9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Size 4.9MB
Sample261003-prxt8sdb75
SHA256 9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2
MD5 b618d3ecab96394000973ee8be7e6a19
SHA1 47881bead49d6c2d513a4c34fdf5df231fcfa1fa
SHA512 3d3f6e8e14279e24746bbf6b01d935c41ddca4d61d9b57f01155f5368142908661bfb4440b2ece8e47cbaa6a065e3dfc00a814c3d6d049353f642413de64f9a5
SSDEEP 49152:utz8DTC3b2/mrhZ3nGQXAPaZdx5P2xU1woP1mUuS/WRucrWdICHZmWMgpJFpvUFW:85ZZPe21OWdIREPt2DSKSIx
TLSH
T112366A13F19600E9E05DC178DF569232EB72BC4A0BF2A6EF269076152E77AD07B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3084	elevation_service.exe
4420	elevation_service.exe
2636	maintenanceservice.exe
3168	OSE.EXE
3732	PerceptionSimulationService.exe
5980	perfhost.exe
6112	ReFsDedupSvc.exe
5760	SensorDataService.exe
4556	ssh-agent.exe
3932	AgentService.exe
2188	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
	\??\F:\	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\System32\vds.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\wbengine.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\AgentService.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\vssvc.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c733b8623a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\msiexec.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\System32\alg.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\dllhost.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002797acd43353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085a272923353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b5acb933353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000d387fd933353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
3084	elevation_service.exe
3084	elevation_service.exe
3084	elevation_service.exe
3084	elevation_service.exe
3084	elevation_service.exe
3084	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3196	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Token: SeTakeOwnershipPrivilege	5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Token: SeBackupPrivilege	6112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6112	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3932	AgentService.exe
Token: 33	2188	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2188	SearchIndexer.exe
Token: SeDebugPrivilege	5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Token: SeDebugPrivilege	5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Token: SeDebugPrivilege	5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Token: SeDebugPrivilege	5272	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Token: SeDebugPrivilege	3084	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 5272	3196	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe	88
PID 2188 wrote to memory of 2316	2188	SearchIndexer.exe	100
PID 2188 wrote to memory of 1284	2188	SearchIndexer.exe	101
PID 2188 wrote to memory of 5992	2188	SearchIndexer.exe	102
PID 2188 wrote to memory of 5440	2188	SearchIndexer.exe	103
PID 2188 wrote to memory of 2520	2188	SearchIndexer.exe	105
PID 2188 wrote to memory of 1952	2188	SearchIndexer.exe	106
PID 2188 wrote to memory of 2176	2188	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
"C:\Users\Admin\AppData\Local\Temp\9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\AppData\Local\Temp\9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
  C:\Users\Admin\AppData\Local\Temp\9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=79.0.4143.22 --initial-client-data=0x2c8,0x2cc,0x2d0,0x24c,0x2d4,0x1404341c0,0x1404341d0,0x1404341e0
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4420

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2636

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3168

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3732

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5980

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6112

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5760

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1892 1512 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1656 1660 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1656 1660 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1892 1512 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1fd743173a5db444c244e1e03e35c7a0bc1fcb4f1d41e9587324be577c83eddf
MD5 6eb5a9a422693157ffa254bbd80816ad
SHA1 0ce7e47d4763cce017d0f7b3d9ee71e988b03122
SHA512 5a994851f53787964db10e8e25b42403591438780111ad49c662646f943ce350231487ffe04b038056a774f067d576b2dc91c8e3db0fd15acdd18b865d1c4811
SSDEEP 49152:7b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn4W8zjSIxF:J3q6sjB0KSIx
TLSH
T15ED58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 d4c7ef92487bc685538925484a38435c4cb133a7c422b5e2bda89aeb05464cdd
MD5 d6197148f0a71b091f9c0243b57326a3
SHA1 95151c6010a2b6a6ae96ebb1eada6b08a0a1fbba
SHA512 3894e769acb9f59f6a48beb0a8a42c7541618e8838437afad4211c398ade56effa3753477a2d794584d8f0def00ca5fe4e6df0b00ecbbebfb7c82083624cc3e0
SSDEEP 12288:V1XLsswWkxy2lRq2czAWH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9v:7XYfDtczAm22Hb5Obvb+ISeZxNB
TLSH
T14275F128679109F9DD67827CCCA28502E633BC924760E7DB03E4A9295F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 a1db2b586eff25dc6256a00ce0bec76b5eb62f4f464e2c58220e45470a41f049
MD5 3d4e01dac916b90c103be1bf55b2f51f
SHA1 4ce58339175450f64552a8420102714fac440340
SHA512 bf1c2f9826e57bb80bb4002aad361056e89ec7e489fa01e3c829c40e0cea208848eebc13c0a42e83faac96728441cab4d0e1a9c27de1e2a918c68239dd273884
SSDEEP 24576:X0Le5ji0hmxxrMN22Hb5Obvb+ISeZxNq:XPji0AjHW8zjSIxA
TLSH
T129859E16F6748375D073C0B9C5D2A68EE93130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f7cff984653b8470bb307e2a9c2bfc01f7ee45dc90194337264230433a575ec3
MD5 c6e0afdfbd7b1cf98b41a75de2cee0a8
SHA1 21f737cae25a697bbe2b493a1a68a2b2c7c835c8
SHA512 e1e05aa6ece655826ef6f2cc24275bf8ec05e0cbb8e64795d226d33fdc038b018dd432534a86476caae97c88f4da9db520f91bef0a870357d705b18e0f6d03b4
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWn6q8wyuX22Hb5Obvb+ISeZxNu:T/ezSC6vUzPveHjy7W8zjSIxo
TLSH
T1A4755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 021475342672db09fa4b492f19f6b40db64171d333d99b6e9c79c98734b86c9a
MD5 faa762b8986201a16cb7a0d30a795a92
SHA1 326f41aaf4c1aa5275571bd7b4f03bd3e79fbb29
SHA512 de3b8b75506bea47943647171a84b11da6181d18d1526190efaa18444d68e9de55c5be5ba2fe9136903624eedee6fbb94ea99219fc4f74792d7297f5db3ff371
SSDEEP 24576:NVbqPb88hv/l+YS22Hb5Obvb+ISeZxNu:NVO88hXl+eW8zjSIxY
TLSH
T173559F66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 3553abc656756efcc7ae2ad9f60fd09c17e71742390951e50d804686f903d83a
MD5 de38d04d0349e4573c135ab9820b85c4
SHA1 264063847fce1c26578bef9924ee19d808d243c4
SHA512 2414350f094edeb0a3783f69f2b23ea015d15491485ccb86ba8580793e2ddddc21052b72d28ba8d76a035bc47af5c8c5a8b4d8323e172144f81ae1dcc399647f
SSDEEP 12288:gL1H73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9N7:gL522Hb5Obvb+ISeZxN7
TLSH
T12A55231A8713B0D2D7B94774DDE2B04792199ED39C4069570AE27E0EAD3CEF1D0A872A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f6b9b7f4c2d262c6d2309b65762ce06772b250dac406afccfe4464fb41616a3b
MD5 0ccdbdd8a57ad3d0889feab980daa90b
SHA1 cbfd246bc4e81ab40bcb46ec6ebdfef83989a116
SHA512 131b1aaee4c2add01e8bc1b0c9fd6a432fc3fa148aefae277d57b3b738b0e5bbbfefc0a237be86f876ca7fbfe6e06747f51831c261418c02cb939d01b43142fe
SSDEEP 12288:UeBNUbTVO86UCH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NO:UJIU622Hb5Obvb+ISeZxNO
TLSH
T17375CF3BEE28FCD2C27E8DB85A91C600D76278714F52A3CBD165820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 01f115b3c3da7d3ba0d32d250f313f476eaa69e64ec8926cd21fc4c315fc830f
MD5 cad051380ee5b9e26501fec37f9edd4d
SHA1 b97a530ad44e787f4950bbb143a48c5103ad978f
SHA512 c5aca759932868ef3d1914045386a216a715d22ec483048ef762c2969c3c568b016f78060abfd7318f06535a2edd653361b7c754a95e0e2b8cbe19193b3462cd
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THp:gQvGAdlCEL8c/DRNw5CpKSIx
TLSH
T123266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 14ddd5f2ee5e25fa2067d44d966e534ca7572bb17bc6ee38d0733f0bd3d1809f
MD5 89ba93d7baca1feba7e2736937a7a3b7
SHA1 2008c565bcacf05c3efcd51c9ce55254d8bb8722
SHA512 f0309ab3b481760aae6b27250b658d3f7dcf926d34323eee02e340e3f38e2f6ddab8876d810935e8bd655a30359617bfa29efb5d43892c76c3edf8feb8029c28
SSDEEP 12288:7AwSfxL/2Dc3RDLLmt0LDQewsAjMH73s32H+2xfhD61sDIpxvbKfhijiuDymjscc:k0ewsAjs22Hb5Obvb+ISeZxNe
TLSH
T1A275E031FA75E032C3BF0DB61B66D706542DB9604F511AC3E3E89E8E59342D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6a2dd3af0c017ce127aa4bce9a42a3dea79cfb4d3fd10e487a72df0cf0154aa5
MD5 3c6efd994f1aece630e3e4503385a53c
SHA1 41c359eb7db8c20125c2dbb3a485989165a017bb
SHA512 950ceb388e1d3e685e932898ec6b12c5fc178feade28534c059a9239a5260bdaacd2f3e9bba65b8362119f4ed18a78691943b361cfa96a180a42dd8fca776a0e
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHnx:KUEtQevvqc2W1cpV2tI32x
TLSH
T1F9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a7e95419eb06b58a7cb940c609f69f89403a286cff3f90ef574b7280de406355
MD5 e391a74fc39ced4115898625bd34aa52
SHA1 f3c03325315b127dc628404e3d2091bebfbbd017
SHA512 86019ad7b05572ead431e57fd9a5028fe71404f3ec70903b7abed5edbc1a997673a8b4a370fe381b1a366679bf73c36102831523d9518af5a7f9f28a954f1ce0
SSDEEP 49152:ICbRquA/m2yL5zTfFiV+XenmE3/zXW8zjSIx5:hoquVjnmFKSIx
TLSH
T12ED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 62c0449611a0b9c33f92e7fa1558ff659785e0088dc1d681266f93f62e079b31
MD5 ff042d8b16dce0029bf8195710568da8
SHA1 07e667df189d9779a1dee2cad558513762c75328
SHA512 d492229161297bb96c494287db1c44152fa1d8652e5ce64e2b021f59db49b3713f6aa7dd014fb50c694c643f20de84054b554bb1f62c7de57fa994aa1a75873b
SSDEEP 24576:4AhGL3IFoiwtA5l7S53r22Hb5Obvb+ISeZxNI:4AMUFoiq5KW8zjSIxG
TLSH
T1D835AD80E7F955D4F5B3AAB899B69171EA76BCA65E30C20F1160D10F1E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b532e60ca778a35d9a4d1ae67f3bfb8759772192af24ada1b7180afd7cd6a5b4
MD5 03ef2822f12aea6cebe1caa59c507e73
SHA1 b21bc0806f5e9393019f2040fe24851e469bb748
SHA512 a46f9bed6f217a866c0eadb11b691ad244d1142a0a1f9e5f26cb511d3f7b0e80094e32de512d9bbd37c206538860c32fe1698ec75d7847f9fb8afef62811e179
SSDEEP 12288:pmw5HEjsChNVBFgl0WDm+CrH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhD:kwu4OWQ22Hb5Obvb+ISeZxN/
TLSH
T13575F10577A51CF9EA678238C597D136E7B2BC422A21D71F07A0C61B6F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 989abb320dbf7f68be1171d34bfdb9d4e7cf656ec2c2463d950cbf7bb45808aa
MD5 813917cea6fe477c82ce48e13f352675
SHA1 2c339f374a1143f1a6b6b96b3aac6c60c04c9bf7
SHA512 eb0476d7c23aa96d1b8859ba595396cde0d2249cb2fd64f3d7517919ead38740463b93776f56b709648e75542f45432a3dea4c676e77d6562ddf300c0147628d
SSDEEP 12288:LeZ1Iy8H73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nx:qZu122Hb5Obvb+ISeZxNx
TLSH
T18155121A23A170F6D2A7427CCDE1A546D332BCA36B3143CF06A1661E6F36ED15D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9f2dee70a7d5bc197d885dacdfb120b1539cea2938f859cda70fdd9828a09511
MD5 68c6a44e972048af0ab02c5e3c3bd02b
SHA1 eaae002a639e0b412549d36707669570bba97fdc
SHA512 efdc177658922b781dfad496302015ec597c08b5283c7cce848563f1c554efd4355a8cd44375377165522b92fb38507ad915a0d8826e21a130b3bc3f2da71672
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uy:nQRQyi36YOcPbLvw2gAf+PN3IKSIx
TLSH
T1C2666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 86fbefcc8ca0012ab1a516862626f0398b9029e97dd94592dbc559a1b9113bb3
MD5 8efb16823ed0b1d91064013fcc86350b
SHA1 be9badf9c0de57bb974f4c0a9a7db40596974866
SHA512 5361c780534cf64777460d1bcb1e455fd669744e248cc9c6a8b08cea04c4d271912715360ee45516e04a0a198b5948fa627a6e3b1b45a99c344f4da7f6533795
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UW:AQRQyi36YOcPbLvw2gAf+PN3IKSIx
TLSH
T1DE666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d0a8ccdf969b1fdac2f0de70f2db287b1a5aa41cf7eab3817b2f1d302b6e9801
MD5 71652527b5ad62b8c5acd3929042b7c6
SHA1 09f63a242e5a6444b6c6b541c456c787cca580ed
SHA512 b892268aa0baadee810925ff20cd5420a6d6b06ae939ab2067bc6bb5a9bbeae8d3d9803b66d25c37b0a043aa89e5795d1a8ab4eff506a40c71eafec31b694f49
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0F22Hb5Obvb+ISeS:968Qg55nhceWu7PNU3/HW8zjSIxW
TLSH
T1FBB55A33B2F200A9C44DE1769F4A972196D17C758FE0E3DB8551720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3979bf0e2e2b04ca1e3b3c6b169a047a12213310e483192301922913433139f4
MD5 73beb1bd2720485f97126800229d63e3
SHA1 127b8e9fdab01ab4939be525434afbbf4e40120c
SHA512 13166a724d364b9e8a1bb1adaa2f36dc26e5a1066c6ae3e17eac23749a984e6e76599d747158c714f7565e704748bc4e5ade8811d005d7ac46c5dc7c7cd8cf90
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99K:ny5112gYy5azzVvt69nLKnhZTKSIx
TLSH
T156167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8030656e35d9c76017a3967b06d6b1d2a31bf374e1dc2ad0d9a9701398131a8b
MD5 89c04cf7d9a531b8c50fe683dc510656
SHA1 0fcf069f9312c875e8ec7e25c534c02d49b36b91
SHA512 afcca48296e6e81778f4a7a8d8d71e1c557dc429d5487aa855b165978d4b934d7c551bb7cbf499c82658d68ae2be637928b4bfb8e894e80c5da8cd75e2b13328
SSDEEP 49152:+B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glDW8zjSIxz:su6Jmdxd2d6KSIx
TLSH
T16DD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bf98a11da5286ec53e79d37a6f9b8fda9110e8ae4ef4c69c37a96cd41fc75681
MD5 d369e689a21542c4bd29a592f9789476
SHA1 3d1e27cdd3d5ada3a0786f16979a76fdd9d9b961
SHA512 560f74fa472dd480460e13e7e06e1487c5f8e0bf759bfd4b5ab670aed808e16d463b9d12884774c57d249ea6a5c978378877d254aca9b16ea1bf4e794b5ee91d
SSDEEP 49152:F1hpsNoJpF1A63U44CwH7R4xRW8zjSIxM:FmifPWRFKSIx
TLSH
T1E9B5BE13F29901E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 99f0f6fc749a8fcac835aafca1812846b90d37d9f96b07429be9a076280fffb0
MD5 51afd0d5734f822e213b2aa9f3a0030e
SHA1 c9864442b84ca94f4206f68c6b3e71ee6be28db4
SHA512 5113136529103a90fc95642628f7ba00d768f61fb68a82693ba60a3a3e34be72b6f86cbb88612b1f3f3f59f5bf233f9d7fa106c83a7414a41130a8d9c17bc743
SSDEEP 49152:MSuZQIY0Be2KcRVtOnks6NMHqoW8zjSIxp:u5dKii61nKSIx
TLSH
T109C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 825bba792bb2212491a151cf49cf865b0c282da78da8c75b7a0cf4b7013b4237
MD5 78972f0b46d0dc132e2338e309f80261
SHA1 97d8f7b5245e13d5726e246e15495ee8135458c7
SHA512 d73f53800cb791d94e72e0d2ef620034df8db9e58c84442ca999b83fabf34dd4bed3f5f558cc25effa845cd920735dacc8307f9ee9ba36c5f4f56084135895b3
SSDEEP 49152:thtSn8EApI0fig3giDn0AP5wNW8zjSIxH:8X2imphhKSIx
TLSH
T12395BE13F2D900E8D05ED178C7468632EA62BC160B35AAEF0A90B7561F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 726b2caa4ad9c30b290ed029639ee86295f0bf5f8a595511d5dcecc1bdb2f51f
MD5 5e37c0a76eb3658917fd83800d77da19
SHA1 f2a9655230ccf73c12b84a67b32e798a6d1140ea
SHA512 48c820acd2c4232f068488ce904bffb0384e8daa7564a55d35bce779f091d54780a54a2362e5354b5d9d50e362953f83481c68b871e8018e7a3005d9bc5cba92
SSDEEP 12288:e9H73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NL:eh22Hb5Obvb+ISeZxNL
TLSH
T127552319D613F5C7C76887B4CDD1B0479208AED3AC01159B0AD7790EFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 80fc5df0a1db1c60f3e07a8c35430fe46d919902a862840d0c9df4cd87b027f0
MD5 6298eed9631f874f3ec9520bb03a5490
SHA1 d74d8381aaad75832099c112eacb4760c17d4a5b
SHA512 049e5026e79cdcf77f376c753b914783e3c8d7bc286cc30d1773f6d0bf52c59443e23f3223f0cfc1f00a34a406ff8ddd5c064acc8e3b4a8ca758d193a07048d2
SSDEEP 12288:tAH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NL:to22Hb5Obvb+ISeZxNL
TLSH
T1F5552319D613B5C7C76887B4CDD1B0879208AED7AC01159B0AE7790EFE38EF150A8B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 b7bae3f45954202fd1ade406986e62997afc86d0fb348cbd41cc2d496c9e3148
MD5 82bd2d051cbdf4155cd64e58d6cfb984
SHA1 04ffe1ebeedacf0057d02bd19c7987b3a66de485
SHA512 09c537927e9ec1865290539151f48fbb90d3ef65e9ddd1c4166412e0f12a760e69aa7cd8e4dc48a341a27a19141d43f8a4e7432f8c63f4a45360978ba486b70b
SSDEEP 12288:nqH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nv:ni22Hb5Obvb+ISeZxNv
TLSH
T153552319D613F5C7C76887B4CDD2B0879208AED7AC01259B0AD7790DFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 dbd025256689a32509fd7ea069a220f330ce270978ad2131b34a79532e8ea769
MD5 bb17b37ddb6501cffea2defa696f5525
SHA1 4cb82430ae65c48ffb20bf0f59c48a2e98136f5b
SHA512 9a3df70ccb3c7224236c4ff90dbfd10d22f8d5f5749d153a4a57239aaa5dab9fcf0de55a3787fec3b59bbf38e2ca1671a60c6b527e134e3804a2d610443350c9
SSDEEP 12288:iVHH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nc:g22Hb5Obvb+ISeZxNc
TLSH
T1D455231A6753A1C2C7B5C378CDE2A046D225BDD3AE1166DF0AD23D0E6E34BE05478F29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 a6f88dc8b7367c29ee83f63e9f119388b151a3abee731fcf29e6d9281ed2d018
MD5 d4f21456369428eab22cf77c5982a6a9
SHA1 3de97731ecd2be76da83cad556e1b2ce86cb6066
SHA512 363f9614b5a3e79f578ef4decc976f1378831fc1883251123940c81274293c0f95a39c356dd344787ae26ce7ccb776c52bef57e7baa0371f96f8a856d7c63547
SSDEEP 12288:S/H73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nt:Sj22Hb5Obvb+ISeZxNt
TLSH
T1D8552319D613F5C7C76887B4CDD2B0879208AED7AC01259B0AD7790DFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 1f63324b7e0c3a23641586f6355dee065754c9b8199ad3d8389a4b934c6d1f6d
MD5 19ce33c9613efbe1e042f457017850e8
SHA1 21e163dc852258907f597baace864c3bbdaad99c
SHA512 f7504708add97c9f739692e43f5daccf26c3657567358d8a1b7fa09aaa61c781d4f185cce51c639090edeb83a39c4aeb11397c0fd5685fa3d40b7a06ecb2a89b
SSDEEP 12288:LUH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NB:L022Hb5Obvb+ISeZxNB
TLSH
T173552319D613B5C7C76887B4CDD1B0879208AED7AC01259B0AD7790EFE38EF150A8B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 b096b4ef819c06697e62e52bdfb41c8b4eda75ba216527a95758c2a59509d6dd
MD5 9e26a9bbda4c772d87909d777c948f6b
SHA1 c53992a22bbad93b6a40619173742805fbd87eaf
SHA512 79186f9a457f8b06b383314b507a6c767a8b7c2c8f1d6c2b2de740b5495d42f29246a2e325381d53d178a7e28e367a2c487a16c9476608deb20826f50a3742c6
SSDEEP 12288:mYH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NZ:mg22Hb5Obvb+ISeZxNZ
TLSH
T1EF552319D613B5C3C76887B4CDD1B0879208AED7AC01559B0AE7790EFE38EF150A8B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b0456eed395711f66a473255d61b415c9539873ef5f22d5da3503bfefc094e02
MD5 b2f037068acc5059c758dd06579f0850
SHA1 f8af2cab0a8e5929c4acf5d16e94db99cdb2c664
SHA512 0dd3c2cb7adebd3909be1443dc8ea452d2f579a2b2c266b6d3d56d52f225a2ee556b422aaf968c44b042a810c178d0668d6ae20a6bb74479840e06cc8913b604
SSDEEP 12288:BiZwbVzzFEoS2cPvygH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NM:EZMRzFVSOI22Hb5Obvb+ISeZxNM
TLSH
T1A3750159B35118F5ED67823ECD519906D272BC5A0A60C61F03E4362B6F337A11C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 17d1da5e6f8ded50935ca6655ca1c77261b7ff08447de6c56c844d587f5c8065
MD5 47ae02bb71c405da83f72294a3da2b0b
SHA1 e77681d55f06809f4de12713bf7dee62bbc5f9b1
SHA512 c3096f2b0178c0625b7ef1fc18d866f150b76e914cbd1ecc1ed85c779bc528ed689bf2adb03d80125fc025faa816ab1ff6940fe1423941803ec464df57150796
SSDEEP 12288:5ZH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NC:5l22Hb5Obvb+ISeZxNC
TLSH
T11F55231ED613B5C3C76847B4CDD1B0879208AED7AC01259B0AE7790DFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 8d2c636341bc631457c64b60cb1492dd1bfb898d322d256f42f311783fc22586
MD5 f8667a603a9952af0a247c913b65d69f
SHA1 d5f509d95c12cf2de2f4f4c4bce80e292d5ca9b2
SHA512 ba34241db7c22402be9ca666804d68e6926e2088022f8b5a72ce200fcd1148dd8186d626f75a3d04a9ca09442d6aa182b58395d4d2d4c8c64821a99a5e0bb103
SSDEEP 12288:FlH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nb:Fp22Hb5Obvb+ISeZxNb
TLSH
T1A255231AD613B5C7C76847B4CDD1B0879208AED7AC01259B0AD77D0EFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a2e31ee3384b989369f9d571695e3ab4ad0a62d56b35086cbc8dbedbdeb25a59
MD5 7019cb96739c17e35679e6db71eadb31
SHA1 b349fbd8759bf3e78a114bdb66859a1dd1d750c4
SHA512 8c3a13251dcde0976317e904bf5fa40056a3b1f27ffa9db2a96c2ae3d617bcf94acbaeb451ccd9ac048d93d3a4d9f4208a269b91bf1e72a884bd5901a476f3ec
SSDEEP 12288:JyPz5L88H73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NF:ozyc22Hb5Obvb+ISeZxNF
TLSH
T138650217736230F9D2768238C8A25502F335BC724B209AAF17A4173A6F376E15D7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 081ee211abfd09c891ac0b3a2fd326d5f075def87dc473eb63c043335a1960d1
MD5 90c34c8a42e5b07626e06796895fdf3d
SHA1 ff6235995eb5885e9299ce66d8272c43698c8d75
SHA512 ebc47eccc1c9c6688fabee410d66eb5e6666e3e9b1ff26316a41d60783363f8a13d9fd8ae6dcdcbb6bd6cb6ff2cde52ba5cd9cfbf31ea268c632771e28689fc1
SSDEEP 12288:2ZH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9N9:2l22Hb5Obvb+ISeZxN9
TLSH
T10B55231ED613B5C7C76847B4CDD2B0878208AED7AC01259B0AD7790DFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 c0cf07caa2f6f8744f9c856f946dee56a1811ec87d9d9e7a445263e71c034337
MD5 8018911e2d687899bc0defbb9fa7b09a
SHA1 501e8ff2616a3f81fc5eeb4f86ec2475acc7110f
SHA512 65d00538e1c7b135b60c5c27fc6ef9ea92a03359b201297e905d242742415d9401e596a388dc1bf083bd8446245418a21fb92780c955143471e9eb7106689ea5
SSDEEP 12288:CZH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9N9:Cl22Hb5Obvb+ISeZxN9
TLSH
T11355231ED613B5C7C76847B4CDD1B0879208AED7AC01259B0AE7790DFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 7c21067a5c60533bdbd639e45d2f83ccafe9cfa1b5aabb59ca1481f6c62784a5
MD5 9213815f20345e4150269de7c492fb3f
SHA1 52e04bbefedd0f8c7ab3f458dfe581933aae214a
SHA512 40451dec845f8ff0738ef20d027e90bda9388744eee7ae2060d594e01036cda5d0ddf32405e36012fdb01e9be64f51d49f588518b96afed3318e0239edcc0408
SSDEEP 12288:8yPz5L88H73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nt:lzyc22Hb5Obvb+ISeZxNt
TLSH
T194650217736230F9D2768238C8A25502F335BC725B209AAF17A4173A6F376E15D7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 4e63ac68ffcfe6fd99a234dc6de8a4d5f67229af91c43fb60bdd58f186677f7b
MD5 af366580f67ad99cabe23591e90df748
SHA1 4fc241044313a2afe6ab1c27fb0c4759b15391bd
SHA512 f52f6f9c49ab49e0786d25c31f514f466450c07b29a934cfe4688f977680393825613205ff624e6fe7aeec4bf1220ecec5792a26ef41ee99c0f2943c198faa45
SSDEEP 12288:2Cd9CWYoaLHF3z0z04PDvh6H73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhl:XTDaLl3z0zDy22Hb5Obvb+ISeZxNx
TLSH
T10D750169B35118F9DD67823ECD619906D272BC5A0B60C65F03E4362B5F333A11C3DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 bf16fc6b457811bdaa6624cfdb7f8d0ea27139d622441ff54c56a39b262c08e1
MD5 730659b2332953153ff22c635a369190
SHA1 2f9ddf3c89231d363fc615abd79a3e49d7fc0fad
SHA512 cf4a85e1c0588ccbccd8d352bc5ae8ba5b8216570ed7974334cf0aeba7c63213feb2f6ecab9a692d0bd1311cf21cab55ab0f50554889035ca022412f819b4094
SSDEEP 12288:Ai4e7KRdTfgwCHKy7GLbbdIvjH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRK:A3vd9CHKy7GZO22Hb5Obvb+ISeZxNE
TLSH
T1BD85CF90F3E414E5F1B79A35CD729512DA767C9A1B21DA8F03A4261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 40730d73c990fc8beead756b9ba0eeeed24d2c19c3bf5b0bfcb21c8b305e3ff1
MD5 0995875c3394ee0e2922a75365c448b6
SHA1 78b04763e90023b40e47a1e8d1056f1be1e2fff5
SHA512 1f9ecdfa8da9aad558f7d5ff5b583750180847d9ac91e56f9fec8c7810826c18f8c70f1dcfcee282b9f2b59c001c6e99b88637e6c5a165b2705e88f788fab4c4
SSDEEP 12288:cKH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nu:cC22Hb5Obvb+ISeZxNu
TLSH
T1FE552319D613B5C7C76847B4CDD2B0879208AED7AC01259B0AD7790DFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 2953b2b6f4edf7e79c47254fe6dad08ebc4676b02cac04b765ba5b68be834c67
MD5 709747d90d0e61961fdeeed60a9ace6a
SHA1 e3c13876fc67238bc1b463c718a35f5f2c70f91e
SHA512 96694519fccd62657d884dddd05e56109fcb4ef159cebd266c00692374bf67cf31b50e63af7917b3845ffe8bf2bcbda71810fe5dd68327d79f24760081437b87
SSDEEP 12288:scH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NG:s822Hb5Obvb+ISeZxNG
TLSH
T1975523199613B5D7C76887B4CDD2B0479208AED3AC01159B0AE77D0EFE3CEF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 8af2b2e0dceb2d77ad004c7f4abd2b181543f7cff71151e1295c3ccc32a46019
MD5 a7c5f7cbba5dfddf77219d194ccc6184
SHA1 727acb96d9d989935f4fd53ed4f3d4ebedbb2291
SHA512 fa316f8795826e468fa186bfe288725e9a29e1309b71c50573f92f02b5aef2467992dcbedd8f91c93b5141385936921a2b187ee5f483d7630a6d6f67d0096272
SSDEEP 12288:QjH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nv:QP22Hb5Obvb+ISeZxNv
TLSH
T15D5523199613B5C3C76887B4CDD1B0879208AED7AC02259B0AD77D0DFE3CEF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 a7499a0a3fdb7b4813a6d987ba4fd48f1973d443f467f7856975ca7c7cfdef03
MD5 568e66a65215e38e380b95996a9df8ef
SHA1 48e806174f162859d20f6f94e949085850d814d5
SHA512 4a00fe8d737c94803b50c39ae626718f3acd10e74fee1657612a0c7e96fc5bfd962939b8008dea829cf4fe53880a42da1da6de4ef4a6fcc80566ac8cebc42f9b
SSDEEP 12288:lZH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nv:ll22Hb5Obvb+ISeZxNv
TLSH
T1AE55231AD613B5C7C76847B4CDD1B0878208AED7AC01259B4AE77D0DFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 9a99059784cf305a72d2c4f390a199a48c9ae1df30f91b9cfd739d2b4432be81
MD5 201767d20d0f7f74aba6032e6a2bb001
SHA1 4f346f03027322aa56a8c349ccd5c2b3a3fb1298
SHA512 1cc4853b9b29e616e273ba4ec97fe1f5582e7af998d49e4fd994c4879b94b2de6998ede63bf497e766393490e1bc397fea7be17dae27c1963a1c1daf19d5bf5d
SSDEEP 24576:KfwvUk9RX6wkyAIZ22Hb5Obvb+ISeZxNL:aMnYIcW8zjSIxh
TLSH
T10785CF29EBD844E5E1B7923C8DB3460AF2B178691B31C6CF029A536D1E37EE45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 76171abbfd0bc89c1d7ed53d43623db28a9a84846695b45d15caba076c48f938
MD5 06db9e7bca66b656ed3c1efcdafb2a72
SHA1 434d7e13e21cf09bbec2480cb57265d697563916
SHA512 6bf2883006d758d6a4558942a50cbcd5b3a3c305213e7d09d137f7caf57806cdec6b585857a0f351ece42c4d61bccbe3e32825bca823153a5a594033cd1e1879
SSDEEP 49152:jYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tW8zjSIxk:WySzPoKSIx
TLSH
T1B9066C56A1A801D5C1B9C1B98F1BCC1BFB7134490335ABEB02E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3e60094b3312586ecef4a2b05e63c644aa128a27fe2a3043659e7a6dae14a6d9
MD5 7ddc644f8976bbd7d12e1e4c61e4ac00
SHA1 9e3746e5007c2c23efc0a6f18847b46824bcc61e
SHA512 f48d25d564da113b4766aa3c9b29f85551eddf9818e2d87aadb9fb6dc8ec886cba80401704f35ac4ce0959b9f5712ea0ab8520f2fcd26182dd450f2767264b28
SSDEEP 24576:947Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY422Hb5Obvb+ISeZxNJ:947JUQjTirIhCnDHUPfF/dW8zjSIxz
TLSH
T11E65AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 7a395fcd8ce7acdaa916fb3672ab57c6317d4d2595a35d4065a5fdc1a952fbc7
MD5 a314c0d86ba98708c3a4d83c265a94d1
SHA1 d245b0833804085506a235f9dca27d29352ca393
SHA512 677b07e21f5845d967f1d67decbba5a3418d748f3ba95f553c516bedb23fe8df8add3e6ab9ba6a25fac0ff2da72aca405aea08142feab69d94480ab620fa28ac
SSDEEP 12288:zbsfpH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NY:G122Hb5Obvb+ISeZxNY
TLSH
T173650119D25412D9C16E6279CB929641F3237CA28BE1D3CB16D0F93E1F3AAD05DE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 e9fc9fc0974147796ae8fc81b40f9734b142aa96189cfb84b21748d5af62eee6
MD5 1dfdd72750c393abe016b6f2b8536178
SHA1 e6d914691b0d64eb609d9c12095457b7c6867e79
SHA512 1170623a26b984c1fc861ea3d2a857b3d52f3f474fe397f56a44a773152b9d58b4e3146e41a43ebf1b190bb37326f82aa19dec9c975b8c7eb83c03822c044f02
SSDEEP 12288:UcBxhBqP1i2yUnnV0jv1uBT2GF9mjqPaZRM11gNVxxG:UwhicN+fmjHZRM1qNVxx
TLSH
T1565529107626CB4FC66940321E32D6CCAB707D45FE05AF0373C98B3F9576A59BAE2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 38c675861dfd4fb8ba22e842694c9020695a7b9edfcfdcc1146718ff91d1ecba
MD5 52d4b3af78a7e58d918f9cd0d1e10694
SHA1 9471f88a33da647bc30e193f14e92d2a8c6784c5
SHA512 65bab1882fce568146649c3b5eec2cb16f535eb0905d02f9204bc714321248fa37bd1df416e833fccb696631e2e64361c64ac69a4428c7e32d9279ff64d6b60f
SSDEEP 12288:up1KIAJ9lzohN1H14MsFCsj3D+m2iJhQdCcWy:uozoBORz3D+m2iL8CZy
TLSH
T13065F9816536E7CFC1F65032033A9B8DB764EC06B7056F26B3890539D86AB46B0F97C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 84ba15991e568739b4296db4ed6a7ff65e1f5f67a5ee1cbb33e2c44831f0094f
MD5 7c46bdbae6db4b34052adaa99a619e89
SHA1 48802ad5bd23e8b1649962656d703cb814d2aa38
SHA512 ceca2afd2aeb0595f5828f33a528b0104fae71338333be22ab336bfeef06861b7b3733e445919184d90ebd3a0f9047302950d8314c5cfe44c5749ed57e9baa86
SSDEEP 3:OlH/lEO2DoKtpKz8PQfmqkYvllla3mCllltq3mCllltGlslslslslslsl6Qt3L/:KWyQ2aQf8AimCtSmCtEEEEEEElL
TLSH
T13A8192889B214E25C246613200294B540370C28EE9A083DF820A2433AC086FA0C02A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8c3456c-ff4a-47d4-a60d-5cd222ceecf2.dmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\reports\d8c3456c-ff4a-47d4-a60d-5cd222ceecf2.dmp
Size 283KB
SHA256 2966c4c4a9ba444123e38a524c1c5971c519f9f3a822ff121f2a6717d7768d56
MD5 ec91aeefc2e4d270e568a2a5e1693f8c
SHA1 05df2f0ad96c6065ecbb997b097c5be4272540f9
SHA512 cbf04fb5c87482e6fbac43259bc69a7ef760d54de18a1cbc46cf2a7fe0dc959d8be881b86f5637e57fde12b4cd9af9f4b0c2e2304e8e68d2b6a8c56242c816c3
SSDEEP 3072:wUh3JVf86XFN5RynAk0OEMrCWu0V5wRNqUiG:Df86XFnR36CkfwRNqUt
TLSH
T16954C426B79814A6E17A833489D35362B7F3F82007624BDF12604B7E2D677D46F3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 4322aa2696b8fcc8aa9f89ae72d559227f519db36925dcfb0d3f80e93996aaf2
MD5 85c818697d34f6595bef06bc53f95fa5
SHA1 cb72a734d96503f87cc7804a4d9054af30f1ecd0
SHA512 8fae17279d2f5c80630879188e524942199ec73b8ba0b7bf8e9467126b274dccc4ba3a7a53c42f87f1fc38c0db123f663c6bdf389d908276ff3128139cbefd58
MD5 SHA1 SHA512

Submit Download

c733b8623a35217a.bin

Path C:\Users\Admin\AppData\Roaming\c733b8623a35217a.bin
Size 12KB
SHA256 7e779f06a979fa3ebf1bd981b57a1920d7b74f899d7640b3dc14be844a953456
MD5 800df9ff8f9755b761746c737700225a
SHA1 81e10d69fef96fecf3b49290ffc505d11f35f653
SHA512 f1dd917cabae44b04fc4f8a876a5af7e9f160f8842be83aceecca10e4d19da87c3b6df444ff66fa92ca43b2d7ef9cee131d40bc939cac2ea154d5fd793a25056
SSDEEP 192:f0Vna5hU+Z8JHiRWhlF2r4s1pSAnbLW20Op9EatsocUoY1/v8f6Crj97seqe:faa5j8JC8l41GObLEayocUoY1MSo7Z
TLSH
T13842BF2007CE093236622EA151E8DD59FF17CF799628E6E6E1EB316DF46DD90C6AC900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 73eaaa0725b6e105457a0ba7475b7b4bd9745b0f6ed40b6b2bd33195e4bc4d34
MD5 9fce1d5d55f4406ac38ac2aeba4c7cc1
SHA1 b4225067224a04fbd143b85be17dd17edf2b3058
SHA512 2cc145c8a7064ba9370e064cf89584320583474255526d5d1a83dafd3d63603ab06cbbb254dd4862acb9d5dd8795dde3d70b06bf83878db6366d639cc6420700
SSDEEP 12288:U07hH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Ny:pt22Hb5Obvb+ISeZxNy
TLSH
T17D552315C317B983D7B957B488D6E016520DBEE39F0094D759D23A0EBD38EE098B8B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e4d36671132255257cdcfc196a8da02e084a7cf754eea83b1de69387c08c44fb
MD5 d63bf9c792700279e586b73787244b43
SHA1 134195f4bfb5448d2368d0ea2eb5d3a4ee53afe1
SHA512 f8d26a6b0f9cb1a12723bb7f3131714abbb06208db504135f1fef73b107f1f339bf3210277718b2a0b6b7c8870e88ada69447cb6503bf8fcb130ed9377ed9b38
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYX22Hb5Obvb+ISeZxNm:cgb4mBIBhGFDW8zjSIxU
TLSH
T10F65AE1E22EC02F5E1FAD2B8DDA64417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9c66dfe26b41e7db98d7d12f1405981d9204193664803dc0c90a48892b6f4279
MD5 06cf4d1cb8fd6b72c43a6bbd7b616821
SHA1 ad04ee085eb8147afbf2196ff4ae3bd7236f77c8
SHA512 4df42f464c19ea0095b8efdb93ef22739495a55bd70f102d0fde39888b9f8bfda39e2e1c37f1aa991670fe24d168e3f634c7c68692108563006298454082f4f7
SSDEEP 24576:nG88u8FpJqH1bzria7/mI22Hb5Obvb+ISeZxNm:G7ZFPqVea7/eW8zjSIxw
TLSH
T17085F125B7E101F1D47BD13889824663F672B8260364EFDF07A88B551F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 1ec37a62eeb6e37cdb03e9d0e6bf0dba0206bd9ab2d835878d99a280f5bc8ad9
MD5 13d39434c12cf9991de1b67de29f2ec7
SHA1 7748af15d74cd637c6cd2c48380afd5a08ca63cc
SHA512 aa0773efe982c39a3682638d6a81912b0f54ce5f7e0a0577d3b9b69100cce48f6e46135fb4d2d810acd3167643a0d8f839f12a658807f7aaba69139810b628f6
SSDEEP 12288:FHvUrBFrEjwaQEH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nw:FPUr+NQk22Hb5Obvb+ISeZxNw
TLSH
T1F865E21F62A918E5E776E17DC9828609F731B862171192CF02E1913E5F27EE8BC3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b31292c1dae15b7267835a85087a3074e93421e58896868377f384b22fee8572
MD5 33fa6ee9032e445e5725d19c95dcb133
SHA1 cb3925ad29705934154ea858e63a7330dc992bae
SHA512 fdabd113a149d7888a52191e2d95a9949ed2f47ac9db9fd98912c6ee45398b429017b2bf6c40ef6a76ba41ea48391a016f48e0579ef317fb58c789ac407553b3
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfW8zjSIxb:eG05lO43brKSIx
TLSH
T12ED5CF6E62EC11F9D1BBC17CDAC6860BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 77e4737a7f7299678c3fc2d0a2b1a075ce350ee47da1a532fcf718694957de59
MD5 b1891efb9599631ee0c1c45986423d80
SHA1 c2c4923d1094173399d2cb52c115ca2ca33b221e
SHA512 361df5f151cce30e914e6b8e7b21718d8d9e1e6a49e51b5b1a9a487695192431e232565ad6192989be28f98cb083b02419250f6819ecedeee7453afa5fa6aa72
SSDEEP 24576:efa5POZ3dpuWVM50JicR2hG0lasx2+47eidnG22Hb5Obvb+ISeZxND:Ga5POZ3BJt2pasx2+mHW8zjSIxR
TLSH
T1E965BF5EA6F801D5D5B9D17DC583861AF571342253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d504546e8e02c018a09a5951a855bd6674d7a3d11d96079ea8ee9e4536a5a843
MD5 d51ca47e4d0c2257202f8228e14f9fb1
SHA1 7d4c68d57a6f92de7ea9bb27a0dd9aa7fea4d6af
SHA512 3930ea6786184e1b3f2a7d3a4cbcfdbf303740bacfe152ca114aeb37ff5dad4d8e09513d145b3f35bb25a47f88263afb28bdd191fe48e3966768ea8dc215f69f
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7Fkw22Hb5Obvb+ISeZxNG:oNc/zEOVHF+W8zjSIxE
TLSH
T1F2858B2623E901E4E1BBE1BE89779546FA71786517308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9e17d071f7201ed3fa0750b860d1c715a8cc54185b58df8918875891967e4934
MD5 b416094966fee82adac866e0a5db8731
SHA1 d8c05281561f7b22ceb6390a05ed658af25403c4
SHA512 21188f61e8be8a247788bba828e0fadd6ebb6b9cbe361810fa5b152fc9921e50bb609df7ae4456c1bef272cce21ad97ad4078bdd3d3fd550e2f0ce53d7a8ae76
SSDEEP 24576:3TkNvNnaFeYhJNtmZBm822Hb5Obvb+ISeZxNE:3TMwBtOmHW8zjSIxC
TLSH
T19355AF2EBAB846E4D1FEC6B4CD238512E6727861073293CB5290C13F5E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 d14f3db2897ff3cfae90ea78ce1a5e4893edea2778fd694fb0af07c5e3eca2cf
MD5 d2af67130b975bd29ad231990a016241
SHA1 eb4820ac2f953be40e1814922ff1933807fe1fa8
SHA512 731c184fbcd327bce9f29426b1f9857b9cc082305db3ed92d2f5dedde33010f5421438181ed05e993b477523150bd0a734026a460220f3021deb6d41f333f43e
SSDEEP 12288:qQcMxWDXN1Dp/fshBItT1IQgAdH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCN:4D3FHshBIYQgAB22Hb5Obvb+ISeZxNh
TLSH
T1DB85E13EE65D04E4D57AC2BCCAA38606E37138A9072265CB06D4917A5F2BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2188-169-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2188-176-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2188-344-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2188-170-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2636-86-0x0000000140000000-0x0000000140236000-memory.dmp

Download

memory/2636-84-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2636-74-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2636-80-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2636-73-0x0000000140000000-0x0000000140236000-memory.dmp

Download

memory/3084-151-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3084-45-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3084-59-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3084-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3168-89-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3168-88-0x0000000140000000-0x0000000140230000-memory.dmp

Download

memory/3168-95-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3168-321-0x0000000140000000-0x0000000140230000-memory.dmp

Download

memory/3196-8-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3196-6-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/3196-0-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3196-40-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/3196-7-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3732-107-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3732-336-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3732-99-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3732-101-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3932-161-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3932-163-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3932-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3932-159-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4420-53-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4420-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4420-61-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4420-168-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4556-147-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4556-139-0x0000000140000000-0x000000014029F000-memory.dmp

Download

memory/4556-340-0x0000000140000000-0x000000014029F000-memory.dmp

Download

memory/4556-141-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5272-22-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/5272-13-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/5272-12-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/5272-126-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/5760-341-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5760-343-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5760-128-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5760-134-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5760-127-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5760-339-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5980-337-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/5980-111-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/6112-338-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6112-357-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6112-120-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6112-114-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6112-121-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6112-355-0x0000000000730000-0x0000000000790000-memory.dmp

Download