1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
Size 5.5MB
Sample261003-pryfrsydpc
SHA256 1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4
MD5 bb825e52a81eb666d91006ed9a1aa2eb
SHA1 d1f5f15872b34fd7f0353fa724291515193ce636
SHA512 c1932345c47bb80f7e8b48e44de6130a2521fb5692109987f2700ff9b5d61f6c644817b6f569f24f54e46e7517e6a164203bc60b4f877817e11fef49a499ee42
SSDEEP 98304:C3bQ/xqQZ/K0tuJbgt+qU0wBeUhKvd0jUf:CsTZ/K0tuOAqvQefFd
TLSH
T141464803F28540E9D059C179CB569232EB727C890BF2A5EF26907BD52E76AE07F39710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5740	elevation_service.exe
5708	elevation_service.exe
3152	maintenanceservice.exe
1380	OSE.EXE
2512	PerceptionSimulationService.exe
1596	perfhost.exe
3096	ReFsDedupSvc.exe
3688	SensorDataService.exe
5792	ssh-agent.exe
6140	AgentService.exe
4112	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\84f5f782b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\dllhost.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\System32\vds.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\vssvc.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\System32\alg.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\locator.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\msiexec.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\AgentService.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\wbengine.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076165e963353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aee0ed983353dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024f9e0d63353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036fe82963353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000212c0fd73353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7457e953353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000bf58a963353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
5740	elevation_service.exe
5740	elevation_service.exe
5740	elevation_service.exe
5740	elevation_service.exe
5740	elevation_service.exe
5740	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1984	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
Token: SeBackupPrivilege	3096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3096	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3096	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3096	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6140	AgentService.exe
Token: 33	4112	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4112	SearchIndexer.exe
Token: SeDebugPrivilege	4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
Token: SeDebugPrivilege	4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
Token: SeDebugPrivilege	4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
Token: SeDebugPrivilege	4108	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
Token: SeDebugPrivilege	5740	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 4108	1984	1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe	88
PID 4112 wrote to memory of 1572	4112	SearchIndexer.exe	100
PID 4112 wrote to memory of 1408	4112	SearchIndexer.exe	101
PID 4112 wrote to memory of 5824	4112	SearchIndexer.exe	102
PID 4112 wrote to memory of 5780	4112	SearchIndexer.exe	103
PID 4112 wrote to memory of 2128	4112	SearchIndexer.exe	107
PID 4112 wrote to memory of 1556	4112	SearchIndexer.exe	108
PID 4112 wrote to memory of 2284	4112	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
"C:\Users\Admin\AppData\Local\Temp\1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe
  C:\Users\Admin\AppData\Local\Temp\1026134c287fc662868a09fc116cae9924c32e00bdb296bcf447b4e35c2fd2e4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=89.0.4447.83 --initial-client-data=0x2f4,0x2fc,0x300,0x2f0,0x304,0x1404c3d48,0x1404c3d58,0x1404c3d68
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5708

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3152

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1380

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2512

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1596

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3096

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3688

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5792

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6140

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1572
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2700 2828 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2900 2884 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5780
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2700 2828 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2900 2884 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5e2d67b27cdd08fd7566c680e99b8124d310304da95b46a4a8b270f5b8f4284b
MD5 256a00d9590bf2cf53c517eb1e7a01ed
SHA1 d23afde0ace3c14d696d878d2daf3516414cae0d
SHA512 09544a2b4fc9b2442fa3c668c0381dab90aed80347ae958a3ceabcaa8b2e6dbef58139bcb0ca3769007ba19307426fad1cc055baa3d9af4aa1dc554fb4f7fcf0
SSDEEP 49152:6b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn/LywGjfMEgf:s3q6sjBy0jUf
TLSH
T1A3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 54907d60706a8ee6dc269765d8ea747acbc1c1800b7f17e5bf703d8a40faeebe
MD5 93b2f0945c7ec7557ed27bc6e97dcf42
SHA1 f1ffd34e8a56b4bbf60f818bea9e6ca8f02cc693
SHA512 3deb3806337bbdb5b1243566f7fc15830a13bfce228846ede5702f6776dadf22bcdd84876b5d5dc8fa31c46e660765690efa05bff0eda18bf5ba66f4da52e716
SSDEEP 12288:K1XLsswWkxy2lRq2czAbvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:AXYfDtczAhegGywGwrObfzWPESfrf
TLSH
T1DE650129B7D409F9ED6B827CC962C511E633BC5407A0EB8B03A4996A1F333C55E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 181aa942ebbe60cb4326b0e07efb8bd0d5f291ab7547d4e7dc3c9c04db6675c0
MD5 6c707ed6b281b0f36b4d705b66923b6d
SHA1 73c4e4b065bb33ed98f89339ea6c7d765611997d
SHA512 d8b63bd9d61e05a0cade3327a64ac6dddbf0ca1bda11ada8bcb4cca872a225eb39d3a7031f53619843dac8d9efdcb368b146cc25343cb1496095d8f38e192c68
SSDEEP 24576:E0Le5ji0hmx/rMWegGywGwrObfzWPESfrf:EPji0A9SLywGjfMEgf
TLSH
T105859E16F6788335D073C0B9C5D2A69EE97230851B308ACB4296D77C3E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 aed6c83ca923644218105e528f249d99cc79cc3e56d4c17674e8d79cddd86327
MD5 31edbb19c2da7361f614cfa197d94972
SHA1 fe4ea49fdb89ae751166061bde3d279d7f806700
SHA512 bd6ed1c3ef28890eff6a9f365f27fe2b14dbd1476ba6ca4e12d3a78f0885eee2411ee17660907e337b1050a5e9d7d3435ebf1994c85f5f163bbfc8ddc0b9da6c
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWn6q8wyusegGywGwrObfzWPESfrf:9/ezSC6vUzPveHjyuLywGjfMEgf
TLSH
T12C755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 45df03e6eebbbb59cc354ac9ce0fac937fef43793eaa05cbd9cb544ad6e5f9e4
MD5 91e625ae8fd1c5e85495bd69ddc0b99c
SHA1 b8893826c917819247e0ae53e314a633e7f670b0
SHA512 f75ef8914b0bfe9c6190b30b8a43d83c992d8388fe21b56150ae7ea24d5fb42299e0389d539b1475f2a01ea667957bef0798d77b3c91685d8102638b6e986dd1
SSDEEP 24576:LVbqPb88hv/l+YtegGywGwrObfzWPESfrf:LVO88hXl+hLywGjfMEgf
TLSH
T10755AE66F6B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2458263e01355a9fe6a581da8ddb19f116c3609a7855a959be58aa5d73848162
MD5 fc11a469eef166751d34e24ddab1ad5d
SHA1 461ee3d9e3630f6989f91da4b2e2f4f56802073f
SHA512 4a7dea74cdcdf9a4b4301c00e45ec021781e4fee993e0d8f6fb22922ed5b4666468c5827137517eca868cb043638e88c2c8f84aea7b00affb834da8215df1017
SSDEEP 12288:FG+vViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:FGCegGywGwrObfzWPESfrf
TLSH
T13245231ADF8C17A5E7CF87743A3DB5A585468F183C925C1B5321BECF207C283E684969
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 7d377fda06fdab98d96cc5205a37ded45a856071692d5f507f07fe266fb86d52
MD5 e7a70addab6f7a720aee0df2ad0c1607
SHA1 fc1b63e307df1f81705ce4c5db90d2f44eddbc5a
SHA512 65db6f392da8b3fbfc1546b91f700416e5d2c0a01f72053b2774aef289ecbea682b34da7c79ccf7a27798cb59edb1026c544657eef9967def6d275b17cbcb688
SSDEEP 12288:jeBNUbTVO86UPvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:jJIUVegGywGwrObfzWPESfrf
TLSH
T1CC65CF3BEE28FCE2C27E8DB85A51C640D76278304F62A3CBD165830E9E235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b4212ae99ff12ec2b120f709b7d2b1de9ae26b46a6a92d20753e3e718441f058
MD5 9374e7f232bcd623df9edac478d590ad
SHA1 879fceaf1c05f30f1255ba2f786c09d24c7ac8d2
SHA512 091ed3e931802c603fe3650b8f75237afaf4a73f7ed1dddee8c31928ed677cb321bfc7111b032abc71d392b877481ba870ce2bee42c52cecf72486ad23b946a6
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THi:vQvGAdlCEL8c/DRNw5Ct0jUf
TLSH
T199267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 3e0f5e0d59ccd27f20f393531caefe66223c9f9b1001d4ea01350cfb236a0822
MD5 fb914ea917ea833959b7d4b57e09f596
SHA1 f81273ad3faa5fc69ef6280c0957d583d4d9769e
SHA512 e397a226984f6759ab6e8839a0b1e78ffac873d2794f2c3fd052ca6ad9aeff7a6cb5f357a8ad512b5dce975eac106f9e3aef619947361cbb5643dd7283ef32f0
SSDEEP 12288:8AwSfxL/2Dc33DLLmt0LDQewsAj1vViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:huewsAjTegGywGwrObfzWPESfrf
TLSH
T12175E031FE74D036C3BF0DB22B39D716546DAA200F5119C3E3A89E9E59742C26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 57032fb550cc73584e10fe45281f6cedf12eea0163ddc6fc43f02bd2baea4f76
MD5 c567ce23f80cadce2ea68a48751caf20
SHA1 9b47c5d85f9a879951bba6d4d0f5055db55ee2f9
SHA512 d68b185be1881bae55aeb91c9be0f4fa84e2aef371e4637f2dbbdf57ff197e3bcbe990c5c97739819a436bd9ef13e0237df12f92931f1ff1e3a79e5f96af21cc
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHkd:IUEtQevvqc2W1cpV2tI32k
TLSH
T100474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 aa59ad8a41b50eec72fdba7ec56fbb989a385194878f87e405a8b43330f77373
MD5 627729ff43f10695b2a5f5d91d4c7cb2
SHA1 f93810fc4f3d64b23d32b63ecba06e32c208ad01
SHA512 bfe0c2fe36de0e087f6f310bff3de4c52a94c985b0cfd46a22b1b9c4d15d4814abbf10bf3f38937e5fcf962f29f990736767dfcf39357cf0cddf6d58e84c8eae
SSDEEP 49152:1CbRquA/m2yL5zQfFiV+XenmE3/zCLywGjfMEgf:ioqtVjnmZ0jUf
TLSH
T1E9D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 855ea10bdbce819653c65982a2f10ab9d83a82ffc55484bf536fcce2fd0a7e18
MD5 21073c0d82316339a8063980438bdc32
SHA1 8ab2083d458273d26f43e21e9bf277f80d1faf4e
SHA512 9f8daa5832164397fb4b58fd69238e780331eabf08cbb9e23d1633b1b8f0f345b3f748bce5423f4b364e8d23f46ecda732854d652118373a5c879f298a45e53a
SSDEEP 24576:XAhGL3IFoiwtA5l7S53gegGywGwrObfzWPESfrf:XAMUFoiq51LywGjfMEgf
TLSH
T1B1359D81EBF955D4F5F3AAB869769171EA76BCA91E31C20F2160D10F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 415f59a817a629119c2e92d3bfad59f4adcf63c8c9e86732bc879a721ab7531c
MD5 d5091c5386f28b4cdaf23449976d863d
SHA1 6defacdd689df0e6660d011782b2fe27dff7a96e
SHA512 e179521998ccb9092b6d9fed9b32a8934f05cd24f234b8f172a0889afca477d91f018686d013846b6f0f380fc1d7a64f0de60d5776606b755d43bf78e8aadfd6
SSDEEP 12288:Kmw5HEjsChNTBFgl0WDm+CwvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:DwuaOWXegGywGwrObfzWPESfrf
TLSH
T10265F14A77D80CF9E6A78238855BD136E7B2BC052A21DB1F1360C65B6F37351AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2aa431b4a5117c4d093f63b7099964f2d0a468c36ac01cff9baf41048fff6185
MD5 7ef6110038dcdbed2f897f86b72c2be1
SHA1 7fa1ce683909b400aa9c6cf196e9e26edac9f77b
SHA512 46a4ce29e3e752668b2f718c930f34a00c31a282cd42b140e41f53a344f8d5c698b0b64aad676c03113cb2ae73065dcda997728238ae1cece33030cb8a57632f
SSDEEP 12288:rAZ1IyFvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:EZu+egGywGwrObfzWPESfrf
TLSH
T12C55124A67C822F9D3978378A9B99645C36278153B7247CF13214A9F2F366C39E38731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 49b40eb7ebb2b53b1dfcd253c21f99afc0213479ea5d021bcecd739f5364c689
MD5 066be3874fa27b98e80f6f8e9c2e0d8e
SHA1 967283a55f5e44b9b99f423b0769eff982229ad9
SHA512 77977f76c237b8e869d0e4b997fee90961f36b422ae6a92c170dcc5d161e45b916586134681668eb22a842766e149fe426f6d89e3f34825c4d512ccd49051709
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UO:pQRQyi36YOcPbLvw2gAf+PN3G0jUf
TLSH
T115667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ac98d608bbaa7f58adfe4311450255615741d5e466ea5f4cc8ab1904bcb2166f
MD5 75d595f98f68ab56b5db925f6b288712
SHA1 18d04062be0abc9a55f2956f67a79edb450a25a9
SHA512 305556086ea531f8fb417ae8364798b22387ebe3568da03b36fb18935f5142b02d2ccbda1535b5d6f701abb99ba7f2ace27df576e82fbdbe2ef4db6cfaeefeac
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UO:xQRQyi36YOcPbLvw2gAf+PN3G0jUf
TLSH
T1BA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a8d5e1e63fb3b039c97b9bdd72b3e26522d377ec298dabde675115c4e2cfa1ba
MD5 a8ec1746448b00dacd675e24c38f4b01
SHA1 4ac70369dc665963f6ad6e4690a7dfaee2e2c9a3
SHA512 8aab9aba6e9284d2662d52e7c37e707f4a65c5ac49cc960b8beb294290f7ba9582fc5fdb2889286976e5323cf612f3834d821a21bd783695a3ce1352a75791cd
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0uegGywGwrObfzW3:968Qg55nhceWu7PNU3/SLywGjfMEgf
TLSH
T18AB55A33B2F600A9C44DD1769F4A973196D27C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3170447dc021a87a153210e3934fdd28b35d14b47562f5463a29cd881e17458e
MD5 95a8bdcde4681849b5b3d2f5e77ab139
SHA1 a621f555eb354bc5d0b764aaeffe4a638067293f
SHA512 eefac95c349a4cf2e98f4a6ef42848e9d1b199e0480a892eb26af4c66bfb7760250277bcc86f862030175e5a5015a97886f2716eca5788f001894e755ac1dd62
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99I:my5112gYy5azzVvt69nLKnhZ/0jUf
TLSH
T1B7168B13F29901E8D05DD1B9874A9232EA72BC474B31A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 97465ab137fd991c281548c83483d1ee8e4a4af13406b5d9766704fc94f27e89
MD5 9513272cdcd845d6871c2e99089be580
SHA1 e94166333dd0b286037d7740dc5fd1c799558925
SHA512 3c80600cafa2d3c4367196086d61684b9eaaf1a752c7aeb32ae2918f6f0039050078b1d11f8977f585d25cacfadee31639ae9ddc09438fc02e64cef1e29c1475
SSDEEP 49152:AB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glSLywGjfMEgf:au6Jmdxd2ds0jUf
TLSH
T126D5AD13F1D901E8D05ED178974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b08b4fb259ab6f39833aad402d9aa85839e97eae8199d12b1d4f276fca586e0a
MD5 f30ed084a5a379c49b90627b248a7215
SHA1 b532171be44a1906023b6cef7e16d4a21e708eb7
SHA512 97bd61e1db48f9d5bc87d02881d6001f5c0fc4a380d91282692d88c8bf58052fe6f353a5701a6002adf4caa7120fd584e517d98b11cc1d18204bb27329b78a51
SSDEEP 49152:t1hpsNoJpF1A63U44CwH7R4xwLywGjfMEgf:tmifPWRZ0jUf
TLSH
T10CB5BE13F2D901E8D05ED178875A9232EA62BC450B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e0cdb89eeaed6dda92fecdf7eaedddd9b01ec4b2d361c64031d8a0c709d1a4fb
MD5 02ae58f77bf3f343beb1e887ebc6eb5b
SHA1 118bf32114952afcd285f507cbfb990e15bbc5f9
SHA512 1a150dc3a23990ac37d50c530f14db18706e78aa3c0f0a7a68ba52d30caf4f226c5eb80f04fdaebeb7d738fa2117032d5090d2e49a622f708110050b000891bd
SSDEEP 49152:xSuZQIY0Be2KcRVtOnks6NMHqPLywGjfMEgf:f5dKii61z0jUf
TLSH
T121C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 27e03f9916192e291b569739caa583779ee77c42e23ddd25183ab51c81677784
MD5 fbf2a852e723fc9852a0309c3fab51eb
SHA1 68bac895bf1e91eb410f4963bc8c3f5ea6ef280c
SHA512 70faec235cde16f83692896beb3ec5e1ba39015e91960b1a02480aeafa1b6c4128b7723530d7e07a997cef4281ca28ffe8335e94c1367f3a10fb37d03be6f63d
SSDEEP 49152:whtSn8EApI0fig3giDn0AP5w0LywGjfMEgf:hX2imph10jUf
TLSH
T1DE95BE13F2D901E8D05ED178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a4f0fc9d0a58d6e6d6717487fa6b03a565f65009c9f7ce1ab58891f5c94a5c5c
MD5 9a40e9fd88ee2fa15ccf20bffc71bd84
SHA1 d613eb067d0afcf3468c6f7aa42be31cab39ab26
SHA512 6641c969a628ebbbd6d87b842e9efe168ecdd8df63904aec1971a21d2afcc6edb6eef99bd19ae0e9572a466f4bbb47f02c6d75ae426fbe027f7067d7557630ee
SSDEEP 12288:q2vViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:qKegGywGwrObfzWPESfrf
TLSH
T16B45231ADFCC47A5D78F87B4363DB1D5C54A8F1C3C92581B63266E8F257C283A6848AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 835520b454b42c8966e4c4db149666d1928f2029c6674f4fde8ee4c619f106cd
MD5 2c747fc48fcc62d515576bdb30700a27
SHA1 81d515d3129623981268f9551e5ed89299e9426b
SHA512 dca9ebf3b2f224c24c1be69146546695f4207abef42d41d6bb7f5e54103db3fde6f8b1a5d9ba87f6dea57b4ec99818a91daf9e3abae6fe7d403dde84561ec64e
SSDEEP 12288:lxvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:lPegGywGwrObfzWPESfrf
TLSH
T17645231ADECC07A6D78F87B4362DB1D5C5468F1C3D92581B63269E8F317C683A6848BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f933484a083f5f101abfc3359130dafd593b49f31a83b3407e9ca1c306864495
MD5 db96c976aa88b4c0bf62727c2291201b
SHA1 df5f813e8958c18eb485e35a06bf5c441882ac34
SHA512 a86ecdad4dab0092cdf479d4e9b4ae9f6d01e7f77bf7c4db3583afba4e79b4926519dfb235378b116166cb9fb12bd36a9b7f992f3f76dda59c059a34cf1c148d
SSDEEP 12288:PHvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:PdegGywGwrObfzWPESfrf
TLSH
T15145231ADF8C47A5D78F87B4362DB1D5C5468F1C3C92581B6326AE8F357C283A6848BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 61108ef07c371f0b52d78c33e97839d15ab6fa0261fdd279fd5ad3f4a7477a0f
MD5 5b7d5fb42cc4e35da5400cdea0bcfa80
SHA1 2cb3c7fddaed8417df2ab2028460f2a5ec25fff3
SHA512 b0666252eb1b496f3ab483adfb9a6b68c4650986de10ccb2f136c02025c1292e5c910b15520861cb4bf4f04da8fc10e0812e4ef44331ecef37f5a152078b6584
SSDEEP 12288:WVUvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:LegGywGwrObfzWPESfrf
TLSH
T17E45230AEFCC03D5D78BC374693DA195C266BE583E72591F53110E8F1974383AA64EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cb0b4c7413a3d25307daaa2a3b98456e15d6fda22a2b0b1d450286a85d0b30da
MD5 e20bdac73491cd82604b36d869ed7d62
SHA1 d7b553dfe5cc37c1b11c3238be73a752f82bc161
SHA512 928d2f64b6eba869b63462fd832ee72b8112f730984a2d2c617f04d536ea944246b64516c099fea798736c5c1421076acd7df4a527f1267d23a59cdc5aaeb7d5
SSDEEP 12288:E8vViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:EYegGywGwrObfzWPESfrf
TLSH
T16E45231ADF8C47A5D78F87B4362DB1D5C5468F1C3C92581B6326AE8F357C283A6848BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 fec93ed32275fe2de6058124e5d20b9533e768d3cc021a1b1c617ace6ae88382
MD5 ee06ad369107699e034353883a213d61
SHA1 f605188005a3af22786ae1b3a765e24e16a85907
SHA512 a443022ceef2ddc526c159a2ab21d116ebdb6b16f0d770eacd130d7643dd001d9ca0d3affc8a580d33c527d40d0b996ee5e8bb008d7e92661ccc2125dc8db27b
SSDEEP 12288:wNvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:wbegGywGwrObfzWPESfrf
TLSH
T10645231ADF8C4766D78F87B4362DB1D5C5468F1C3D92581B6326AE8F317C283A6848BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c6629f1cdb835a155c082780164390bcc5cb845305658d5e7c7de2495ab5b7ad
MD5 898d8b39d58bf6d2abfbd4839155dfae
SHA1 b6e6a0c52b85722df22ffdd3c32758cc8a13c93e
SHA512 800db3c1aaee71e3384196f953fd7e214ff744c725f0f07a729c0cd03b1e1c500870d03436852f75745697e1b876d6f082512ec1512fe74c7e756f07d09afe10
SSDEEP 12288:85vViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:8HegGywGwrObfzWPESfrf
TLSH
T1F045231ADF8C4766D78F87B4362DB1E5C5468F5C3C92581B63269E8F317C243A6848BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 adb37b1d4bbe4cbed5762952130bb0151581dce0fc155f5af414bb77c0864325
MD5 93e6be88382cb0b6f4154a868758ba17
SHA1 dbc71fbc4e820042d46d5ea9f84b4c11ac095378
SHA512 8d8d1592934a76ab6e4788da08c75ee17170edc93416c922b5ccb4e7f29b154a9fff16d865ff5548ac916579d880c0e12368d5f9cbbc1a2ea266f5301ad0cba9
SSDEEP 12288:yiZwbDzzFEoS2cPvyRvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:VZM3zFVSOvegGywGwrObfzWPESfrf
TLSH
T19B650295B38419F4EDA7823DC9299906D2B27C191B70CA1F03B4366B1F333925D2DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 149d581ccd535addbefe1e77ec87cdaf01750a997475d72809788f11255027a4
MD5 eac934b85f72bb9a0b67be8d208f1371
SHA1 c09ffcc3a9e81bb4f98995e73bbcb0477d5a6c7a
SHA512 f3a7f57ff4e332b2203a86722fa42cbc3190f86ab8fd38028073a8461ff8d3b2a91938e7f1e389a3bc260fdbe08579d26c4a2b33ba4311dc2959d1be6dd972f6
SSDEEP 12288:O6vViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:OOegGywGwrObfzWPESfrf
TLSH
T18F45231EEF8C0765D78F87B4362DA1D5C54A8F5C3C92581B63269E8F357C283A6848BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 60a00e0d2cb274b8f7b6be09f38a642d67543347889ee747afb45fe4e3e5c4a4
MD5 05b6be47c3b0a3314b4f3ba5e1bb5eee
SHA1 ebfe1429a60cb42414ed59ff5c3f8fe899560760
SHA512 b8a1fd48f620d89f25bb90bf0bd3d3e806b90a050d8c621cdb16794cefd018168e7d7f8ce7b51124d98cf771a18a99ddfcc1267f272712561e917ddacd57b7f7
SSDEEP 12288:sOvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:sSegGywGwrObfzWPESfrf
TLSH
T1AD45231ADECC07A5D78F87B4362DB1D5C54A8F5C3C92581B63269E8F357C283A6848BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a60f69b12cd16e0227ae90de1939c8289577f48a66689106aa8c446177dda791
MD5 9a803c7b6094fc0bc090a6520ceeff84
SHA1 ae7c23c0d72824fd08866b7f19e4b0958c394df4
SHA512 5f7f7236244750dfe765a3c7e41a25154fb20573cb1ed2f2c0898c32c946e829c4171f2783d203fbc62d8f48cbfe3dd483c9da801fa324f2a90ab65b5736e585
SSDEEP 12288:7yPz5L8FvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:2zyjegGywGwrObfzWPESfrf
TLSH
T12A550207B79421F9D26B833499655A41E372BC351B618E6F13604B7B2E373C29E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fb57f6b3aa7f6f0cbb7ee285d126de828ed061493ce6d37e2cc67ac5a61776b5
MD5 2e387b8233390b579ef26210975e2a4f
SHA1 3ad21d8d7bc41a4b5fc6daa8766acc52736c42a8
SHA512 885833aff9f4e0d2c68ea561ed6b3bb311dcc8dfe6fb90374e437847c2099e79ed2d305456977a299eeac3eb896ef53ced56d59921524cd187a1d21ba4b1bf7d
SSDEEP 12288:X6vViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:XOegGywGwrObfzWPESfrf
TLSH
T16E45231EDF8C0765D78F87B4362DA1E5C54A8F5C3C92581B63269E8F357C283A6848BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 05d284861816c11b1fbf74e959047753c2fc458cea136de5e64a3a7530bb2ad3
MD5 841243897de0c29cedc2f4797ea2c348
SHA1 1dd92d479377aae36f05361dca836897370d4b19
SHA512 a91e1ad04ea018070222e39f6b740b0d299f878a0b31654ee7599da394281f773c220b4753203f6668699415599f83faa10693f5bc72e644cb1454c5e1c4b626
SSDEEP 12288:r6vViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:rOegGywGwrObfzWPESfrf
TLSH
T16245231AEF8C07A5D78F87B4362DB1D5C54A8F5C3C92581B63169E8F357C283A6848BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 66ea148784ddf4b87e29639ab5d1b906e8bf2c7dc3f63384904cb83af75a1ea1
MD5 8a3680db3ca0dde72ed48cd4f38d61f7
SHA1 16717914c1226e63d9f47cb92296f3832c725579
SHA512 79d40f3e315a8c98adabcad8b6ca61cba41d5c399bcc57f709c5ed2a1f2be2cdf2313ea3c5a46e5883c224a8912b4b00c0b3c8ac1fa8c1a1f29e2c41de8fb406
SSDEEP 12288:ByPz5L8FvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:QzyjegGywGwrObfzWPESfrf
TLSH
T18E550207B79421F9D26B833499655A41E372BC351B618E6F13604B7B2E373C29E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c643339c1deed1cf29993bda924f0339b47f59ffedb706e8f4a7cf481dc31314
MD5 1de42e70246beeb2288a6c3a59c214e0
SHA1 bd20aeab53aab8db437ecaf48a7d21b3fffa262f
SHA512 d10b2cc5bd28967089e1be338cedae3eed913e89cbfb395ed99f3fde93effc203ac36bd701f09d400c58311954bd503e4d9be2499b1c6ddf6b52438c14fdeb9e
SSDEEP 12288:FCd9cWYoaLHF3z0z04PDvh3vViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:ATNaLl3z0zDNegGywGwrObfzWPESfrf
TLSH
T13B650295F38019F8DDA7823EC9299916D2B27C191B70CA1F03A4366B1F333915D2DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 dcf5544cf9c2ef613f910ef563d72f43b361bbcc782de1cb74492d1e9b9605fc
MD5 64872074b0acf6ac223a4032aa9ecef9
SHA1 2204c7e657486782b611a0170ae17a5e8a4a53e5
SHA512 42703f6d423177ac9142999db1577b9d39656f7d78f0e7c44ca404a5938931b88df0c641a68fd94030e3f4acc47a851f11b407ece58381e76ba8ddb9bb3e41a9
SSDEEP 24576:q3cd9CHKy7GZpegGywGwrObfzWPESfrf:Mcd9CHKyaqLywGjfMEgf
TLSH
T13575CF90F3E811E8F1B78A3589769511DAB67C591B71CE8F03A4265A1F337D18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d3fd0c375d5b94044feaa08d7fc2c4d143e97d3e799d87e4b6b32dd4ccf7ad1b
MD5 cbac7b7e4f70b9f76a8481d281662b7b
SHA1 3913aea22b3f8baac07590a97a89a8003d50ce75
SHA512 78aa5bb1fdd530ebe4cda949d8878668332658951eaaf139e63172d42080379edbf8929660d24f46617cfa19d11373dc83aeeb24b1b5fbe610697d2301b41bfe
SSDEEP 12288:cnvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:c9egGywGwrObfzWPESfrf
TLSH
T1F845231ADF8C07A5D78F87B4362DB1D5C5468F1C3C92581B6326AE8F357C283A6848BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 491c766ba03361f6d01f71674e438072e44b4925b9d7ec1e624b2a9febf83aef
MD5 4bc8a23e07cf2787cdfe3ba91b317cad
SHA1 7486feefdf5d6b133f7b6f2afc2633dac695e138
SHA512 31cb1539601b70c054b31564e361a9a6a853091fedbebe1e2f1afef2020a78a4d46b644fcb56fc12de7399aa7c6425b40286e6805855367d94190d04b2a3bb94
SSDEEP 12288:QlvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:QDegGywGwrObfzWPESfrf
TLSH
T12445231ADFCC07A6D78F87B4363DA1D5C5468F1C3C92581B63269E8F257C683A6848BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 cd906837f1c06f62d3d2016c6fb7653b9f13d0fe03d6caee4fb62b18b28371d0
MD5 6c7039db3755d3aa8b8170e8132c2f64
SHA1 b4f4c4ce17e22f72a099a4e75bc34707d8826c05
SHA512 3d6a8c37d1f399588854de4c27ddbd72f945916c679b3138f923d4eaa6fb49f887205087c7e322a9e4f1e4807f4b8095e7cf2d7d2f6d387ff63c0c666e031a2c
SSDEEP 12288:mYvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:mEegGywGwrObfzWPESfrf
TLSH
T13045231AEF8C0765D78F87B4362DB1E5C5468F1C3C92581B63269E8F357C683A6848BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6b36996818bb0564fe41fc2b1a251f5ac6541dff14d4629830024cb98affd623
MD5 3326d82a174dd90c3bf2868447297228
SHA1 5496218384e8b387f272978da5cf7f0f008fb695
SHA512 00b720befc77bc013bbd0771070c36ff3ec1396b6bad0982a46c0154dd41261dc05dc2acb6cbf0a644444ca82c2e69b0de85ed1778b84a0fa72ca7c7957f89ed
SSDEEP 12288:e6vViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:eOegGywGwrObfzWPESfrf
TLSH
T17B45231AEF8C0765D78F87B4362DB1D5C54A8F5C3C92581B63269E8F357C283A6848BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 a80f0d056f376f725a95488d68d757c2bdc932695f0e7d10315d2e61416cd70d
MD5 20dcfdae31600160b16b7f7a6e19050c
SHA1 ad2e53fe92620d9f075ed741a8fa630f2cab38a1
SHA512 920a4852f58ff7917fc5f4ac035c6b0b8b9fa8b2282ca2c36acd9eeee7647f49db233a23171e7ee232c8156cbe2b80a90cf195b2d06443f8ce1264ecba294676
SSDEEP 24576:0fwvKk9RX6wkyAIiegGywGwrObfzWPESfrf:OMnYIrLywGjfMEgf
TLSH
T14E85D029EBCC45E5E1B7923C99B7460AF6B178581B31C6CF025A53AE0E37ED05E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b1e1ebba28782cfadcc3f3cde52623f4cdaaa5cad17117bfe102609a4ffe72aa
MD5 360124eee81300f19bb337dab24b6113
SHA1 77e5d42a3cf426c431ccc2ec97de51c88cd20ff2
SHA512 215563f20fe1a1597d3fa8283dbe531675a4f94679cbc14c71aaadeee2c1bdcbcd4750dc6ad42b818decc9ad943e0a29ad0613ac55018f467fb4114d64d4f705
SSDEEP 49152:zYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ULywGjfMEgf:GySzPm0jUf
TLSH
T1D7066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 00fcf1cf366e463cb373260827a84d83d9d3cbae63f84d904be5488710829022
MD5 c19818de8d7503282f87b51461c142a3
SHA1 ab187081272b7642676d79a8f6fd265e26ee84c7
SHA512 6a35104f0b9ab4f2121344ae81d4ab79950b2642274ee0942e7364783733b6e7b31e997e1dcc67d137c0991980cb5b242005288af112d091cc7094ffffe34ec2
SSDEEP 24576:W47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY/egGywGwrObfzWPESfrf:W47JUQjTirIhCnDHUPfF/kLywGjfMEgf
TLSH
T15165AE1EA3DC02E5E1BA927885154A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 83aa8c4f559088c627f4b3b02671958a8cfac22b5ae266ef7168f5018daa3420
MD5 e0361457821cb7e11550451c0bc06423
SHA1 92e63f1a941ba575b96df26f8b94369c768c5888
SHA512 d6176866fd7e66c0c3d350c9ae79061a4f26e16a440eea91ca04c2b671c2de6fbe9abbe3f6dffde35c15b04d8bb159f5c23bbf69032c01b54715b3998b3d71bc
SSDEEP 12288:bJsfqvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:E+egGywGwrObfzWPESfrf
TLSH
T1DD55010AD28802E8C1AF9275D7199641F3237C245BE2D3CB53D0F97E1F792819EE9A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 ae6986021fb8cd74d58311c05420d5e6b1973f211e76ec8b7a89d3887f8077ea
MD5 1dd6a5d9e9b5922ff3d29e882ed5d790
SHA1 d4d05ad236908b4c6e12f81112e5d1d2ec2352a4
SHA512 8e485ade866b7517e90bf4483e948d3df1f856c26623a3239b433e35fefb6899cea1222e3aa2e991628ff10f2ee47ed79e5f2a6ca37ec4d1a5109c29c6468d78
SSDEEP 12288:YQB9NoOUnSEaLF5fPoiYat11oWE5/nrnAN8Mm:YQBwnSEa/fPoi51CWS/n0pm
TLSH
T1404539007266CA4FC66980325E33D1CCAB707D55EE44AF07B3C98B3F9576658BAF2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 1a68e7624ea198870df486e864adbe9357602b81f66a19d3441652efc6c330f2
MD5 41bd2d7db4d89ab67aa1a94dabeed83e
SHA1 3cad6832e89de7a6df467a2d84620a7aa185203e
SHA512 7ef3c1a71260111d896ec630b747d0e0d19f3fb1b75cc45469a21720fb5623ac3d3d72a64fce76f3d9ab913c261250c45354257083549f6b8527a03da8fabe65
SSDEEP 6144:K1qIqxgfgxhFhdmN4x2471LhBX/Jka7tMxAeIQK87tMxATpjgX4z:K0ZbtxdrZwIK
TLSH
T19155E9415037D78FD1B76032072A5B8C7BA4AC167B096F22B3C9453ED82BA55A1FA3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84f5f782b68fd3f0.bin

Path C:\Users\Admin\AppData\Roaming\84f5f782b68fd3f0.bin
Size 12KB
SHA256 41f926cbefa1a27cf50169244b8776d36dfc90b39c542d1e8fb61c3b1fdeab30
MD5 bfca9f535f5cdefe131780202ded3366
SHA1 429a9f895f423c252a481a69bd3c4d90f01bc551
SHA512 652436eaa85082ddeef622487a2858d6a6b828bde2b9a6560f9a4c1ee5f3a85942d521180f42db8089ff391957883fa11f61300217575e8d94b61c71d85a2b4f
SSDEEP 192:sx56HHEhKQqi48zr7lhujduTaa/a5Odfb2FW/syLhHnJi9XlOAMAG3jP8998X:yYHm/Lzr7DCdi6OVYKsAHJi9A/Q98X
TLSH
T13C42C04CD7EC5E79204E045EC32264E04B3C0E7A29B635B5944E1437DEEA452979B27B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ab71551-dbc5-4087-9a17-0a47faaef84b.dmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\reports\3ab71551-dbc5-4087-9a17-0a47faaef84b.dmp
Size 324KB
SHA256 4ba1d3f32e05f486a47a5905efc2f0f6a0c804a7174ada786d006e6c97a64dfd
MD5 67297490a99893746aa6be5ac0a77b43
SHA1 c8f4bda360e3c9ae577635a6a5e364418e28ab53
SHA512 a0b8be18d2a9cd33dbda21d10dcf818c5f5746022131d1df80906ddef47c95319feb0092a81d79ed033a668e7990ffd3bb63ceedb38da314bcb1ef601b9bb943
SSDEEP 3072:pVrODJvc8g81Ira5nvG1ZOU5OA7kGRq0OEMrLu8mV5Mxv3cE8:pV668g8ua5nvG1ZOUn7kGuFmfMxv3cE8
TLSH
T13B64B127B3D458E6C166C7758D93A76077B7F8E107228BDB0290427E1D2B7D86E3AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 a77d118436b90a15227d71fb44049c0b0303f799dddbee5bbe4931d8865312be
MD5 9a5765bf645d1b74a3eeaaa607ab4e90
SHA1 be557bf7e5c882547f3c4bee063c63bdf2857aca
SHA512 d4a255d36ce17afd9fb78fb6a25f36a2d88916537a7bf6fb00320f71473fec602ce3ba16ce17a4025adebf48edc86ae14ec3ecd6d86a243029b8ac34253f46e3
MD5 SHA1 SHA512

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 940260bace92e53d6d02f09995811749b1b2f6904c239d2552293d111d044311
MD5 5c4c661002ed59dbbf908ee0c65676fe
SHA1 b0de93e0ae3d9bf871c225d94d38502a5ebe1aee
SHA512 37fca37d375e0cbc31d8bb8b12654be7198629ef4996498887a78054f5d8111588df97bba49c4f64dfd9d1672afc37c3f8cc251a0912a57616615350c91234ef
SSDEEP 12288:Vr7yvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:V2egGywGwrObfzWPESfrf
TLSH
T16C45231ADB8C0755E7AF87B0353DE164910A9F283F51885BA3116E8F30786C3DEB496D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a7eaac1f3253e56913bd3711b248d6750ac7b8662c0d6ae1e18093e1c691af63
MD5 063d13e31ea474bbaecfcd5bd1a47037
SHA1 6c112b0debf007fe22ab2d0d2cc01480194c2d0c
SHA512 4b799231d55c698295b91186dbb93c05d00e87381c346a9382564aae7ad73ad1faf6103cbed7f49c32b7e5367e18aeae802334a130c26868ffc9bb4459648381
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYsegGywGwrObfzWPESfrf:Wgb4mBIBhGFmLywGjfMEgf
TLSH
T1BB65AE1E22EC02F5E1FAD3B89DAA4417D6B278160731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c98e97645612434d0b578b29e760e9fb807e3df9c4c885e3e3d785aa60257382
MD5 5116071a9d9558f6d5173b126fe77176
SHA1 bff1b793ce164bebecca739c64dc080d4627f321
SHA512 fd77ea5434e6f7a3e84aebf2df0a18233621ad94b2d67fac32a9300ca6fcb96767a65f9736177a010ee8c6742d91025e96d6f1c630c9fc5e44189e1ecae4f8ea
SSDEEP 24576:/G88u8FpJqH1pzria7/mvegGywGwrObfzWPESfrf:O7ZFPqVga7/hLywGjfMEgf
TLSH
T14085F165B7D402F0D47BD1388A464663F6B2B8251360EFDF07A88B561F23AD14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 0a10e84d13308d967990fc01d2bc42f52569f8faaaca1e980de30be683d5e55c
MD5 257385e0e48e36411649f39f127f03d3
SHA1 10d4937da3a0d89d6b4366bac8dc0e052c07e26a
SHA512 a754a539dbe9ef6991f19dcf9ea15d7ee6b3befabc04ed375bb7a3a5d02f63cd11b8a37db3c502a3290bba28e0f4b1bc1e0c23ebcfcb535b69529fbf0001d6f9
SSDEEP 12288:OHvUrBFrEjwaQdvViA83gGywGwSMGPfjfzWPEegDMhFkKXrfOu:OPUr+NQregGywGwrObfzWPESfrf
TLSH
T12165F11F66DC18E5E77AE17C89468319E772B861171292CF02A0817F1E77AD8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 68d5ee4b8e3e37877a77c759b03ef2445febc51ce517aa5ab9c44c5de06ff935
MD5 5ea159252a72045b72333951a5998b87
SHA1 52eb34e32fa15fe0272ada54feed9af522fc7499
SHA512 064d37257ba347b5f50ced4e6a5d805fc2a77c76cf2b11b36922fdf92edb480fa46497ae8209cf611da60c6c57a54cea87789a06f42dedd352747112701da307
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjaLywGjfMEgf:FG05lO43bH0jUf
TLSH
T1FBD5CF6E62EC11F9D1BBC17CDA86460BEBB23815033556CF02A486A91F27FF4967E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 214d331c73986848865fad770a79c8d9c97c1e636ff288d76e1ad055ae03594a
MD5 7a58fb8b34ca2320e369b211b06d0e1f
SHA1 ccbf88d6b91caa91aa02d535052076850d13bdb1
SHA512 845fc77fe2f81a6ca2dc10b1ed8b405ebaff6585ea214196bc111b4a0a6f8763fbd25f2003183ba5a886e62946f92d06ed4dae1f41743f7b7f4e456f93c47d4b
SSDEEP 24576:6fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnBegGywGwrObfzWPESfrf:Sa5POZ3BJt2pasx2+mSLywGjfMEgf
TLSH
T1CC65BF5EA7EC01D5D5B9D17DC583861AE5B1342513329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8da5ad489bc2818ebf3bc6237491e2b10d25c9fbdcc111889b4d5a6dcdabdc78
MD5 32d8c2a2a3e17631a0ad5fb5cbc91255
SHA1 8ac6aa03a418bb956f29c574af41319a19cfab27
SHA512 9a82de241d26ebb1ed579368e296fe0398e8cca428c7d2eae5fdd6b9f85ad996c24f6198edefea9500709498a13d40f7bdac24c9b8500f553f3bf2652d490ddc
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7Fk3egGywGwrObfzWPESfrf:INc/zEOVHFBLywGjfMEgf
TLSH
T171858B1623E901E4F1BBE1BE897B9546FA71786917308ACF0291851F1E73BE45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 563558f257c62518b84dcd939637f62db9ad9e5edf6a2207bea74bb5258b8b38
MD5 538c1f850822b5fc9509bcffc0323292
SHA1 0e60f82539a5b0fa8fc8f5db26f3bf6be1d26844
SHA512 04c55184ca41a8dceaa239cb5d9057d484770ff54e8b9dd9a0d7f8fc7724f1a6116a469097098e993acc997e86c948dd0e7cacb783b64ba4ef15e0579d4b43d4
SSDEEP 24576:STkNvNnaFeYhJNtmZBm3egGywGwrObfzWPESfrf:STMwBtOmuLywGjfMEgf
TLSH
T10D55AF2EBAE806E4D1FEC6B49D238512E6727461173292CB5390C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6c03556fbcecffc8a89a8c5304b5e4921a724b6e02e50152d4353c03ff873b7e
MD5 5f4bd4a163a6af427076a62ad1f20a2c
SHA1 6ab938eebdaf7eda73da29cd20677c976a96d3d9
SHA512 2cdc3f04b5284c553735243b1e9d4907ea4cd9c1613b785a619d79446c8526dbf215a492ca3e7237c48f08e0fda6981cd7bcd9fa44c47cd4c106865c08afcbd3
SSDEEP 24576:tD3FHshBIYQgAqegGywGwrObfzWPESfrf:tDVHeBIAADLywGjfMEgf
TLSH
T1BE75E13EEB9C04E4D57BC2BC9A638606E77138AD072255CB029481BA1F6BED47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1380-88-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1380-81-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/1380-313-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/1596-104-0x0000000000400000-0x0000000000533000-memory.dmp

Download

memory/1596-105-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/1596-343-0x0000000000400000-0x0000000000533000-memory.dmp

Download

memory/1596-110-0x0000000000930000-0x0000000000997000-memory.dmp

Download

memory/1984-39-0x0000000140000000-0x0000000140597000-memory.dmp

Download

memory/1984-0-0x0000000140000000-0x0000000140597000-memory.dmp

Download

memory/1984-8-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/1984-1-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/1984-7-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/2512-100-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2512-331-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/2512-94-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2512-92-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/3096-115-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3096-363-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3096-347-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3096-114-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3096-121-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3096-361-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3152-77-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/3152-79-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3152-73-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/3152-66-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3152-67-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/3688-345-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3688-346-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3688-127-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3688-128-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3688-134-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4108-126-0x0000000140000000-0x0000000140597000-memory.dmp

Download

memory/4108-12-0x0000000140000000-0x0000000140597000-memory.dmp

Download

memory/4108-19-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4108-13-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4112-349-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4112-176-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4112-184-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4112-183-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5708-182-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5708-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5708-62-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5708-56-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5740-44-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5740-52-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5740-159-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5740-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5780-425-0x000002516D070000-0x000002516D2FB000-memory.dmp

Download

memory/5780-360-0x000002516D070000-0x000002516D2FB000-memory.dmp

Download

memory/5792-147-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5792-348-0x0000000140000000-0x00000001401DB000-memory.dmp

Download

memory/5792-139-0x0000000140000000-0x00000001401DB000-memory.dmp

Download

memory/5792-141-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/6140-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6140-161-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/6140-167-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/6140-171-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6140-169-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download