWBxTdq/BiaLB1XjpfrGi1bPR+iEdr3J2xxcjIUFIOKk0ulAZWPWuWhq8VzrW:ak84+3FyEPEiQraw3DAwPWuoV3qxvdf
TLSH
T12054E536B3D506A6E16A933488D75722BBF7F82117528BCF8280517E1D637C49E3AF12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 5bead62ac2c8ae501f34d55048482bf355a5949f211491043becbc3c2db602cc
MD5 8b4cf6964c7f02218659b86ed6a570a7
SHA1 0bafc5edd7fa04ccbefe57a8378fa06e0420a799
SHA512 81ed31bce91728be6f26a187e78ae3045f29b90bd92a8371d62523f00f262ad3c9b1baf76a9666888ef2e7555211f2442f9c19c0fc3b2082680c83111073d6a3
MD5 SHA1 SHA512

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 4fb8e3483bfd9dc23ca551711385fef44313597cb62ea971b180612bf791c6b1
MD5 490f5b625bb85a3e5ddf19498f31135c
SHA1 c62280266c8445a691413165f9f840d0a60ec1b7
SHA512 97754a857352ac4fa6f05220c5810aca1a200beadd93f7ce4501899ae3e82e17798a174ed28e2053806213bdcc76a602272fea0f3e93a1e2a2ab2a6725478fff
SSDEEP 12288:6F7D4PE3JLnILv6cqF346rzOrMG/HIR9oKp/UIGd2P7mQSGr+:273tnay1F3zryB/HIPoaRGd2FSy
TLSH
T10C65238137C14AE5FAB307B644D9481AA421FF55EF1453EBEA26BB0A053C9EC0D3667C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1a69f09089ab1abe8e9333c1adeada9c3b865e49570b3c0e662a31498fe08334
MD5 85c6428308cb50b58b5f5e387e001b42
SHA1 b972d4beb9835da8a76c67151f07e97bb63348d7
SHA512 953c92d7921b45ed69c19898a8f3f0c2c41b6783d1f8bba2f5fc0ba3e51194a370f9d1659f946b4af9098a4d988b19707f485bb9ed29cdf8bfb16e903a6a84cd
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYF3tnay1F3zryB/HIPoaRGd2FSy:igb4mBIBhGFm3cy1NryByocSuSy
TLSH
T1D965AE1E32E802F5E0F6D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 d11cb4b8cf7f8adb2e5347e1f771010e21e9941743b33c5ea528ecd77074975e
MD5 31c0937190722f927aef198e6b2c953f
SHA1 e818a06abb5ffc81e3dd78fa34fc1a577bc389f3
SHA512 eb1569bc6b1dcf1c2f54e9a8d2804e9538a14bb2997739436038b668a76bf138f4ab1107bbdfdab1e56f3eac0310c08f4fb21273e3f28f0cd69fb8afb02a398e
SSDEEP 24576:eG88u8FpJqH1vzria7/m23tnay1F3zryB/HIPoaRGd2FSy:17ZFPqVya7/d3cy1NryByocSuSy
TLSH
T12295F16577E102F0D477D13889824667F6B2B8251364EBDF07A89B561F33AE40B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 83fafcc28813aa744a5ba122000bc9d956d874952a8a59b5348417e7f49b6c8a
MD5 4e53edc36093e295fe00468054ef6f52
SHA1 fcaee847370c9a9b36e8c8af12b0d7ffa454c8cd
SHA512 9aef30ea9f6d74baf6faac11e95d619a060a5fda2da9dd4b252943212cfa5d653a36ae54ae70440553c68aae683af952d46422327db7db15f9383555cd32e41d
SSDEEP 24576:SPUr+NQa3tnay1F3zryB/HIPoaRGd2FSy:SJQa3cy1NryByocSuSy
TLSH
T14175E15E32D91CE4E677A17D8982460DF771B8625711A2CF02A1913E0F37EE86D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 60a15adf820068e3ff6d7e104b679167bda14797ca618dce9ac011312af9449f
MD5 5fa0e316f8c5c98f3a7bb21cc3848175
SHA1 5a554e4527bc264fe4af0ace8ec9b0cab4a5bd8c
SHA512 468d24dd4761232b096a82aab571b1e031de1f94575afcdcec39f32d78816b2dccf97bfc3bc809b4c5a53ba1bce123f1c29b925007316c48750be221282dea2e
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjq3cy1NryByocSuSy:SG05lO43bXcANsRc/Sy
TLSH
T18FD5CF6A62EC11F9D1BBC17CD9C64A0BEBB23815033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f43c486af92da535dda3f302e2e575965f7f189383a3b74a346cf388e7745a24
MD5 0fb0e2cb4b518ebac59650cf100ce21c
SHA1 7a4b5615f8b87e7c608bd875bdd8f1420633d067
SHA512 c86bf8462e3b3fd0596deb0fc89dbb3359fd59ac7a7dace3335a523f915f1b1f4b9662edc546b0022ee50020c909f9a9574f3a5411da393cef1401af6948aee4
SSDEEP 24576:zfa5POZ3dpyWVM50JicR2hG0lasx2+47eidns3tnay1F3zryB/HIPoaRGd2FSy:La5POZ3lJt2pasx2+mS3cy1NryByocSs
TLSH
T14665AF5EA6E801D5D5B6D17DC5834A1AF5B1342253319BCF022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 99f9553728f6b0ee74b077553e25580e095bd195b7206dd8002ba7c2516a0b68
MD5 3d54a8cd294d566eb61ed69c196633f3
SHA1 4575a4d8284f74d37490b20b02699b2089a804e4
SHA512 dfa018229eddf645499f4bdf8293a899ecd13a6453de4d672f9e63177b2f2202177a0a2177c4edf989212830a2069d17654bb295acb016542b672e21f2c9badf
SSDEEP 24576:mNcwHdjbyQ4nLC18lb/EOjowL7Fke3tnay1F3zryB/HIPoaRGd2FSy:mNc/zEOVHF93cy1NryByocSuSy
TLSH
T15E857B1623E901E4F1BBE1BE89679946FA717865533086CF0291851F1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e09a4e0743cb5f7a44e841048a2e281bc7e54d608fa6bf5fa165e95c48b62832
MD5 9124fd8da08f1db9db5952dc2ae272ca
SHA1 78fb0af46822d3a0d56d6c4de4cd3800fcdf4684
SHA512 fcd3da1d7c41729a01f4dd23a84e6048029a27a917a57be73c7372f5902ff97727119d4fff5c8c5cafc33f6a15d5b3f97596232061ea1544539d6a5f5a07864f
SSDEEP 24576:/zkNvNnaFeYhJNtmZBm+3tnay1F3zryB/HIPoaRGd2FSy:/zMwBtOm+3cy1NryByocSuSy
TLSH
T1D455AF6E76F806E4D1FAC6B58D238516E6727861173293CB9390C13F0E279D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 bd7e1cc4fd108a116bf7d86bbea90b04f5a2809bc93d7e5115ed34334234ec3f
MD5 3da2b5d3b4630425e1c9da62da9493d4
SHA1 f50da0e5f6176177c3040ea871d147ff53bfb575
SHA512 ac7fd411961615ff056f560c7400646888950b7e8191ca960ea5ca45eb4ea8ee8f0e26081cadc4c55df61480065e6317a5ed18143af350afa0049af9350cc138
SSDEEP 24576:YD3FHshBIYQgA33tnay1F3zryB/HIPoaRGd2FSy:YDVHeBIAA33cy1NryByocSuSy
TLSH
T19585E17DE79804E4E577C2BCC6A34907E67138A9032166DB0294D1BA1F7BEE42D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-329-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/240-107-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/240-101-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/240-99-0x0000000140000000-0x0000000140274000-memory.dmp

Download

memory/2824-365-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2824-122-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2824-128-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2824-367-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2824-345-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2824-129-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3216-11-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3216-121-0x0000000140000000-0x0000000140630000-memory.dmp

Download

memory/3216-25-0x0000000140000000-0x0000000140630000-memory.dmp

Download

memory/3216-17-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3692-134-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3692-350-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3692-348-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3692-346-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3692-141-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3692-135-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3972-183-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3972-177-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3972-176-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3972-351-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4376-51-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4376-57-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/4376-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4376-159-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4468-73-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/4468-74-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/4468-80-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/4468-85-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/4468-86-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/4764-149-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4764-155-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4764-147-0x0000000140000000-0x00000001402E7000-memory.dmp

Download

memory/4764-347-0x0000000140000000-0x00000001402E7000-memory.dmp

Download

memory/4828-63-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4828-69-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4828-62-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4828-210-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4952-2-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4952-39-0x0000000140000000-0x0000000140630000-memory.dmp

Download

memory/4952-6-0x0000000140000000-0x0000000140630000-memory.dmp

Download

memory/4952-7-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/4952-8-0x0000000002090000-0x00000000020F0000-memory.dmp

Download

memory/5472-171-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5472-169-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5472-167-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5472-161-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5472-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5708-111-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/5708-117-0x0000000000AD0000-0x0000000000B36000-memory.dmp

Download

memory/5708-344-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/5708-112-0x0000000000AD0000-0x0000000000B36000-memory.dmp

Download

memory/5908-447-0x00007FFDC3D10000-0x00007FFDC3EB6000-memory.dmp

Download

memory/5908-362-0x00007FFDC3D10000-0x00007FFDC3EB6000-memory.dmp

Download

memory/5908-449-0x00007FFDC3230000-0x00007FFDC33D6000-memory.dmp

Download

memory/5908-364-0x00007FFDC3230000-0x00007FFDC33D6000-memory.dmp

Download

memory/6020-95-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/6020-305-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/6020-88-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/6020-94-0x0000000140000000-0x0000000140278000-memory.dmp

Download