bf29bb1d08a969e843cd6131451a7582fa83805744d3ac924b30736094fae5ae

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
Size 1.3MB
Sample261102-aexldafz6j
SHA256 bf29bb1d08a969e843cd6131451a7582fa83805744d3ac924b30736094fae5ae
MD5 7388ce8c746b53c85e70e457b1103c93
SHA1 867c641e9beebd1f050ba17ee91c9be86d0cb9bd
SHA512 07d7ecafe5ca8cae3712588508ba67d69bab0cea6b2e30af12c9c8e02d9257c781c0208999f4af8d8a28b1c5318fc25990c0b52dc8c4522517db0c325143b06b
SSDEEP 12288:kMpX20hoHbgpcffXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:kMpjafsqjnhMgeiCl7G0nehbGZpbD
TLSH
T144652222B2E88033D873193481B5FB755E2A7E756E3049077B5629BF6F30A804B39367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1612	elevation_service.exe
2108	elevation_service.exe
5904	maintenanceservice.exe
4416	OSE.EXE
6016	PerceptionSimulationService.exe
1068	perfhost.exe
3176	ReFsDedupSvc.exe
2332	SensorDataService.exe
4588	ssh-agent.exe
3460	AgentService.exe
5200	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6e4023a431e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c466728a5e6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9e1ff485e6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f64aff495e6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000eed40495e6add01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
1612	elevation_service.exe
1612	elevation_service.exe
1612	elevation_service.exe
1612	elevation_service.exe
1612	elevation_service.exe
1612	elevation_service.exe
1612	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
Token: SeBackupPrivilege	3176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3176	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3176	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3176	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3176	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3176	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3176	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3460	AgentService.exe
Token: 33	5200	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5200	SearchIndexer.exe
Token: SeDebugPrivilege	5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	1612	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5432	2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5200 wrote to memory of 2004	5200	SearchIndexer.exe	102
PID 5200 wrote to memory of 3480	5200	SearchIndexer.exe	103
PID 5200 wrote to memory of 2568	5200	SearchIndexer.exe	104
PID 5200 wrote to memory of 2452	5200	SearchIndexer.exe	105
PID 5200 wrote to memory of 928	5200	SearchIndexer.exe	107
PID 5200 wrote to memory of 5368	5200	SearchIndexer.exe	108
PID 5200 wrote to memory of 4800	5200	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_7388ce8c746b53c85e70e457b1103c93_betabot_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2108

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5904

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4416

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6016

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1068

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2332

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4588

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3460

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2004
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3480
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2568
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e4dec8ec4308f94f2439b9a0d3ba517f0f61f8a4fbca88992548a19389ae5121
MD5 52fabb55de5f0583804c69848b02778e
SHA1 ca057e6e23f77da8bc6f3cd7226998f9d437b2b6
SHA512 f9087591b39e54a1871cf5a220cad44585cbb78180c1166fd106fa2b101cfb0952cffc3853b4d03f60d7b74fb0b0c21507a9ace0a833c3da63a90a359f1af389
SSDEEP 49152:Ib+632BuPkFKRrdE6ohvstBhuXjfS4LWxnzDmg27RnWGj:i3q6sjBID527BWG
TLSH
T13FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 43360f22a3bebe84fdc869d14ed5550c0855c3c13fae13b4e0d76c1951e0c43a
MD5 9250f7bd1b8c9c4b0c3d40be273d6f5e
SHA1 ff08225ae06e31ccaad67a81a6110f5d8f036695
SHA512 7a62c345c56cee52e8dd241fa2e9535ac459430dca514a38899fb3690eb49dd76b635f84e2515259057b755af00e172d527a738555adf47cb8b60399c9b817b4
SSDEEP 24576:qXYfDtczAAsqjnhMgeiCl7G0nehbGZpbD:xtcVDmg27RnWGj
TLSH
T16C65F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5e31b1100cfe570904a26566c241360b6f3e98f0a4bfacc98c35a1c20b933e3f
MD5 256630521ce4e948a708fb8fd1f060b4
SHA1 c9997edbe0b526ab6357a24b29a712d6024fd3d7
SHA512 bd0428c46f8ea3ba9a5fd45a6a3ba61e5b41e840558bd5087063fc0385c30d1407ce041d5d12f12928eb917928410b22aa6aeb2935a7f2820282b37b066d979c
SSDEEP 24576:l0Le5ji0hmxxrMHsqjnhMgeiCl7G0nehbGZpbD:lPji0AjKDmg27RnWGj
TLSH
T13D859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b61bd8c9f7044bb079de7f11c1dc8bda33a72755d4b4a0bce77c098052876b9a
MD5 2eef590291120c9d35d1458af1299025
SHA1 0da258295d6ee02e80c9e44091373c3074113677
SHA512 48977e53575ecb5115faeb89db05637fedc3385c669385b339208efdb67b778c36239ee91c4725c25946d9f717c5790bc1930b64d0b5a03a9eb1a3b26c0ba122
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWn6q8wyuxsqjnhMgeiCl7G0nehbGZpbD:C/ezSC6vUzPveHjyeDmg27RnWGj
TLSH
T177755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6f68d644d6ae8787eb9fe3e72e9eacf11055f7af2acfa8b57299411c6ec9b8b9
MD5 49da5613d0efe36b41ed2ca11322447c
SHA1 5c98f85fb829cf5773e3d63131cf9af002de6abe
SHA512 033479a41eb8f398f76284ab8035c14aca15d5bc78396012a87a76250bc12934f3a5cf05b83c6e642e6d25d5653f884f16ce5e02a779993c5eb074da60cd509f
SSDEEP 24576:8VbqPb88hv/l+YMsqjnhMgeiCl7G0nehbGZpbD:8VO88hXl+9Dmg27RnWGj
TLSH
T1DA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8c3e87dfc49a8d81ae37ed5e1d49f53c1256c1453864debc4367b99bfe650d38
MD5 a1bffcd791e7593c483a2086e523a300
SHA1 3977d682b45033fcf2781e9241f12042504bde71
SHA512 d6aed8712c8b00395f1a0b7ec26198985bad06a8de6fe9de6fd87ce1756fef40f0974f4aae1ec223cb2a544d9156a373a13b910a73c84dc2b0ae12d9c73b7729
SSDEEP 12288:7LDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7LDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B64523BF964C51CAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 7aebd8ab47da9c937bcb0e087ae554e14ed29b4a941540668aefb09e7b64996e
MD5 ecc34422882447a2cc334b6a083f2d74
SHA1 5aafe2d58a003b10aceb9a0f2d68699a5bf174aa
SHA512 9b84d2b556377232c9152e9a9389933bb64a96bd5bac691ba2a4a22f31d54202a4fce87f43c8cc7527917970311a2fa42917f871808e957a8287ac871a882901
SSDEEP 12288:yeBNUbTVO86UEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:yJIUEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B65CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b8bb2a0744246bf062c5e9f354a383528973a84e0b1d42c7f2be54ac55b14524
MD5 0f74fbf3e710f267b626c4aab28dd4e6
SHA1 88a36d83db69a18be29769d5c2f45d8b943c35c7
SHA512 2f58f6365d1226d0bc142179586cf4fce10afa4ecfe52b76f677e0f39b032413bcb5f0aaf78b85ed91e006fd928f8860b88998414af18c82e601879ec85175b6
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH7:9QvGAdlCEL8c/DRNw5C1D527BWG
TLSH
T1A2266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 30084d979a061a674e854d4577bcf82ef6b5e1e60ea70def690dc19956938094
MD5 a3e6dcca81b1072256d9f65c070d4e65
SHA1 cea8c3d4793c79c0e5988137f812849aca1c5f84
SHA512 3cbb06b8e00b5d0100df07517b238c4f44633cba323c826291717def1e747bb348c51a5f6f7a08f447474825552745652cb94cb85c62108db0c056783ac15e41
SSDEEP 12288:rAwSfxL/2Dc3RDLLmt0LDQewsAj2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:U0ewsAj2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10675E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 06b87515d1d862bd30188d4550aaf4bdffb596687188d9cc6c637f77dc22a264
MD5 025654ad9775a5d08d10d339976a0957
SHA1 1d7d2d70bfa96c571214a5b916b6ae992e5c2b2c
SHA512 f3bd4051cf26e5c06acded5763dbeb22bf931b14c67b14f12e451759b3216c8ef01e9724a51e8860d1fd7702592e47571d419127732725bc41415fbdd340ce83
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHyVQBWG:pUEtQevvqc2W1cpV2tI32lB
TLSH
T1FC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1cf66b78983ef78d8f41c5ddc1678bf444bd95fcef5460945a78b9421b162283
MD5 ba6e28f7447bd355e25a2bd326c9791a
SHA1 db228ed6501539ea636ee2090f84cb16572ecfc3
SHA512 72f1e6bbdfef9b989963ee14512f4a3cc38684542d06a06b8543488045625028baa225329cb25caf0adedd14a889d8a679e8109da663178b614822ce4102c538
SSDEEP 49152:7CbRquA/m2yL5zTfFiV+XenmE3/zaDmg27RnWGj:koquVjnmJD527BWG
TLSH
T1F4D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2056b69c99bfcbb629802e387bb44d533144cc30ce33c8c744e90e045a538c15
MD5 b44814bf40000773ea25efd758baf2d9
SHA1 d48c3d438adc63647984ba46b4a821e6a16f738e
SHA512 8ef141dd35f84bbc4261d941107226df9688bd4ae43f8437b13a85ac098507beb61a0f637f5b38d0d1fbab2469a466c77ef59991dbfa754a422994808293c067
SSDEEP 24576:4AhGL3IFoiwtA5l7S531sqjnhMgeiCl7G0nehbGZpbD:4AMUFoiq55Dmg27RnWGj
TLSH
T161359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 658f9460359214fd519b4489589510f07a6e5a75ad47e32a221231dae6e13f3c
MD5 bf584b2d59c591248144cc9123fb731b
SHA1 8cea4f87801e3436cb055c87f3b9a95b6d2bd275
SHA512 b6c1f7f8c87c08d2428d91f3b1797f516c9913c3493596108d6785f498494369d0c60a3de2882da3f51bf38e6fef614c477e905c78ceb2ad8b48952c889ccbfc
SSDEEP 12288:Lmw5HEjsChNVBFgl0WDm+CRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Kwu4OWqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ff6ce8cbe03253fcedc41919061b32c9c152fbb0e98f08cbccee8698852bfa54
MD5 7954aa594e3ed209d06e68730020f70a
SHA1 6f8fe3d698bee7f0e2cea641d5bedc08505ac01e
SHA512 ca0ff35a83a798e314ee1234bd7a1785f34dadf20bb8b41190335f1723576401c4478ea84ee48af2ad0b4bfb087212532fdf7b6e3d0404b3b6654d99d6858c3e
SSDEEP 12288:GeZ1IymXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bZu/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC5512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ce70d2b5b759cb400b8845f78c4333442fdf03d10d24c930b52a872e58555054
MD5 2caeb934f81f23544b502c635a525463
SHA1 19082323b98805bf775524422e9450836dbbb650
SHA512 0032bf1efe70ec927c9ccac0725c0f7907eb68bb2f91ad4aefa306f6a6e84900bab3bcb478321cacc8cbc0f3d479e7255a7cbeb4876f805dda957a044c43a15b
SSDEEP 98304:kQRQyi36YOcPbLvw2gAf+PN3ED527BWG:rQyiKa/X+PNUVQBWG
TLSH
T118667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 53ac1fcad32a038e44e9208a477a1d208e18f3583bdda00db707a3c1a9709bfc
MD5 15dbe9d06ae9bcdd113165f92b2126f9
SHA1 42c9d08bdbe55d4923776c114a9882034c1ea7f7
SHA512 7d66b9bb42b8b658997d31361f645849ce88330653c8d05bbb15715dda6f0c7e6dc3d4d854ef366a8b03c383a901b3821daadfc6abdc763ea8ad800a80ba127f
SSDEEP 98304:hQRQyi36YOcPbLvw2gAf+PN3ED527BWG:4QyiKa/X+PNUVQBWG
TLSH
T1AA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f79178d7e541e26987546d95ce8a581ca800c2a9fac7e634c03f49a0bd13f55e
MD5 f45d091e06e3d99faea27786910b50ac
SHA1 8b55f4d3aff24e2920147bfaf111a0d14886649a
SHA512 3c520419309f84a550ff58feab574a796bfda12e87a77eda4b34e021bda962890e2721fd947f46fda429cb117f2db90754d10f4363c7aa648d7141610683f1df
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0PsqjnhMgeiCl7Ge:s68Qg55nhceWu7PNU3/KDmg27RnWGj
TLSH
T1A7B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 925fa2f09b90915a269d787d06811dbed9a108df9890fb2a3de0996e335e31c1
MD5 e869b91bd781edbec0f463b4566a096a
SHA1 3f7c113593504e659f471d4a79f1a06846814b05
SHA512 6fabeee2c921a7f351937cefa43eca039fe9af4220dd8785d93405b0dfc5a5bd79e5ff36250ae0cb937bf648af1680b3a640863c13462085b6a76d119107c1e7
SSDEEP 98304:Cy5112gYy5azzVvt69nLKnhZHD527BWG:LLIHEWhhVQBWG
TLSH
T1E6167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 737582f6547fc09830c4121ae75aaee99cadb487ae268ba3aa710b0e09c1b231
MD5 e8f0da56d0882e6037fd09495a618e8a
SHA1 411c69213820398d9833d9c616870126fde68bfa
SHA512 be9ba5b26c75a82df7291e35a0cd16382459e1ecaeacfa8d822569c58d55cfdd1503c5bd6d2ed2f215b7e8b2fc2e171891a7534bc97f75ea98a0fbec77cb3786
SSDEEP 49152:WB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glMDmg27RnWGj:ku6Jmdxd2dMD527BWG
TLSH
T19BD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7fb2f990669b652581fbce7a4f361b1a91edb52a9fec97a9cedba0d4e2ec4e1b
MD5 2b41edd2b6546305a86e48fa6154e272
SHA1 02fe8e2b9692af74a23f65804f9bcc7d80af42c3
SHA512 01954773171ab6fc28c198e45f9e46b8f81d76ee6cd32ff171c571e83e175383b5cbb1f46a76a44cfbab74eacc13202d09be24dc915d5a1b71d212ed22b8f414
SSDEEP 49152:L1hpsNoJpF1A63U44CwH7R4xADmg27RnWGj:LmifPWRJD527BWG
TLSH
T13FB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bcf91614f8324a93219554a51a53cc56d8bffac0253c1e8e515b5a69683dcc49
MD5 f568dcc4ea5032de0e37cb3fb1bb27f9
SHA1 56f0fe6f041f52a10b7ee413f9a883216aeee69e
SHA512 299786e6012df2ca31c493b5cf4ef82d69cc2e74b0c662610ad39cdd4c181aea5e16b7bec2bfd211586f13ee1483db689a8ee55265e08e2211f588aebe26ec93
SSDEEP 49152:tSuZQIY0Be2KcRVtOnks6NMHqjDmg27RnWGj:j5dKii61jD527BWG
TLSH
T123C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 96433dca8d08c5d2fac5a3f671ec320882fed33529b7ef6c58a3ad6b75216238
MD5 6571fb4ada8bdb6d38315aac49c9b68f
SHA1 82d1e9a7dcddb5c0bd09e56cdb1e7a45cc185610
SHA512 efb471d66e17fdab443c7c357490b1942c6f202f08d66fc55b135c1ecbee41510f6190bef14aa15ee0ea3f3074a9dc52191ac11170632e187cdae74cfc1c6c86
SSDEEP 49152:PhtSn8EApI0fig3giDn0AP5w8Dmg27RnWGj:eX2imphtD527BWG
TLSH
T12495BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 70f6239cd35b9aa88f2a470cc1d837736fb82593185e8307ca5ae85baf9028cf
MD5 7ff7040a8bf427563bb52077987b4817
SHA1 6cbe8573a6ed9e10d37f773d0b1b42d802ce8df8
SHA512 e7951a813a4c092d6fdc91a460889df658c4658b8b387749bbd436628750810473fa5a10588440722441c6b1e1df18295ddb805dc5317f54a5a1601496b8a1e5
SSDEEP 12288:s7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:s7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1964523BE965C41CAE52648B5C3E5F10DAC073E5BE92004937A577CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 79cf05d373e6fd902050a96b4a7881231410be49a3e08a0db658a20fb89c8116
MD5 6f8cca0a09c9ca8522dfa5ebf873ffe6
SHA1 a726eea34185566871c866b5c9c0a7686d980311
SHA512 74d82f6500b261dc7523a8c3afa06088d5ba85618ba745ac7dbef447ea37b36908e3bd622e645cb74a92199fcd49b4a37bca5aab429573772caf7365e1b3dba1
SSDEEP 12288:0SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0SsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C24523BE965C41CBE62648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 113529ec69777f8d236309d4a7004f8cf1c86dc5f2b305f1dda5958376276304
MD5 ac7c4edfefeb421e254d2cb017045f3d
SHA1 6eed36df75ffc7ab719afe912c902ba8807bde83
SHA512 ab0ebbc88f55fea27d27679a936d0e437142f9419327a8aeb009934c689b45782a9c2f590ae9e18453ec84d043ffa34c85473ba22198ba7d1a00227cae3f66b6
SSDEEP 12288:icXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:icsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F64523BE965C41CBE52648B5C3E5F10DAC073E5BE9200483BA977CBDFAB24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 249a431fa9d8927b2aca9fa9db6ec279f85c396cb6fbe7364ebf7d77fe705643
MD5 1873ae986da767298b42d9ea4571f6cf
SHA1 688ad4aa4a4003cad547c777b6e2fe76d4721c4f
SHA512 75a9502891bdc1c97aa5d3854d8f75b984f83ef5c2453b8014dba2474349f31d8408d6d894b07f803f04c36d31bdabf47230e1320fbd572b274c27f1cd7595fa
SSDEEP 12288:7VVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11745236B675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 39291a276adc8d87e634fc8dcd068b0694fb34c3554d61b7ee3e958dea9e0a9d
MD5 d95e40f199692b5d6e4628f592c36f2b
SHA1 e07231f611b154a8da3f37f119a1a72e63dc00e2
SHA512 4288af65656771087ab062a1853e54452bd3ec04bf5eb743e358eaa37abe5d741b7f9b179d8dc69120bfa16a1ef3519eb3f62f7b7198a19dac141f1631c7b0a1
SSDEEP 12288:+dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+dsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13E4523BE965C41CBE52648B5C3E5F14EAC073E5BE92004837A977CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a466fc032a86c4f06bd1964fd9bef335688e92798fd9737cb0512848bd3aa57d
MD5 e93eb68e03b386a5ce51696fd1ca4fce
SHA1 75ca76db582474f2fcb2f4b96a4f80a74541efd7
SHA512 368009ee6bbde5d7735fb25bc3f879b77bbad5df14c05f07d75d6d9f8f9f6b85575677c376ff9ba6e8e769ef6f59f1fc241b13637407ab74a4e9d4fb6f630114
SSDEEP 12288:sOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB4523BE965C41CBE62648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 abc6f4448fb3230c0a7f74cab5b4883ec4f988061a1f0125f4e6e46b26be5800
MD5 34d97f5fa1249063ba003f6e6e9d92bc
SHA1 93b7ce90c7f4d66496ab5bb0bb8ec67a49697f8d
SHA512 f73b36d9a96e5c67906d2f65b040aa3b34286da73ffd6fab17420123af56c1dece76ac2f0f96904d05306c7cf99944dfbae9fcf67f3900c5f567f270e88acb03
SSDEEP 12288:F6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:F6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1464523BE965C41CAE62648B5C3E5F11DAC073E5BE92004837A57BCBDFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8f6cc9952b2119451c2e80859667466516eb571e0c2791c8eba9740f3c7ef0eb
MD5 7d8f1af84ce16fb5552c22e737f5be7e
SHA1 e3f77e54fe542b8993615256c24006f60edbdebc
SHA512 b604bc8d8fc46f8f8e53a65fbfc40a43b4f04a8daa5ff5b712d24537086569147a84e399f0a463acfe36d7904ec3d238da518dbdce40bd00a8184b082391beb2
SSDEEP 24576:iZMRzFVSOysqjnhMgeiCl7G0nehbGZpbD:iZMRzfSDmg27RnWGj
TLSH
T1AA6501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 974b9c1cac51a54c6d62888eb94de6983617dba0f203992cb86a659ffd65730a
MD5 d5913e9d397ff5258d89c3b464444b0f
SHA1 1ee8c028840c34d7c41cbb3558f342c53427909d
SHA512 1ceab94cdc021ca5faf28fcb3f5cc1611df55ac65326b133a0e38d585eaeb2571c84200745fff931a0f96ce434f4c00f3f31b8c5103d7249538539c3fad5b8ac
SSDEEP 12288:PvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC4523BF965C41CAE62608B5C3E5F10DAC073E5BE9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a19eec3c509bb18b80453d9505935255243b6c343b54c8dd2f8513f81563c6f3
MD5 f4e09ede0d56906173dcff37c30c7059
SHA1 27ceff19ee243cf26c6c790611388c8b1129eeaf
SHA512 7153324bcd4232c968ca65bbfea650710371f100afe0e4ecb354db8e7bf094888b95580350b74c7da9e15597b769fac24128bcee0c460928ec298e940f91aefe
SSDEEP 12288:VzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A4523BFA65C41CAEA2648B5C3E5F10DAC073E5BE92004837A577CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c6485d839c92eac536adc2986debbd834f57433cbffa6e992eb16af05f2587eb
MD5 0da4930c81498e145b3b8c5e17a21584
SHA1 71dfee9d4472e39450acca7e0eaf2b61acfc6b92
SHA512 b5b6b743b5d64d5701da8beb4d1389512dcd6eede3e12a2aed170d67e5c5b29ee3872021b28aa1eb36cc94f28b2eb110eb407c0b1fea4c02b430f28b6b562ea0
SSDEEP 12288:1yPz5L8mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:czymsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10155125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a97fa8b5002528a4ec0af12e792c1379ae2de772c50796baecf9845d6ae0aa8b
MD5 88dbd71c5efd0ca04955472639ed63ab
SHA1 a353657495d73ebbcd15b7cd9eafbb19823aab34
SHA512 a18e8924dad41187ea38eb80808c8e668ce58f22a2813fb283360c3d870fe009e967ee5a37bf91a1ba30d319a286fb3521f14f64c904325c3e54c475f5e902de
SSDEEP 12288:UvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1864523BF965C51CAE62608B5C3E5F14DAC073E5BE9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b70e789528435a6f5b0d418c653d98c6f0219df01872806ceffa0e3dc3dac11b
MD5 bb4213d04eb94fbdc0707daec29b9374
SHA1 7b69b3830aa415355d9b82829d04e4ad013de449
SHA512 eaf01890c135f6cc9d1541b50336e5cbbf66fed24da8f0977f76775c9ef043291eb1b1f131a5ebeab8d9ae80a7ff4e73772267ee293f93ee8e35744443f9c836
SSDEEP 12288:AvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1074523BFA65C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 98659063e650fed9aa63304d2672a647a2ead39b61abead16b039ee2ad102f27
MD5 d01b1b23f55e22d85dea1c5b811996a8
SHA1 73314adeb08a4c038d3f9c7654f1493c62185a49
SHA512 f502290bee0a94b89e4ae35387e040a36f7636b1e3963d1e13f535644a9fcf6e4b47d6e3fb348233ac266420bb99a117415b6532081acc9663812f4ab4902dfd
SSDEEP 12288:VyPz5L8mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8zymsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19455125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 99a5394479be84ee1d325f6227cd87e4f27f94015466494f4751c0dbfe00ae83
MD5 15abd1470ac69f10b9444704b2e282e3
SHA1 b4b06e8b31320c1b3e29f320b5403ae4843de935
SHA512 b2a4773ae893bed1b96422c2836d12e7798dc5c7a6336a52523ff06964f03b58cd50d35a631c1a601565e1ce0d0ae05ab95d474738cea240d9650a91922c8fd2
SSDEEP 24576:2TDaLl3z0zDssqjnhMgeiCl7G0nehbGZpbD:2TuLljFDmg27RnWGj
TLSH
T15F6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 6bb0e88098c81201c3be724564334641b1d3c8003b12847503f073685215f1ae
MD5 f7cdb86e123d93dfe49769624589e08b
SHA1 7fbc8f12799ca63b7e45458fa3c5774fe66a4c79
SHA512 921f2cbbf8d3ef0019f0e8ca45ff2b9916312a7e5ddaf53396db2d18c7062d0c579f6044bbccb5937358392094df7f5b87058c43683f327dea4873ab31a170a9
SSDEEP 24576:c3vd9CHKy7GZ4sqjnhMgeiCl7G0nehbGZpbD:Gvd9CHKyaSDmg27RnWGj
TLSH
T1FF75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e0df0c675ddf2c0ec91f67b305755a58058ffd2fdc60624cdc6283aced298d17
MD5 2ffd02557d2ba9c2999ae32851ec1ffc
SHA1 7a9816afdd0cd91a9b99c11269f62e8b1f26de03
SHA512 e1b9e64c6867d8e72cc34638a50a669e678cc4982e4bf9e2c8913344ee5b1519971d724ecda70a2ef3d6e2c263b23ebb33d4df22cb6096bc920bb0abc0affeb2
SSDEEP 12288:E8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:E8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B74523BE965C41CAE52648B5C3E5F10DAC073E5BE9200493BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 bf18144686640676acfb217d9d14e791f7e519a8ebdc9bac806c0c98d94fc096
MD5 99bd1dc91bc0d09d441ed94946f26279
SHA1 be09a819f3684341f1716e95a8217149af44d8bc
SHA512 c6e42c45393b2c50a1d42c72be7e99d4e2c0fb01acba5bc74701b1d77418c1db41513df89b49ba221ab75c7f339c5c7533cf7048354e2b5387dbbcb9085658f8
SSDEEP 12288:jGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE4523BE965C41DBE52644B5C3E9E10DAC073E5BE92004837A977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c0a75b29937ea2ba0e3c96c73b159ffe4abc31edd7f71f4f5b8aeea4cee690d8
MD5 83154b017d2c30b7a180eeefb66959ee
SHA1 002a494b670c42c7b70915827895192847269280
SHA512 fa179fc8ef558da763c1b33b314a3ffc06ccef284e267e03883ab1afb071aba137001d604a059f31e4ba88ced0f4a3218a4d531fc775dbd27addbff78879ed49
SSDEEP 12288:wZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1154523BF955C41CAE62648B5C3E5F11DAC073E5BE9200483BA977CBDFAB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 5972f1f24e60b0b87d98dfa24da8a8a03c224a4ad0b3ed78eab420d92e7de616
MD5 44a56e1a8304be091bacfd4bcb5f4dcc
SHA1 f977fc53990887676da940a96c9d1c5b1edff21a
SHA512 2ec54c24d041630249d090a2d5bc24695e3a70bec02a1340766efaa240bac61b0531b624187db17e639d84225f7f174f22398c1f00a6832b2822ec9331beada2
SSDEEP 12288:4vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4vsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D4523BF965C41CAE62648B5C3E5F10DAC073E5BE9200483BA977CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 72b8dae6ae9d78643ee698cf01f04143b0f091fca68a37f6a0bdf8cb59fb9691
MD5 9d5fe9ecb6b4ae6372faaa65502c61a6
SHA1 e206cd156c02df996152783bbaec659192daa379
SHA512 cbd7ba180e314b8898e0dc4ea50c375af3e31ea59a026dafe0ef45c615215d910c2ef5f3c93e0d99620f7bea715dc31509a5b6f4a0edf7fd964ec08181172a87
SSDEEP 12288:t8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:t8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F94523BE965C41CBE52648B5C3E5F10EAC073E5BE9200483BA977CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e23a40b9eddbcd930762080c3e8a6b334d84b74646ae70636a50277d5d7d35fb
MD5 9c089dfe6abb99a75820562a778856e0
SHA1 06fbdfa38b2f96bca4c653d30efdb06ec9c99488
SHA512 1a2855e81fd45c053bcf43e92c3d1219cb9d34c3f11ea36296c8a636813f973e30f8259e42c05a2986a172d4e6675a86d0091e7cd1b8614856dc7a64377c8f63
SSDEEP 12288:KXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1274523BE965C41CAE52648B5C3E5F11DAC073E5BE9200483BA577CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 426bd5df924a2cac59c22c86cb2713400b9c90751b626f6393dd95ddacac32f0
MD5 90d2d5bbd06ae9326718582fbd751ef8
SHA1 2cff5e3ee2c738a7e850ce6fde59788aa8eb4338
SHA512 72681ebd68330348d26b69f576432039513cc7207dd26d9a7289b30b126d6a3080346eb33c47c8cb4320b76baaa056090d457eb916c80f2531b21e21726b504c
SSDEEP 12288:XdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1204523BE965C41CBE52648B5C3E5F11DAC073E5BE92004837A977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 96fb839e5930b66f76b07948e128153b92a67e1ebbb1695be2a38259f28c2ffc
MD5 04451c24e0c1cc21f1ccb6f65723c291
SHA1 f4684e2996760a6b855c1bd0899c40c0063cdb1f
SHA512 d6ce870c5edad7652c47ff2ebbbac1323efe9d865e3f31d29ce185d5983309030abb1a424cf7e559603d3bae33f32176a57dbb67db03e6852d6d674465ac209f
SSDEEP 24576:nfwvUk9RX6wkyAIjsqjnhMgeiCl7G0nehbGZpbD:1MnYInDmg27RnWGj
TLSH
T1EF85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1a35e2c70632b1a213d5e7365f0ba95e95ec3400d4fb8d148bea6996dcea1ce3
MD5 d89f5bddabc708f874287a32e43e7d4d
SHA1 568df784028222fb22210e2e7ae6e079b3b3126c
SHA512 f9d8b39b1301ebc9cfb7ada0c4de25e093766c4612c7d245482ff5a5a852af2e2962c4eea86b160d203ac75ab571a9a5308cbc3fd6a7c52c551f72e06d542ee9
SSDEEP 49152:bYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cDmg27RnWGj:+ySzPkD527BWG
TLSH
T137066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 01448458ea87153ba7401f3b5e5a029be37909a4c97c577da2df1e4268348cc8
MD5 1bcb5b2e4fb79b3c295b034039f888d9
SHA1 2e2d2a37567343216bc50360fd82521869d1364d
SHA512 97d1554bee28e5d42907db1112e9fb7414914e1edb689f1526f6552314ae436e3ac41ce3b4a2e0671fafffad7c58ef20e4b4c2ef169a3cfd2281bce34397c34a
SSDEEP 24576:V47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYisqjnhMgeiCl7G0nehbGZpbD:V47JUQjTirIhCnDHUPfF/MDmg27RnWGj
TLSH
T19265AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 460a7d2aaa1c1fe109919b8e3e636604767eabf5e4d2bfbd9f25a11b1c28cc9c
MD5 5a8688f8f997733aa4f19b584f893435
SHA1 552d190990398f81b3e4ea4f0affcc903c6af65b
SHA512 3ff20300608ebe887b91fc80a1cc754cdc7ef7b96209fedc7630cb370a5a0f6e43ceff2293551526964a98ea552c39b0ec69cf9d7fd1e9a3db48580aaa89b3ae
SSDEEP 12288:obsf/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:P/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15355015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5c09845a3c5dd6200a997df58322ba3a9c48dafbfb06a3aa2cf3c4361662009d
MD5 2aead7d14706626a4305069e706a5ed0
SHA1 7eb74b53851b0c5c9ce7c4c21843cf6cd02e24fd
SHA512 52e5afe5e2e9a52ebfe53cf65eb65264d7e03c4cdbb2a4f068174a6e212ea6ae84ae309338c5c0b6b832d86ba4ecaf51177d06792fda2a662dcefc1758864110
SSDEEP 12288:vBsfCU3fXHRQ+tD5TupRmIVJpjRkQyrImcRMOBl2c7sT1EjQvF:vBsKUPXHR9TMpjzy0mcRMOLp761ag
TLSH
T16D3518107666DB4FC6A940322E36D2CCAB707D41EE446F0373C9873F9576659BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 29208f4241637b38fbd54a107095d00b4c4bbbf6f84d5373fa788e445d7c6cb6
MD5 e7088206ef5fca351bf5867e8c4685f2
SHA1 1ae90bc7278bfa8abbe16213692608762348d283
SHA512 bb060a0c0fbee7fb38e68031f1affea9a30a759220469777bf2d4d2c46c574c3f07b065f9a1d9800765645b42c1ce869d9022934136b641405256e7d6c2ec611
SSDEEP 12288:ykxjut0StRaOtLFF9bK+4hnbe4ssGlvbEnO5RqzHrqeerFHAR:ykxab8498rQraR
TLSH
T15265EA809536E78FC1F76031072A5B8C7BA4EC0B77496F66B3C9453AD82A711A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0b4b59e871469d6e41f78c05961549bb4f7d944e1e057c067e8d85e240b936a9
MD5 e614cc07452794b7b398cc7078a036b7
SHA1 144acfb9b7539e7d6364999655894fa8ae6629b5
SHA512 d42b14608a482cb6fc4186e9fa331f8430f33dd09ccf0eab8dbdd7778c303ce2637ef852e7b654b44c04d139a9d9eb8fb0cf52700cafcf51db2531b2025b6f3b
SSDEEP 12288:607nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7nsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18B45237B934C518AF93609B482EAE12D681B7E669F1044C3B94778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4f75fc1a6705136391de8f7a78b8b5a7f2e4be27ab4e1f6530abc392bc1da44c
MD5 8ea7fa0abfee7dc888b717c6c441db31
SHA1 8df644d180f9f199c23e69d5e3850bfcd00a09bb
SHA512 1bb583ee31206f2153f4d61ac79add544f5c94a656b20f6fd7866ad508e267ea34a954d86ca9a484dd3745e9591d2d0311c358d6bf01791c6836cb115e6ade53
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYxsqjnhMgeiCl7G0nehbGZpbD:Hgb4mBIBhGFmDmg27RnWGj
TLSH
T1D1659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 5f8853e5a68825529a732ac32ed321b42fa1085338ab0aa27afe0978eea359f4
MD5 8f27d1e3d42396ba77355366f6f6f783
SHA1 b307f61bec73c3d70d7078ee32c563acfeed7538
SHA512 48aba39b297549c25039bacc474dcabef204cb1f2639ac57a72ec28d231b14f35f2db598e49fdca72b03e829dadee1f305740e3df6a6a15cb35f7fa684326a60
SSDEEP 24576:iG88u8FpJqH1bzria7/mysqjnhMgeiCl7G0nehbGZpbD:57ZFPqVea7/9Dmg27RnWGj
TLSH
T12585016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 04acc5e8bb0a6ba66f69747845856578267a98ae1ebabf4b8bba5a77c9b2570e
MD5 bd33de6d15eb903d68f775d694e7e1e9
SHA1 55c6febcefa036aa7da8e3d4cc155718d006a94e
SHA512 74d772cb0da17152c3edb2e7d3bd7eb15d848b6726fcfdbc36228278a67f86cca6555fd2abe1a3c911507a75c7406b4b8b5d0a82af8535ea274a274e09adf4e2
SSDEEP 12288:5HvUrBFrEjwaQ+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:5PUr+NQ+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC65F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c4071c4f1e4d55cf3f4b69eb83ae1452c85596692858945b1cf63400ea9c9931
MD5 bc8688e39931e0945762c848d684c665
SHA1 f36d22f267a6ee2ee50f641523b033c9f3af8356
SHA512 fe3f87faf325d40794ebb7746acf5ddbf0adec2e2d3a17a62bc5f42dde454a2050614a1ce7b959910892d3f2e234678db6da2665d9929e47edae80479106de54
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjiDmg27RnWGj:PG05lO43bfD527BWG
TLSH
T14CD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d86479698ea92afd99858518c76a1a8b1f51afb166de9c2997fc4edf5d102b35
MD5 e2917c7132d6b9ad7915985effa01b41
SHA1 e59f40b4553597e14d39c3e60c7f8edbb92d11be
SHA512 f6c506fbb865e26a429476d803027aa1d820fba1b58fef1159315e5d352750e25cbcf7ed9efc69dd7e28d55bd60e4f27f9ddac69dbd545cad9ca69cb37a26eb9
SSDEEP 24576:ffa5POZ3dpuWVM50JicR2hG0lasx2+47eidngsqjnhMgeiCl7G0nehbGZpbD:na5POZ3BJt2pasx2+mKDmg27RnWGj
TLSH
T1ED65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c58ec5726f82b5e070f32e5626c91ee50ab020ad013537c8725e75f112f75f80
MD5 9e17aeef467acd3a9f02042bcf95e150
SHA1 3efc68b3946558dfccb9887d95155c94e05f6db9
SHA512 9c6e60923c25f730461528abc5fabfe3539d867485f80975e83530b6e4894e302bea2322b94d57db979c8f83c833623fa94fdb6cfb6d65be6c2d9b79664b5c69
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkKsqjnhMgeiCl7G0nehbGZpbD:4Nc/zEOVHFdDmg27RnWGj
TLSH
T10E857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c30764e74aa473886a973884dfb6077e0cdc67219e1ecca303eeb6f60ca7e8fd
MD5 0487045c198695dd57db350b324bf5be
SHA1 f84e1469838d8e0ba655daf601aa7b61ef1e5576
SHA512 34d8a8f95fea970e8fcfb94c2e993a87623aba7ce55e816dd8f07329801eac7390c53ea12cd3451baf0c135e022bb1ed3a9e61b42b5899f8f7ed7de8eb4e265f
SSDEEP 24576:JTkNvNnaFeYhJNtmZBm0sqjnhMgeiCl7G0nehbGZpbD:JTMwBtOmQDmg27RnWGj
TLSH
T11055AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 4d8511d718db336cbc76ac0f21032635810aa9cb05817ad5812ef8215357454e
MD5 84c922088d95e98ecea6fc317f38b4f5
SHA1 3222b620140586fe82125357e9e339e2d3b36166
SHA512 a2d5e0eee713ecee6a80e4b796311898dadf3b9c456b9ff858aa0687b57cd9cc0192ed79d3a32f5447c2655f5cb9ea066ab87b2e47ba531f982f95a94b563a0b
SSDEEP 24576:uD3FHshBIYQgAbsqjnhMgeiCl7G0nehbGZpbD:uDVHeBIAAPDmg27RnWGj
TLSH
T15B75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-86-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1068-299-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1612-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1612-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1612-13-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1612-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1612-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2108-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2108-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2108-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2108-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2332-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2332-113-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2332-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2332-317-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2332-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2332-106-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3176-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3176-93-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3176-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3176-331-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3176-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3176-99-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3460-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3460-138-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3460-143-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3460-132-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3460-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4416-60-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4416-249-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4416-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4416-52-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4588-316-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4588-117-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4588-119-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4588-126-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5200-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5200-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5200-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5200-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5432-6-0x00000000027F0000-0x0000000002857000-memory.dmp

Download

memory/5432-91-0x0000000000400000-0x00000000005FC000-memory.dmp

Download

memory/5432-7-0x00000000027F0000-0x0000000002857000-memory.dmp

Download

memory/5432-0-0x0000000000400000-0x00000000005FC000-memory.dmp

Download

memory/5432-1-0x00000000027F0000-0x0000000002857000-memory.dmp

Download

memory/5904-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5904-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5904-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5904-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5904-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6016-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6016-73-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6016-81-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/6016-282-0x0000000140000000-0x000000014020A000-memory.dmp

Download