07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/05/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Size 4.3MB
Sample260501-mgcefaev3v
SHA256 07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2
MD5 43bc93f614aa770c4f7b9017361aae00
SHA1 259c75df0ac5108c9fd69adbcb54a8252831bd8a
SHA512 a16befa39973e944ce28615a9730640dca613744131c47d7c9486b9409cf333e4b59d88a19fda777be69bf5a444dc1e3cfa3131a411b1bb059163f138e871a64
SSDEEP 98304:57OXu+3kFW64CgkfClnwh9hNhroFk1GXKvgLm:+EgMC1wjPpvUa4L
TLSH
T1C626C012FB8180B6D8430271966767FA0E3BB910533AE5F3DB941D3ADE212D16A3F395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4768	alg.exe
5088	DiagnosticsHub.StandardCollector.Service.exe
5180	fxssvc.exe
3496	elevation_service.exe
5632	elevation_service.exe
5368	maintenanceservice.exe
4492	msdtc.exe
632	OSE.EXE
544	PerceptionSimulationService.exe
5192	perfhost.exe
6084	locator.exe
4088	SensorDataService.exe
2436	snmptrap.exe
3696	spectrum.exe
5344	ssh-agent.exe
2944	TieringEngineService.exe
5648	AgentService.exe
2276	vds.exe
5952	vssvc.exe
1104	wbengine.exe
2196	WmiApSrv.exe
3336	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\48c0b7b6b9e5d6ca.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\wbengine.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\vssvc.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\msiexec.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\AgentService.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\System32\vds.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\System32\msdtc.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ba663e954d9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000669c3cea54d9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099926fe954d9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e84ca7e854d9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ba663e954d9dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fa3a1e954d9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b74542e954d9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9a482e954d9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aea0dfe954d9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
5088	DiagnosticsHub.StandardCollector.Service.exe
5088	DiagnosticsHub.StandardCollector.Service.exe
5088	DiagnosticsHub.StandardCollector.Service.exe
5088	DiagnosticsHub.StandardCollector.Service.exe
5088	DiagnosticsHub.StandardCollector.Service.exe
5088	DiagnosticsHub.StandardCollector.Service.exe
5088	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Token: SeAuditPrivilege	5180	fxssvc.exe
Token: SeRestorePrivilege	2944	TieringEngineService.exe
Token: SeManageVolumePrivilege	2944	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5648	AgentService.exe
Token: SeBackupPrivilege	5952	vssvc.exe
Token: SeRestorePrivilege	5952	vssvc.exe
Token: SeAuditPrivilege	5952	vssvc.exe
Token: SeBackupPrivilege	1104	wbengine.exe
Token: SeRestorePrivilege	1104	wbengine.exe
Token: SeSecurityPrivilege	1104	wbengine.exe
Token: 33	3336	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3336	SearchIndexer.exe
Token: SeDebugPrivilege	4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Token: SeDebugPrivilege	4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Token: SeDebugPrivilege	4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Token: SeDebugPrivilege	4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Token: SeDebugPrivilege	4936	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Token: SeDebugPrivilege	5088	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4412	3336	SearchIndexer.exe	111
PID 3336 wrote to memory of 4720	3336	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
"C:\Users\Admin\AppData\Local\Temp\07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4768

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2508

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5632

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5368

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4492

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:632

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5192

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6084

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4088

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2436

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3696

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5344

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4496

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5648

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2276

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5952

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2196

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4412
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c1fb33dc3ca3752b79dbef6922a8106c261e55ae4660315dabb9ef98eb697fbd
MD5 cb7cdd7585dbedb967c05f5d993129f7
SHA1 227bf5b0d2e9f28f7686e106b292e6e7059343e3
SHA512 f6893ff7bae17a9d39b9f26eefd10c7a50444a1f4bc4ab9f8623ce31f21fa7dbdc73f6ac741dfe1ef8762ccc020a9229d5a5c4ce838b611b937665e3245e7977
SSDEEP 49152:Ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxncQ/lFTjN4:Q3q6HjBoLm
TLSH
T1D4D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 bda6db933c342e9216b9422382a16f994d18c93fbca3e915a34fd735d69fc64d
MD5 5c255b1294e4205e4cab9181d772b29d
SHA1 5b554b38c3e04e1596ef9a2b0c111685176ce9fa
SHA512 70ce9aef897bdd7edb792d82713d760744145cae0d8f47b99e09f80eb869f1b2b9c1532d1fd7ca30b6ab2dbbc1a1ee04b03d6049596690e7bf2f4ccbdf50ac39
SSDEEP 12288:D1XLsswWkxy2lRq2czAPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:ZXYfDtczAvnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1BF85F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 c5ac773f7dadf7eb777ad1539bc3af52cbedcc2f75181c2cd75a67c5dc9c444b
MD5 b088e7979953f473ae84736475973fc8
SHA1 23fdf2cc1e05c8e806920f8bb1c36ac709bee192
SHA512 c6247dbdd8d4e302be1a64140d52c4b58c3d062db55b6876c9370fca07b2ef2cdbcdeab8c34a13499ec436fbaadb65c5433e83aa995ba0410aabeaf568f31906
SSDEEP 24576:90Le5ji0hmxirMknQ/tbw/2Mkjy6Fr7g0oU:9Pji0AcNQ/lFTjN4
TLSH
T19B959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c668cb77a73c53546f7fe6bcc6f8087d13c0cb7a504ff5683a4f102ad1c1f650
MD5 575a724e683b8cfd8c2acea082eab1e6
SHA1 addf189fe7e700308fa0ff449650f6343237dd05
SHA512 a0ebc9537273c63c277ff0fcd8baaa02141c54b832f5dea155659be347141d426a4580d59502d8516ff055a64cd7e99e24de290b686f6291fdce69bc47c672dc
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWE6q8wyuWnQ/tbw/2Mkjy6Fr7g0oR:2/ezSC6vUzPvxHjyZQ/lFTjN4
TLSH
T14B755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 094b266c107fc144c9750f2ad303672b7e6a69871347f3f5edfdfd26483e9ff7
MD5 796b03c29221439f29bae97adb8d8b9d
SHA1 e7a64801eca66505ad928948b5100150003d89e0
SHA512 3a4bb4cb00470200f7a66fc2d8122ec230163cbb5c68f314acba35e6d578acb6bc535e147d76a5479acd3dd212d4eaf955038840bd5d23294befbf3b4a6466bb
SSDEEP 24576:VVbqPb88hv/l+6TnQ/tbw/2Mkjy6Fr7g0oA:VVO88hXl+gQ/lFTjN4
TLSH
T177559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 1db13512f458156aefbe73f7766f53f5d85b20c28632ce9ccc84cf1dfb4154e0
MD5 70606255214146d50762ec641f005bfb
SHA1 c621d42f6ad26a0f56adebd96975af8543d987c3
SHA512 e8000e955f56f25c8b3adeaa21f3c68cbf7d454a8bfcd020e79e7207f660035aba35dfb71c084c3b9ceed6089247bc8408554bb229ba4da69513e7bbcb70c847
SSDEEP 12288:rR4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:rR4nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1736523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 88fb74cbb129e0d12836e3d0157a29f1f59f54190ac507db875eb0fc7afadb31
MD5 62e8ae30bbe889d979070506af7bb4a4
SHA1 3f5def8aca95939a3a1658cb74a4f901a9c1f725
SHA512 254aa46514c541ee07aaa1d398291fddd7411a2f0c65338872c5b49e707dca43936e1aa2ad1076514b82b7dda1a588dcded3a1b09ee5760cbd5075193504226c
SSDEEP 12288:qeBNUbTVO86UrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:qJIUbnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1EB85CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3cc74db8e3c1fc522b54ff1179bb85067ea25bb10ac76385b18612123f266e30
MD5 491083a84a49ce47fd6503f0beee907c
SHA1 7f3551eeb40a8fe5139aa20efa0550232033577f
SHA512 fca008b255ea443d93de679d026b8e98098053d0d91d8bbcd2b75e310b560b59f40a03e332337c7e7522bcb5348ac30344608afa9da2d0d9ccdf81c33334a72d
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THr:1QvGAdlCEL8c/yRNw5CxLm
TLSH
T17D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 40adc8aeccc8c2072b9464623f25f3d9612b9418e5fec919096e17cc785799d5
MD5 89c3582782392e26a51b24bb20ab9f03
SHA1 0cec4601e85bb18e8a0bbcda5cbbe19c09d41f57
SHA512 ee33b108bef4a3164dc99603b579fa7c3a4b60fda52357a86b678f01e031d4b458c9d2510fac22f7a42b0ae7df629c954b5019de5b790997a1a56d30cd704335
SSDEEP 12288:0AwSfxL/2Dc34DLLmt0LDQewsAj9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgr:JdewsAjdnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1E585E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d3eb32f199c596c7e713845fc3f8ab21cd87c4221752da3db0b842325ec1b8e1
MD5 dd87c8eaeaa1261fc92f28f6d53376c9
SHA1 fa20de7e65d5311e00d9b2275f6cb64f2410d357
SHA512 8952e182f3286dd7597c9ccd59dbc2537f7c4c0815cde7092f6fbe6b2048105f6bba8376eb7f59b2a0801a169fb6fe2dba86a533dce4c808d719b834a6ac6f47
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH6L:NUEtQevvqc2W1cpV2EI32
TLSH
T18F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7d1668412bece3d8d4b1d4513ec72991a5f3ef73dab60ee1547f945955e60135
MD5 016903f1b6df1040f2fbbfe63abaca7f
SHA1 17a7e1aab9c191efd707e046df49cb13fec4282b
SHA512 a1004e387112fc49832aca6d6f101e09111bd1678330726b8f5afac4be2f0f9f32af62f92dd03caceac14d65c57c6a128265ad0aae66d3b3e821c274d6d47750
SSDEEP 49152:sCbRquA/m2yL5zQfFiV+XenmE3/z9Q/lFTjN4:FoqtVjnmNLm
TLSH
T1EDD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5618a1bd3de06add63053ad93b680f2ff9342f2c6332d429f8498b688f160ea7
MD5 e477bec4e2e113c70a7789a3c1240de0
SHA1 cd3eb4b6f49d85534e27bc33d684368a97b9f3f4
SHA512 fe0374d51d4756c2cab010b3bdd01d3b8d84658b5bbc26534af237b525f89c3e90fc4da4484a354b464ecb839de1b76c81424f1b918db5eb9e129529c02fff2b
SSDEEP 24576:kAhGLJIFoiwtA5l7S53inQ/tbw/2Mkjy6Fr7g0ob:kAMyFoiq5SQ/lFTjN4
TLSH
T16B35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 7c6cc54eb8fa3850be96802fde320b8d206f7b06a081e49b7a2d1ec7b684214c
MD5 fd5efd54744e08e1edd0a53a5b491e18
SHA1 1dd55ed3f06ba9163e26d38ace49fd7ca2cc81ec
SHA512 387906f9b507d8d45da2082dc8ec30f025a82ab3f296266d61a8224ee22c1a938266bcee14ba326a73bf53ae1fafc8005b8f6f7dc1af31402eee278027132ee0
SSDEEP 12288:zmw5HEjsChNVBFgl0WDm+CWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMZ:SwuoOW5nQ/tbw/2Mkjy6Fr7g0ow
TLSH
T14075F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 60a649f41d880c7f83a5f77756b64399107f0ff21e5f9c598ca0b33dfca5f56d
MD5 fca3492830b25e1df119f9f0168df1bf
SHA1 ca4888496b62a1a3cc80ca22fe0a1d4cb862d4a7
SHA512 b92fb72aba95bab894cf1e198427a41cc3c96462420b7914f6f36aba916e8f7531fd0ed9dd9453153a3c70047ad4aa30d5b7ffbca8d228f6046c5e8142010802
SSDEEP 12288:1BZ1IyNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:jZusnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T17465126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 91a6bdc4c3309427adb9286c0fcc8866786ea6226958fc685691f45e3266e9fe
MD5 5faea4f6abde0fdbee1fdc9a2ddccfc2
SHA1 09cea4e5eddd052aeabc06156a027085c2375f02
SHA512 48322af26df60a1c533512ba260c824d135b2f195145f5f529a639ff93f3ad8bf6cda3c6c8923fb4cab7238c974a83945643eae17aab8e89d89a81463eafe4c4
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U3:yQRQyi36YOcPQLvw2gAf+PN38Lm
TLSH
T14F666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2dab7af45fd4d7f446fa7af0065000ca7598a2ded84a1d6da2b2ad3f277683e9
MD5 1a8eedb66ea4411c3ee3390d1c64aed6
SHA1 ba435e049d9c2602b1d028ffb3de2009831c11fb
SHA512 20846e427b4395639441d3724a52e7c4ea63baee1e395d58ce0dacc8e2ce1d8ba5c54169be167955cec2cacb507bae11dbf5f660ac9fd084184c1d34fbf4da18
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U3:0QRQyi36YOcPQLvw2gAf+PN38Lm
TLSH
T181666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c9ec1dcad5cc8f5cd7ef848a41778dd44cbc76aac15c258798ba058b5f661511
MD5 299029d683f371111c468d76fbfaeb0b
SHA1 7bcb3eea93e0a1a294bfdd1399a1ed25e5540578
SHA512 87efcba76fc967dcac2655348f204a0fab376b41753817c83ffcefa18df13b38566404f93e87f4facec0d47ec2cd163e1a0fb50fd885c6e41ca701a01bf70851
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0cnQ/tbw/2Mkjy6T:f68Qg55nhheWu7PNU3/NQ/lFTjN4
TLSH
T158B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 57ef06162d8f4e12ca8d2bc57f2318351a53c559466865ab4a5ae390d0bccadc
MD5 d331980bcb4805ee3791dd6b520be680
SHA1 4c02341b8d3c922cb4848a8e6da28b2a91011c83
SHA512 12d9773c0a95b4bdac4b840d8793402f121d1871cd704c55fb46c289183a6f1bb5dd895fc825eb4d795f67b9407167db477b637d3c02b058499ff29b08f162a0
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99t:sy5112gYy5azzVvL69nLKnhZbLm
TLSH
T16B167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f11820302594611a0696a906a0bff540624e1db655a023d7be04cd1becb7545f
MD5 15f94761558ae81856483cc1f5e3f077
SHA1 bd0899cec2a5c7d750bfe8a10c08f06680703c44
SHA512 aceeae4cd463711ec0c054d9459460169fd3700df849d7c82e40aee4f68e3d20efe599abd132ee4c935335b2337ec8f8ba9d89002816216dc35e0535f1c6c09c
SSDEEP 49152:FB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glfQ/lFTjN4:ru6JmVxd2dULm
TLSH
T115D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dfb34ddccdb813d07d06a469038b4bf192b9564453c366b982ef2fe36a15121c
MD5 2190dd63cfebc59e66b59a1d76388214
SHA1 656daadade90f62aac86aa6a38dda0bdcb36fa94
SHA512 163de730a3db0701331e2c8c9f33762af5646fd2fd1f9aa43389968b6c1f528863c4a4775c502fe6b720b838518411603cfa72644f59ef4f420e9fb3e7d52a17
SSDEEP 49152:O1hpsNoJpF1A6UU44CwH7R4x7Q/lFTjN4:OmifPbRNLm
TLSH
T15BB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ccfe8d6a783d643419b4846a1978bceb056b3486dcbbacc63d5b925b9e245587
MD5 440f7e8e8354942320c382492967e3de
SHA1 9f8eb252c068cec096f52b11538b01db76707ed3
SHA512 dd61de830306f085f27873551544498c07fade607a6bc8520f3bb51e35734b2edfbf33be0fc5be970dcbc9aabe9b4f7591749582398b1c91d2c6ab02ba2b35cb
SSDEEP 49152:wSuZQIY0Be2KRRVtOnks6NMHqsQ/lFTjN4:q5dKTi61PLm
TLSH
T113C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0f552f11298c843745184d1dccdef8257b2b4f584b515892233a0b2a1a442ca0
MD5 a8972d0ce364a808d35ca14fea6304e1
SHA1 ade1baf77db2a2c6c9ff2d876fab188a5cd57156
SHA512 3b13b7ceaba2825d4cca84919cec3845f83e31d97b2e8650d198b70aba42e6b39c73094a942c6ac2a8a81f43908bb1d2d78cad66004c815dd6cac0710bd492dc
SSDEEP 49152:ghtSn8EApI0figngiDn0AP5wvQ/lFTjN4:xX2iyph5Lm
TLSH
T15F95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 aa729919a19e0a72f91c575d55f10ef33397d8b6d8186db15ebb879cfb7c4ee1
MD5 5eb4c77754a333f4083d13516d3cd8bd
SHA1 acbce45ff5277ca52cf6117016640b30e7e38c52
SHA512 1441223f54029252c50dfcae1e9429b34481e122c3e887c0b5092873f3259c03a269aff02ac1fd872cb5d8f4b56fb561b1d9cdb29a3c77b8a88f376e2e33fa9e
SSDEEP 12288:zAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:zgnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T11B6523697964F98BFB1706F18C828182A73F0DC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 9c0efb88a722ef9a197274abeb4625737e8996bd6f5e0e3d2f95d44fa9915688
MD5 61186f3f736cc89085a5401dc00ca47a
SHA1 2713db5c1a20d4e1d74bd922225c6235668a5af4
SHA512 4e2c91a8a3e535cf1f804e520801a08346012c52d04922ac5062be4d56e04dc31525826e5b89501c08c063f4789ae220a8bbd5b7bf51cefa36951da2bc25f889
SSDEEP 12288:nBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:nRnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1D26523697964F98BFB1706F14C8281829B3F0EC6BFD1938F7B482129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 d111ed13017628ba64fe3c4b0aca55cdd1ea9f59cc64ad7a1cdf7d3c6e22d6f7
MD5 b0599c18052a26c6b064fb46f409dfaa
SHA1 e10eade363570e469e4ff0be6a7faf730143a81b
SHA512 7ba28ed1e7adb32c64fa41954bd3e51249fbc30ed1979faa32d7e1d1b784161a45f70d05f12550063c264a25d46b834c434d58d4838fbe4cc8e5916573d5831a
SSDEEP 12288:CTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:CDnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1BB6523697925F98BFA1706F54C8381829B3F0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 5ebd299b00d6c672d8eb3c2b1929939d52d27436ed9cce665526fe2bd7d62298
MD5 50b18013cb3720d35a6e148bb67db366
SHA1 48ca4c7db658e6fd3fa3837873ce4f426802b903
SHA512 6709b39abd77b13335036abbfd93c483084f4eb8094b84e05dfda286172e20770c6c7a33ade40b660f825009bbca93cf67fc9d9b4e1c1f73a4cff66b624f9ba3
SSDEEP 12288:vVCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:InQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1836523693A69F4C7F92742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 5b30615cb6a4f3ecac46b138ca1574a8b14fbde3cfa98294ed4a31a9838fdf88
MD5 1e34e8e2c7ab1770a8449ca1d1489f75
SHA1 9219c2ac3a6522544c7b7048123ecf1d746b3e83
SHA512 58291adb0cc62b967b240f617a1587560cf5e22579f5869bc034073b0dd07a1a0d63b3ac371605a8bfcb0444d551cc49058be4e9217151961ea47ae6a731bc65
SSDEEP 12288:N6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:N6nQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1E86523697965F98BFA1706F14C8381829B3F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 1d531d4b871134d9aaae5741a90aa31f6d6b650fa8a5665587594a894bf922e4
MD5 d357eb6fb5ed94be2033937bb4b98935
SHA1 43d181caed5d2ffd84c25d69313725b19cb42ae5
SHA512 60a99fc1f5b0414bc7ec1c50ea0be40962d7bb813356c9159e2f29ad1521666465bf7f8a6ac23091532b67f58231a09799571387ac8848b46bb42f3017a71bf6
SSDEEP 12288:nFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:nlnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1536523697964F98BFB1706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 49f174193b5a4de16b24d6e08a141bfb8b9aa19919d77dfe4e0cddd24f98b3e5
MD5 dc233ed9290a36a07e372d69c9c9c664
SHA1 511c3e13ee24894c9767f3c12211856210b2e65b
SHA512 36a29d06e5ddee6908c43ea9548af61a4700f4cd8d1cfa713962690aadce3a966e54048050d150f3e061634d5b6390498037be149a21c06cd1c16c2980fcc255
SSDEEP 12288:iZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:ipnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T17D6523797924F98BFA2706F14C8281829B3F0EC6BFD5938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 cd75726c91f2951751f5496b09f38533f0765a9737c5ca5cbeff791e34b7ab0f
MD5 57a274af4a23f642c39dd7af4ee15e28
SHA1 ad4f23c90ce9aa78ccc72498cfb1b0dd6c459f81
SHA512 45dcc3e36ed9de3215d1652b0fe1d4b666e78d192294130a98ec75116be439e35f1a5fd7374ba35eba48768072fa8136da17b1fc68176dd8fac3c7a4901d1057
SSDEEP 12288:piZwb6zzFEoS2cPvyhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:sZMSzFVSOxnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1228501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 f34df79a72d058d748bc5d705252584ded205964297b92ed1c6da6135fa4f01c
MD5 3757909e0eab89a1b07db7705da26e33
SHA1 0be64ac97f87f1e167b452e1c497ee99f3c60791
SHA512 ec392e3540f23a66857772c29613bbe8e55f1cd2dbc8196fe4253df114377091e40fbfb008cf7b116b0ff28bb6885da53a65febe39af8ba9a9b801384c871122
SSDEEP 12288:c8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:c8nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1C36523697964F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 8d83c76c79562082294ce01bf664efaaf1ef79286dd6eae3d7c3a45bb6f69b38
MD5 3a99f068aaa6141720507d501a6ee23f
SHA1 2de606082c0517e7d5403f09553effc29bc2baca
SHA512 056dd0205b197267830450e09ec970e5934862aec03396a784868e79e7b91d1c0481c57d6a6381cf5cb2bcd06bb80da24c45be00b411570de8b008efba0c90c7
SSDEEP 12288:GIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:GInQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1A16523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 4e4ab52714b7b6bb416b4acf29d74ec7e2270087e22c0c14873deeca74f83418
MD5 e27f8b9c59024b51c30a80c02c104500
SHA1 1aa77647944e40a38773c94f63508158b3d63718
SHA512 e79d715a13df50482562652aaf9343cabac7a3be74f3879b6e752e7504f063cd0d281c2fb1e848a67a8a6e04ba9221e41d1fca01c3beb0e7d25f8febfca9fbf3
SSDEEP 12288:vyPz5L8NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:CzytnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T15175021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 b8bbc586b37190f42119216a5b826a956f9091faa0d3613e3a89ccaabc66ff27
MD5 e5b2e00ac3cca16faf10efa21191d9a3
SHA1 f04be291ae0db732a381fe656c418e7771ea5d02
SHA512 9fff8919343fe8c53e9217abb199374d3df2956be80069a6427c49409d44fbc96db7d3dd11f77b8c986119a6f25fa3b4474fe50b30212ba3b55c0fd86916df94
SSDEEP 12288:u8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:u8nQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1046523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 0fbc44508a73fdcfb25f947dff1ea0808ada67242aea534f690e97550ddbc6e5
MD5 d55ad26d4ca696990a11054b8106d732
SHA1 ca65b992055dc4df35776d799f8e211f1acd071a
SHA512 45063ee743da171f0b2b9267929a1ed3d3c57561ac15c2aa9565ff57d6534da5467da5010e31a4a4c3723b6286cd9d8442bfe39f0e6b0e7fbcb19f4530f619ba
SSDEEP 12288:l8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:l8nQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1E46523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 78a4ac35d424cb572c334a39ac51ce317bbe78cbef3fa916c8ab938c918ee087
MD5 c64b19be0d41d9f3eded606daa670660
SHA1 a83c7242287cf7bcfd48270b045300cf22b30021
SHA512 fc107b9797a3ff6f7f20b4b20c77e110cd815afec72e8ee7edc05132df41000d74f8f7490ea0f0d7e0d1d01fb52f4e4b6083dc553498a5e517fb714cadda4f7c
SSDEEP 12288:HyPz5L8NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:qzytnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T16775021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 8466192113812ddefcf167a9f7bc1f44abc921d28ac95348f5cc7004106713c7
MD5 20e6e18e5f035923f7f4a6ddf6d0ace1
SHA1 db40299270f54455591288541e25f64274ee69a6
SHA512 d893d6eab58125171fb927d6b1408f3b1c4886bce2a93708cf4142d12f1dcc0c4145fd1caf14901237524c3dabcb92c640f6d101a10d4ffff5675c7866f5fbc0
SSDEEP 24576:TcP4mcvIjkGOxhKP2l71nNKbrh/8KBUnQ/tbw/2Mkjy6Fr7g0o3:oP4m4IpOO67W8KmQ/lFTjN4
TLSH
T14C65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 e73745275be4a1a2e192f020265a19b7b442a3e79ad93055ebfa0d20d8a87a90
MD5 b28d282f61328058660188bf86f2f26f
SHA1 0c53c6c47fa769c6c5cd4be9d92c14769467f25b
SHA512 d210441393805ac5439e858a6c119fdbf378257ea440c86c6220ff7fd1890fba759c7d6aa7465b23b9c8d35b7bdd1cb4fb0bd1bfa2026a8605dd0cdfccb56214
SSDEEP 12288:LNsfsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:IsnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1F475F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 94c93fd7ed397b943c2d416b09e8442b4aa70ed43b949a2edb81cfd24faae970
MD5 4314ea98e8b4ed3376f23e391ee2ebb7
SHA1 2942146431a5ed83004745dd8d9acf7925b3bba4
SHA512 8da19b40d46efd3fe9737a6fe642929315ccc08fb6005613b7d1f4445e6b52029b0ff7ad694006a59e80666a4c2b30c34843d4a5a41cbd93727dadef79dbf91c
SSDEEP 12288:xMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:xMnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1A76523296768F94BFA3B16B05892C151673F0EC5BF90D38FBB08222D957C3D01EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 eec0a1e4ef708672b51ab92d55e45c8d58bed6d34edd2c3a43249b5ab91625d2
MD5 3a80a5a88519db0166cb52cb03e79921
SHA1 4d7986fbcfaeb6be67f2ce9d366e3493c4373395
SHA512 7d822405deb35281d04807745542d4eba6179112a80c8d7311c9793bf23dc02f70087796f59c8b0179bbdfb93f575b724ea08a3690d59125be4bb1c9d8b5d7c6
SSDEEP 49152:Ua0h2GEkuAe73q3pp46zwwQ6Q/lFTjN4:Ua0hNYG4Jw6Lm
TLSH
T19F859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 6321c1d0cdb359097716b49340e9250f45e0af86c3da0bba83131b014abfe831
MD5 aadbb28e6742eb229ca3b24d0819aeac
SHA1 cda621648ae1ccb61945577ebe9bfb25f94b7521
SHA512 a82e032c578de754fa0c9f0187f836816b31a0ca5914a6e123a3293c2d645f2c3a2d1067ca7ecea301198798b21dca32d0de281e0b716f99fe9f4c541cde1db1
SSDEEP 12288:0hbHjfXxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:0hbHjPBnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1F165027D26AC20DAF63692BD88928546D7327C552B11A3DF2381823D4F3BBE41D79F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 77868dc35a5faa53d00f7a2eac82949d4d9c2c39d8f6373a46228421f68c6604
MD5 bc30a8dda9116902b53969e4698df9ad
SHA1 90e0d59e47615c7608a08c88b0d18f4358a81cfd
SHA512 d99fa34d0254e46a64ea2b5b307a9110246a5a1417abb0af3093daee35ae6aa7ac2e51c2b8dde5882200f95c8d64c99136b717f639fbb3a5bf1aa5008af3ab4a
SSDEEP 24576:03YgnJcRTk4yti+R5dBR/5nQ/tbw/2Mkjy6Fr7g0od:0IgnaTk46pBR/5Q/lFTjN4
TLSH
T1BD45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 3c7f8da59df99327e97199e721bed974f62e4ea79b7b6b312fed0007e50a427e
MD5 b8d9828e7fc57bec186cbab5a6aa612c
SHA1 d07cdeca7b456d5b81a6560a740614994cb0923c
SHA512 5892598c182e6138ff049acdcb671a2053f0bc707f4203178ed631fab64a736bbcef15f6429757fe752663018c8d6362bc33a83c41619c3fae5a6f92fd0d28ce
SSDEEP 12288:kYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:kYnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1976523686614F98BFA2B06F54C838146673B0EC17FA1A3CF7B48212D967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9f4161bfd5aee54ef9652ed7decd338c965b2149c34a5eaa99c47fa355dc8321
MD5 78caab2d9b68c42a0ae982966f36ad0d
SHA1 4a6d8e745eb9fbba44501be46834e699fa1deb3a
SHA512 0e4e5740452f7a2e25d624d467f9d592a92905b653e2fcd766720460ebec5484b8f21067cb47dbcf51f65acb0b07022538940857b125cc6b254ea03681d0c520
SSDEEP 12288:JOb9A4LWOsvAYFTPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:+pL3UTvnQ/tbw/2Mkjy6Fr7g0os
TLSH
T14A85F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b7220b11bfe664a895b39a500dff5f74784d021d607b279fda8e8a342c7b8742
MD5 9ff07234fab438a860c2218c3f0ad09c
SHA1 ea466802328f1ccd49d8d1f17aa64eea58380e7c
SHA512 c2e7c2c3b130ff70af2e8490d5f3ed946dd7679680013694a3a79e7b4b4d12ee013d978a2647989976144a87c52ab9a58fe21dbe8e3f6f614c4e8f88c30d38a3
SSDEEP 12288:RpFtpOLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:hO7nQ/tbw/2Mkjy6Fr7g0om
TLSH
T19B75022D36EC60E6E53A527D89838209D37278961B6253DF0780817E5F77BF81C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 891b4324a1ce2045974495144d9e2ecaa4a9c9d8e83fcf02c09b728ea473fbea
MD5 c38a8396c10974c8261586bfd08de8e7
SHA1 e746fa5a64d11db4afbb1d5dfe25894701b6cdcf
SHA512 48c0f31235cb1dc831f5a55c0b5055ef9078991b9d332de6ba205e6e6f8623232a5feb7dc6828b50311f4cf742f06feb40ea6da878f2d35f627dd4c751926924
SSDEEP 24576:y7NM9YqZqmWMUkPjZM48Mv6bEhs8nQ/tbw/2Mkjy6Fr7g0oo:y7cBWMpPjN8DbEhhQ/lFTjN4
TLSH
T114659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 22be4f48869fced0d38f9b06ec69f4f322c3bf88f60708d70029e71de43807dd
MD5 48ea9381bd417402e246d224314b5f36
SHA1 fe88bf1b2f4684c9b8012de3908c7963f0d865e3
SHA512 a8058b2c3a14680b1983ff86fbc20b37be8a44fe564db3374392126e9ffff193a2ed3fec45c22fdf8f7660718e029c15031ab79cd7c6fcdc52c74fbc40eebf3a
SSDEEP 24576:ZW6BApg2YuyuNDYTabvcdvNYf8km1OnQ/tbw/2Mkjy6Fr7g0o7:ZF2YuHNETovAvNYf8kmcQ/lFTjN4
TLSH
T15F857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 23be10eb0e91b6e04fff59b556cc089ac4b24dbc183e6bf706d59da9362ab32c
MD5 951a25dc93d28859a5abe4804c421bc7
SHA1 b6185f1e6465bc3f3d6005c0efc15645f84f8f17
SHA512 8afa8828c1bfbe529672dc9221fb2f8702de4da7adc6ca39e695b5a00a90cc76bd2045a3f40d7b462ce1a31ac17d75efff5c95ceb2b66f3ecb48dd0adc8f1bba
SSDEEP 24576:AAFs06+Omlf3NXEbTo3nQ/tbw/2Mkjy6Fr7g0ol:VFs060lVXuaQ/lFTjN4
TLSH
T15465AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 b2fe0c74f40a9bcc5a5a0e47b9236af044ebacb9f4543a71eae2a95dd3bf0300
MD5 cc9dfcf3b5ed182f1a29d6b0ad4b9a00
SHA1 1289014439cd3197a0247810b28a4aae0a23af15
SHA512 8de6d069818a6f1e9a816bdc7d326c74e9f33df9c6026b73300d5b69f545e2f80d0bc365cc3a1c9596e7beaca2fcc574e3f3cb7fd24b1fa7d2627250e7551e3f
SSDEEP 12288:dCJnJ5D3VkrDzxcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:0JnJ5D3WXanQ/tbw/2Mkjy6Fr7g0o4
TLSH
T15C85D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1940416834da194657995fddb3512484871ee7aa5d66a6edf8fb10c5e53e708a
MD5 be15f40e99667cf15186cc8b0bc756c4
SHA1 c537fe70d1aa990d5c80582997479e6f107631f5
SHA512 f5908b0c5f4a443209581fe42fdcff93ca75651bfd6dbba8020df7d73fcfdb8ea598e7df8734db2471ce08020d7bd8fd776079831c631bc3d665dc6490b486ff
SSDEEP 24576:SEPghm6/7IIXdwcXrif7qQncjlP65i3Vu5nQ/tbw/2Mkjy6Fr7g0oG:lg06DIKdwc+eQnSt65aVgQ/lFTjN4
TLSH
T161955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 4c5dc07ce3e974171916aa9466aec8a37a429f5518c0c20453dd4367fedb31b6
MD5 ef277c96efaa84bce7f8a29366a95545
SHA1 a7c79da2ce076cc3f985c2c4cbd87dfaf3c86e79
SHA512 9496457da773d71830439b27a0cbbb6cb9f16da6ca056e1974a9838e7e94bb32379f2048541e11150354be6be85ee5ff75d57175f2f5a692d0bc134a99b5d53d
SSDEEP 12288:pEP3RnWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:6n2nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T14265126D37ACB0EAE52A517D88918145D373F4A16B5267EF2680823D4F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 b5311e14e14075026887172b59460b68971848d225e3b57eea371cb019fc5ac4
MD5 7518c9b903da6bf0d8a749b9992e6942
SHA1 7ebca30075bb6bb1061201ec46443382817e2041
SHA512 e7a8ad03446261bec77200a6f24569f710c29b56b5509e3fd10bca4e256b28d6c90f05e1c0dc5f9500a710857e529fcdbac6c896906c2b0dc4f234d33f571226
SSDEEP 12288:ajkyBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:aIyRnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T13C7512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 319a002093d3d918b358c86d5ef33e61128ab36e2437c44092b81321d8812270
MD5 241df6208ee87e6b7a9fcc8d64c8ea1d
SHA1 b06769eb0838d585a9a20aa165941f05062c8f67
SHA512 7a969524dc1e4b3adba49ac2ace2d65eff571362a1d0c4cca1d5ef4da7a0aab373b7e3f47c5e9c5b4ac01fbbd43cb7e9b0a42f4cd11028debf5d668b1308bf5a
SSDEEP 12288:QybGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:tLnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1AC65236C2625F89BFE2706F448928542973B0DD17F9163EF36886239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a527768a6a7a49a519b7c79eedcd3aeb5ccf5a558c478986108ec55725928e37
MD5 d368791451264f919d1799442e57b1f4
SHA1 22b9e358dfe513846de2d3828de1989d98aef1db
SHA512 01122d71d4005daed073123c4785adddc9e21566f722625624c40961b6b9753aa520922c6ebe5d07094eda1e1c9fd98b38791027573c9607db879cf42c00243e
SSDEEP 24576:NQ9MxZKdcz9dw3EnQ/tbw/2Mkjy6Fr7g0oh:NVKZEQ/lFTjN4
TLSH
T15D558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 15e1124e0ca8dbe4359ee7af2b9542cc01010a151bcd7c8cc55e1c7038424599
MD5 2bd400da4735188888c54385fda4b65c
SHA1 40f14e6b933fe60212389e38679495cd460733bc
SHA512 4e7bbec0dcd07b931d2abdd12ad48e1bc3cb4f4ccad9861a290a274f930073e100c3f3509b8f0d0136c969b9addc2690be4ecf66fb30fd79b9feaebd4e44854b
SSDEEP 12288:byoKo2JRple9p9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:byocDApdnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1A975E01FBB6990A2E136813C88818745E773B4706B6263CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 89a2e1b0dfb013f4146b529253b9bd80c3717a60eb7e7fb60e7fa9757f0148bf
MD5 2d01cdb65338fb84c19f6cceb83d97fb
SHA1 7cc71622f4ec8fa23a10d428221aa69e017b104d
SHA512 0cb3c4f84a4a4d54519e0ee61fb34571b2a8c4b978dc7616c4aa2cc93ec0458e1b83817c38facc956d540152b51635d1b4676cbbf47b149b47df7d9c935e50bd
SSDEEP 49152:IWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKdQ/lFTjN4:q0zuNIkLm
TLSH
T1D8A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 efe5042b85ec2325b6f1ab52758704cb19e0a24faadb0733837ead8290cd87ee
MD5 04c360c0a1b77ee525309cd7944f1d58
SHA1 df335c544c303d922173f314e94433792151fc64
SHA512 336bb1b7605694742541cd9045cdd94ca2d1b5706e105cc5bee0806728c6b80c8723b33a8e53ce77f24f2a25df71edcaa7002bb4779e3b956b86ae5c601a7e5a
SSDEEP 24576:F1QT7EcpfxR+N5AWAz3ooiYtjMqb2nQ/tbw/2Mkjy6Fr7g0oT:gTDxR+N5YzTfjMbQ/lFTjN4
TLSH
T19C55B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 33b8a21f56e8c632e5a5fd36203f71873ef37be208588c11160604c3226d202b
MD5 364efd2e185cb1e12018a27fe7bbcafa
SHA1 1610a06409bfb71a3f04b8ca022007b84f11a1bb
SHA512 b9bdf7f0b43c4c0b78ca638c261c5f4a62d632f81510a5561920a2f90ac1917697d47d9d0c8385e6f7ff3ec56c04e9f5cd9c494d3060d6fff48ddae29626310c
SSDEEP 24576:DTMdOz0FFS+imSLCnQ/tbw/2Mkjy6Fr7g0oX:h0K+imSLCQ/lFTjN4
TLSH
T1C585E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 7244f77bf7aefa14087079bd2009a5e26e8ac1a8938de39174492f69f1ec4e0f
MD5 3d353258fda3c22b87b7fbf0fde0e785
SHA1 63871f061c3e55e7c44df3a417ac361fdce99c82
SHA512 f911813c338d1fd76e7e47afdca5103decc1c064bcf69c6d3df2392b0e6eb2e80deae96c7a925d36de2563478e624b6ebf568e23eee1f6500ff7643557d7a866
SSDEEP 12288:n4KPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:7vnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1BF65122D23E8B4DAF93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/544-343-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/544-97-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/544-91-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/544-100-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/632-399-0x0000000000CC0000-0x0000000000D15000-memory.dmp

Download

memory/632-76-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/632-84-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/632-82-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/632-316-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/1104-172-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2196-455-0x0000000140000000-0x000000014026F000-memory.dmp

Download

memory/2196-173-0x0000000140000000-0x000000014026F000-memory.dmp

Download

memory/2276-170-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2436-366-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/2436-122-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/2944-175-0x0000000140000000-0x000000014028B000-memory.dmp

Download

memory/3336-356-0x000000000CAD0000-0x000000000CAD8000-memory.dmp

Download

memory/3336-198-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/3336-174-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3336-357-0x000000000CAC0000-0x000000000CAC1000-memory.dmp

Download

memory/3336-214-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/3336-359-0x000000000CAC0000-0x000000000CAC8000-memory.dmp

Download

memory/3336-182-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/3336-456-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3496-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3496-120-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3496-33-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3496-363-0x00000000004D0000-0x0000000000525000-memory.dmp

Download

memory/3496-39-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3696-401-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3696-133-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3696-124-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3696-130-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4088-116-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4088-419-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4088-365-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4492-216-0x0000000140000000-0x0000000140262000-memory.dmp

Download

memory/4492-72-0x0000000140000000-0x0000000140262000-memory.dmp

Download

memory/4720-396-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-391-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-377-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-379-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-382-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-381-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-380-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-386-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-388-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-387-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-394-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-398-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-375-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-395-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-397-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-393-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-392-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-376-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-390-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-389-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-385-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-384-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-383-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-378-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-374-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-367-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-373-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-370-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-371-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-368-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-372-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4720-369-0x000001324F3D0000-0x000001324F3E0000-memory.dmp

Download

memory/4768-90-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/4768-12-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/4936-70-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/4936-8-0x0000000002730000-0x0000000002796000-memory.dmp

Download

memory/4936-7-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/4936-0-0x0000000002730000-0x0000000002796000-memory.dmp

Download

memory/5088-22-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5088-16-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5088-24-0x0000000140000000-0x0000000140252000-memory.dmp

Download

memory/5088-99-0x0000000140000000-0x0000000140252000-memory.dmp

Download

memory/5088-362-0x0000000000BB0000-0x0000000000C05000-memory.dmp

Download

memory/5180-29-0x0000000000700000-0x000000000082A000-memory.dmp

Download

memory/5180-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5180-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5192-104-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/5192-109-0x00000000007A0000-0x0000000000806000-memory.dmp

Download

memory/5192-361-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/5192-103-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/5344-143-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5344-137-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5344-402-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/5344-165-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/5368-55-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/5368-67-0x00000000014D0000-0x00000000015FA000-memory.dmp

Download

memory/5368-68-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/5368-63-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/5368-61-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/5368-65-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/5632-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5632-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5632-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5632-364-0x0000000000D70000-0x0000000000DC5000-memory.dmp

Download

memory/5632-132-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5648-150-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5952-454-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5952-171-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/6084-113-0x0000000140000000-0x000000014023E000-memory.dmp

Download