07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/05/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Size 4.3MB
Sample260501-mgcefaev3v
SHA256 07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2
MD5 43bc93f614aa770c4f7b9017361aae00
SHA1 259c75df0ac5108c9fd69adbcb54a8252831bd8a
SHA512 a16befa39973e944ce28615a9730640dca613744131c47d7c9486b9409cf333e4b59d88a19fda777be69bf5a444dc1e3cfa3131a411b1bb059163f138e871a64
SSDEEP 98304:57OXu+3kFW64CgkfClnwh9hNhroFk1GXKvgLm:+EgMC1wjPpvUa4L
TLSH
T1C626C012FB8180B6D8430271966767FA0E3BB910533AE5F3DB941D3ADE212D16A3F395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5944	alg.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
4348	fxssvc.exe
5404	elevation_service.exe
3368	elevation_service.exe
5304	maintenanceservice.exe
5904	msdtc.exe
3900	OSE.EXE
5176	PerceptionSimulationService.exe
4684	perfhost.exe
900	locator.exe
4020	SensorDataService.exe
6068	snmptrap.exe
5308	spectrum.exe
4416	ssh-agent.exe
1500	TieringEngineService.exe
4744	AgentService.exe
1800	vds.exe
4564	vssvc.exe
5192	wbengine.exe
5596	WmiApSrv.exe
5264	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\daa634628b62accd.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\System32\msdtc.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\msiexec.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\System32\alg.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\wbengine.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\system32\AgentService.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c9200f054d9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc5a4ef154d9dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000761667f054d9dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000189becf054d9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d08941f254d9dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ebaec1f054d9dc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe
2516	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Token: SeAuditPrivilege	4348	fxssvc.exe
Token: SeRestorePrivilege	1500	TieringEngineService.exe
Token: SeManageVolumePrivilege	1500	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4744	AgentService.exe
Token: SeBackupPrivilege	4564	vssvc.exe
Token: SeRestorePrivilege	4564	vssvc.exe
Token: SeAuditPrivilege	4564	vssvc.exe
Token: SeBackupPrivilege	5192	wbengine.exe
Token: SeRestorePrivilege	5192	wbengine.exe
Token: SeSecurityPrivilege	5192	wbengine.exe
Token: 33	5264	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5264	SearchIndexer.exe
Token: SeDebugPrivilege	3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Token: SeDebugPrivilege	3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Token: SeDebugPrivilege	3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Token: SeDebugPrivilege	3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Token: SeDebugPrivilege	3452	07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
Token: SeDebugPrivilege	2516	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5264 wrote to memory of 2364	5264	SearchIndexer.exe	104
PID 5264 wrote to memory of 3528	5264	SearchIndexer.exe	105
PID 5264 wrote to memory of 2188	5264	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe
"C:\Users\Admin\AppData\Local\Temp\07b0799b48e5ae433555cc7c069eb396658c40cdbefcaa65eb1ee36996f9dff2.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5944

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2392

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3368

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5304

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5904

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3900

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5176

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4684

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:900

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4020

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:6068

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5308

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5336

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1500

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5192

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5596

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5264
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2364
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2808 2696 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3528
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2836 724 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9613381c8576b200f1c101075fb9c130ea085499ef437d5f72b6a158562dd22f
MD5 20490a98501a915e0598315440d912d6
SHA1 ca7a2e9a83da673ff70b5cc091265ca05f5b75da
SHA512 8dd4b06c502b66ec6ee0419367aebeec34c68aaa8ef928f97eae57815b28efe1f18b6e120bc4793459ff63a27107b22c64c899166e4de6ba59889453b708040f
SSDEEP 49152:Kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxniQ/lFTjN4:83q6HjBiLm
TLSH
T100D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 05457f27cb2d998a0d228441da909f8d385bf89a2103a4e8b7c1f12d3400a044
MD5 dc5850239974d392bd4dd2aa6b0afed6
SHA1 6707f5a9b7b27ae36376f187a79b388ef2476828
SHA512 244cb6fea39778f5a353f88b67667a7cfaec66228339f8e7803601015233c7afced848886c5306655709e4da0aec9aac16f3be0970cfd684147c7bbb23b9278a
SSDEEP 12288:f1XLsswWkxy2lRq2czAnRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:dXYfDtczAnhnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1D685F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 1b91361f62e880a18658f0db9d7c26ba3cc756bec0d71d7275f9126a1ec55399
MD5 c080dd6dc6547f4bc0fc56c745a3e470
SHA1 f4dd74cf73455dd8a4c77da68c839d7b1c4847a4
SHA512 baba1d2fda801bde08acf17b4188d0b046d6a604dad7e3ab6caaf4a874342232ab2cc03a9f3975ee8a26206d91de8336f993c44beb6ffad19196f71838908c40
SSDEEP 24576:K0Le5ji0hmxirM0hnQ/tbw/2Mkjy6Fr7g0oQ:KPji0AcLQ/lFTjN4
TLSH
T1D3959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0e0069eaa6a5c90c72ed05668033e5bc9a1aba27de3201453d685ad2321968cf
MD5 2dfc80f3e0ba313d4098e6f3fd106fdb
SHA1 2a08ed3b98f9971b30d9bbdd01bf559770b28b96
SHA512 06ee2320cf03e7b4700493c4d3d95eb10e1163fa86d27295dd96b50634537a3c2aadd42db54d1ee0e2f4090b8289322fe65e84cb002e6c02b97b7d4666d5e156
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWE6q8wyuChnQ/tbw/2Mkjy6Fr7g0oL:a/ezSC6vUzPvxHjyPQ/lFTjN4
TLSH
T194755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 66729b8b0126cc7b5eaf31eb813109e774c53b587c75061bd59e0abcf3afd0c2
MD5 d7301b5e86f1c461711357f7e0561f8d
SHA1 e68594dfb775ef2ccef191058ba9dd7d85721a23
SHA512 e0b5128ffec66c583774dcd9533b84ca0d25701abdca1aa69b81985118fba8020ca0ae635826b8b8421102d44d141442c8012f50d2c34cd3867f4197776a7c58
SSDEEP 24576:XVbqPb88hv/l+6jhnQ/tbw/2Mkjy6Fr7g0o5:XVO88hXl+OQ/lFTjN4
TLSH
T114559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 02023fc2d205da87afd7c5135ddb95ce79081e6e98f932cae6978c03125695c4
MD5 043880db94d8648cbb428d86b4d15979
SHA1 848e3968405c1b3308fe265dea543d0578751c5f
SHA512 e53c5405000299aa4bf1737fa6d4fe4760b45335c914bec47585565b2f1483a2f9f70d42fcd6ee9206b12536cb457d3b1982a7adaee5caa29e8dd5fb2c6ad84d
SSDEEP 12288:2RwRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:2RwhnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1CF6523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 6040ba687440c6ab9a373b17d5bae14b5fec2718e27ded44caafd452439ca948
MD5 ff12c3685f3958e33af2f7bb33359629
SHA1 86568278b2b2a9b8fe18878109accd05879419e5
SHA512 7b058d9fa8211c183494d7a14f5b78a33ede46b373df0161f2a9a18b3d4b024d114ddb69cae3b17356384ca27ae44fce691f6f5396b0a250a4a47358d6e28833
SSDEEP 12288:oeBNUbTVO86UbRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:oJIUbhnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T10985CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d621b4fd9f2ed1d30078157d7d9a5091583da862d3f489099a316c2e96c3465d
MD5 554d7551723f48c38b169403eced7327
SHA1 e383536bb8291e35d6940213db60f17f9fdb1f78
SHA512 b1e6570b6a01479389156184d997fb5a7a0d8b04d80d3120ceaf94ace747beb6c6225266bda0b0a40f7c57f227d9676bb936b7ede99a00b1883ad37cf9685829
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:yQvGAdlCEL8c/yRNw5CbLm
TLSH
T13C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 a7bc789c40e53264349f37cd4bed9f193293fef4f6ab57554f31d3d9b554c3e5
MD5 9f0d8c5bb043fcaafebb9582031b39de
SHA1 e8ea93cbddeb3f77fa54205773bc4973bdb57593
SHA512 88efb8b6dd8fb44954fc5c6cf083b53478956c4e92864feeb6ffcb485631a0642cfa9a43bc673856a54beabe765af0d54691128d1351d7266be6b508f9f1c91a
SSDEEP 12288:IAwSfxL/2Dc34DLLmt0LDQewsAjJRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsF:tdewsAjJhnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1F985E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f8296e21b3592ea845cc9a8307f2f4ad7add657d348f658b4f373b94902d9fff
MD5 19b89bec5b0932b5646c4300e1321308
SHA1 fd09cbc7dc367ad3d6b27de09662d017fb039ad8
SHA512 c8f192450f5d9925ec3cb9faf9de45b7f763e41d60c8027f4cdd3456c55528151096ba69fbd53814f51e7c56479ba4d77af8e06d9b0bbdc5783228cc923b826a
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHoL:dUEtQevvqc2W1cpV2EI32
TLSH
T1A1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f72c7b4a06bde7655c3cdd0a2f228eb953475eaac35f4689464450d8661691fc
MD5 2b393a63906cac98da008136848d6c83
SHA1 8ee9486a08a6ea8d2f32f3a4bb753e03a66f2009
SHA512 9696f63e6cb2ec34da35fc2f0c1aab8a4d89ec4188a8f2d5f65859d7751662bc00315174a4c4b8f7aa58ed92ea20a4e386585969ba482edab2187e891ac5a9ac
SSDEEP 49152:YCbRquA/m2yL5zQfFiV+XenmE3/z7Q/lFTjN4:RoqtVjnmPLm
TLSH
T1F7D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ad0717b3753888bc6fff31588636bada6f3f5c3a4f39b194106c857eb43fc533
MD5 e33d0684677bf2769d724c3d8cecae60
SHA1 689c3ae407811974e85fbbf2d2aee2929f43672f
SHA512 bba9da1fe18342e626a7f3bda525b4a28289682628d92ecc63c088e17fa9dfb0ac4c7e84750a6744833e508f88dddf8b0e80c0162b43d1edefabfb87d8ec0adb
SSDEEP 24576:fAhGLJIFoiwtA5l7S53WhnQ/tbw/2Mkjy6Fr7g0oC:fAMyFoiq58Q/lFTjN4
TLSH
T12D35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 c981348366fd41e4558afa2efd82ac85c6c39bb500015f96b640b498056e9772
MD5 75247b62d669b512f71664a1431fe218
SHA1 036e22fbc09dbfa86a3647ada324f3068ddc7d91
SHA512 2fdc4a963fe451be41242208016491e0e69b414f85138695681b5ee80395a43bac12763e9fe976f4d83ad4a786994dc4066ae4a001e3167f0b7b79cc1c757156
SSDEEP 12288:Amw5HEjsChNVBFgl0WDm+CiRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoF:dwuoOWNhnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T17C75F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 8f761bc8fb3bab79b98a4504dcce904b89e3ca3e1acf316a958950c96f2e3f49
MD5 b54767eade857b5d5c1edda248f3e957
SHA1 3a8dc0e33037659da2f7f91cb256ddd73f9eba12
SHA512 6fab17665a1542e98f14d60f2a3f065dca85abc1911335b3d972bde1cd934b0a67ae51e7975323ea6d551b9a916dda355360d9bc76d664673e0195781b3d539a
SSDEEP 12288:QBZ1IyZRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:OZushnQ/tbw/2Mkjy6Fr7g0or
TLSH
T10265126933A4B0FAE6674278CCE28646E773388267B193CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6cd448e97846f41b858cdd5cc60a0c1a999e664e2160f433146159fec7aab6b7
MD5 8d586a3ae790291944568c9d5e239845
SHA1 b4843e35f11d1d0eb2b4b3c79a16019a56bf9fc2
SHA512 2b1dc0ec74ab8d19058386189bffa490ef332867ecbc0f332b341c633341580e872c82889d5b5014156e8040aa6cb22c57a8b0a7a75b1931bb6abf2ccf8ad72a
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:QQRQyi36YOcPQLvw2gAf+PN3uLm
TLSH
T140667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 78a2fcb7770c8eb697dcfdf5c5750b0a20f23754f6345ea2deab7b73f22fdba8
MD5 bea7476999d3d2297bd00d22485c10e6
SHA1 79122fdf4d3d93181b529429910a706db0453326
SHA512 d54fe1c3e35e22e539bf2b04ac891d3028fcd31b1ac2b8db901bf07c730cc95526545e18c1a61416cc943ebb4bfd83e9465c9eeed89810d5a22ec872eac9761d
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uh:KQRQyi36YOcPQLvw2gAf+PN3uLm
TLSH
T13B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 170ba4546f1aac015efe8b8ade43780135a0c913db9fc01fb1f2471a46c613df
MD5 4824bc00256d029f6b59f8781403d147
SHA1 d26ab4123c7ac664dfdde870bc0558952989aa4e
SHA512 43aac4898dc555e4052436870f2edc9881e65d43ed538ff986b519da552598379b301db22231e9ce65cee4ff9f4739654c0176a66341f6198fdb6fd800fa0c6c
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0chnQ/tbw/2Mkjyc:U68Qg55nhheWu7PNU3/LQ/lFTjN4
TLSH
T124B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3bcda68ea6fae11c1e18ff496f08c26d8904947cd2724e3d35d8a058be7da3c8
MD5 d11ca1c5a98a6c5ed41e811b39c4adad
SHA1 3bd9101e4a2cb71d07aae81fd05b5139fb0bf64f
SHA512 3afe1dddc2d7426de65e00f89cd4f4fe5959bab0f521431c323abc1445934d76013dcf1ae5f399a7fcc3174908f8395909059d1f1679e4f6a8d357025f14c834
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99T:Qy5112gYy5azzVvL69nLKnhZBLm
TLSH
T19B167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fc5664996b32eb05d546c220116708a0c2f21e0869694d8d85d2372c6c2ea7bb
MD5 dce931a9a8fbb7525a6cb8ae5dfc7b0f
SHA1 63e23d82c11e86fad182780b6b6abca61a6bacf9
SHA512 2159cbe97de1738f0d8405e362ac39aa40f7a097a3838fc60b9deb8b2e82c7ceb5177d6bae54fd4adfda2d3d711876f09839fe9f08ad9bd192db3282b18ea0eb
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glRQ/lFTjN4:lu6JmVxd2d2Lm
TLSH
T1F6D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a5369dead462c7a5ba9381b47728411f8c09a2b9bcedcebeed7de9d6f335082e
MD5 c8a9b8d61496286414b3f3dbf99d9020
SHA1 e3735f658968c98514631f43bef6289767b137f4
SHA512 435e2cffc98db1596cb5bc9e9b1ea7053ab368520e4d769143cb50b9c69eb4b3e4fabc120be72ba55c6aa056d3a79d19a44e8d973eba5623e56f1dfb24fea7b2
SSDEEP 49152:G1hpsNoJpF1A6UU44CwH7R4x1Q/lFTjN4:GmifPbRPLm
TLSH
T1EFB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d6f4acd78beecfa4f77d34cfa3c00cc4b63ebdf2dd14d73c328e627ee5f94c2f
MD5 6543b213e3e62ef0fa62120fca9fd2f0
SHA1 ab7a49fc474a0f74927017b521b05abf643ebcaa
SHA512 761e8bd8b6ee362ba1402695989e569fa5842b261a78d7a09692b7c666ab6d93b5f1ad27b9033387bde0365fa790302bca4719d24f5dd8391cf43d3632cab255
SSDEEP 49152:CSuZQIY0Be2KRRVtOnks6NMHqyQ/lFTjN4:c5dKTi619Lm
TLSH
T1CEC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1d28846181a143d5a95672a66c8f460234a59ec821e3e47bc81f1cec1e065e98
MD5 dc518b42f557677c82f34a48e375ebbd
SHA1 499d2718baab1188916caa49406f478bfc0c1210
SHA512 5d80ce002c8a067e876871a720fbf2ad8b19bc1234151ac36955c5f2637f07dbac4d088c89e58c54b368aa8f2082429f3bd8ae91b1c475ac045eecca4dd7572b
SSDEEP 49152:DhtSn8EApI0figngiDn0AP5whQ/lFTjN4:iX2iyphTLm
TLSH
T19E95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 021c51bafc845268ff9489c6ae287381139cb184ee3ae8a6362b73e33a50ad0c
MD5 c384e94b2fbe981927117bd82199ee38
SHA1 a3084d8fcfd14422aabc3087e358c0790cc99da0
SHA512 b7d12563d0a299764e28fab35d35ca207408e4546fa3fe9c726662ee7696302a1cfee1b6c54f54374c413826de308d2296212fc8b2b9853dc8d0f6fe45aa5281
SSDEEP 12288:wIRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:wIhnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1296523697964F98BFB1706F14C828182A77F0EC6BFD1A38F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 a2d95d95583f8144cb097edb65c789b3ac5c11dc9bec9386aa7a47fad0e20e3d
MD5 4b8650519baf5d10be16d99131213c28
SHA1 6e885e9e52e4f12fc004f01d48bf278eae1d7574
SHA512 1258995585bd422499d116722f5746103902f94eb61f9e46ec8f0c3519a0179cd55867b65456e02513344228611dc801af546ad14fd3f2edc28952d97559113f
SSDEEP 12288:BVRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:BVhnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1DB6523797964F98BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 53e7905bb142acf6eac5bc6965060717b1bab6aa272fa426f3bc540e7b960ce4
MD5 3be53c78f86cc2013c83bb89603a0c2c
SHA1 7b1576c37d4de21f027eb7ed646e056c0b4edb13
SHA512 7bbaeff39d6841c0f7e044c1a4fbab6a2864b92cc6bba048cf7ed5989239cc21b28ea75153c236b89c86b93030fd1734a2758dfa7cd2986414b830d13fe704c9
SSDEEP 12288:kTRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:kThnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1B06523697965F98BFA1706F1488381829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 8cad50a6a271e8127e284f4d2a51a04be29074026c24a641075ab12cb1b9215f
MD5 529e54c19c1f651366251865becfa155
SHA1 0e28caddca2beb4e70737891406080e07b9b3e59
SHA512 be2e47c0a643df5a7e9973237307ac4ea06a49075ec2edc5fa8605ebe766edbc40013bf5550b4f8866f02c6e80173a0bdbb2009ffa66e1ac565e715d5e36153a
SSDEEP 12288:gV2RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:LhnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1796523693B69E4C7FD2742B4CC928142E77B3DC5BBA1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 55ce6e2c3973658c70c830b8f2fc72f87ec29621bab566ef19d6046f129b1052
MD5 7338401578d119b2971bf1a1c3ffd5d1
SHA1 5caaa1066f14ca53f920381824734a9264d83c0e
SHA512 e21d465e8328db2482d076b824b5cc0b8929f5e485c938b86b95da7e2fd9dcfab1f69ad4ca70bd9b93aab883b1cf13b60e68f7d8956598091f98944a70002dc9
SSDEEP 12288:S+RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:S+hnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1C46523697965F98BFA1706F14C8381829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 64830592c0838b557605565dc6b004f965dc1f536d8c41f8bed8f899b2a0ca25
MD5 ae522461928c745925f777705770dd98
SHA1 f50abbe5e6698ec6317d3c7ed3b0c08decafca84
SHA512 9ccf184e29f376e8221e1ee76ed251cc487fe0f6ac44fb85e2f0135ed9b1f567158fcd3a67ce5ff94da6b80bf1c1e08554c9eef6c8737412fc4d4e5fc8b480f9
SSDEEP 12288:sBRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:sBhnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T19D6523697964F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 448f4e195b4770797f7946b11158ddb3ecb37cea13277c19a76669efe13a238e
MD5 9e927938159353d2645ea8119e37b909
SHA1 35d062fa5666b3c1d7649b0f76b85780b5e59cf7
SHA512 0989714f60631e16bd17837b1238f41b1be30fa974f6126aab01ae626fe163f35e5847c75453974783f7938657dfbc4490db30e30ca6bef8deff608a6c71aa71
SSDEEP 12288:S9RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:S9hnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1156523797965F98BFA2702F14C828182973F0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 f8c4865d2df87a2e18f4b186fdd6bc4971a9b489c5d201895e579e6608f5777e
MD5 c888e8ea211c928a6956b65162793f27
SHA1 5366eecc706801bae8a5eedbb1e510ef7ed357f0
SHA512 e58eee6e6f3ac19d74e7a1aa14349f38d91a340f04430cee9c715835c37dfa178156798a59a7490a168032aa3725c7e9104cfd52a2f77c2d34b863607538ceea
SSDEEP 12288:yiZwb6zzFEoS2cPvy1RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:VZMSzFVSO1hnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1E98501A4B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 b96ec32388c1734f3d5cb0d07ab56067a66561de0c38ee09275e1397039a99b0
MD5 4e01fd05284e04fbf86d0b24af7dbfc2
SHA1 06f0cba65fab9615496168e7dfe029525f8f7aba
SHA512 082a28b9040b480d27a2beb1d62e762443df3448660dcfd58bc05b3b9db7bf9477797e55f29c77d9b1468662ab0f116727f92c6c11754fee838d1498a5dd0c40
SSDEEP 12288:08RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:08hnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1AC6523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 76513012244e119be3097a8791095de60d3ceb2bad8e5290f7c1f30cdf181f55
MD5 60fb84048e720b8f341cc3c073ed06c9
SHA1 8fa5d42af0f041faf46aba66885c6d23c82098a2
SHA512 9a565a923b6bb10212a8f349ccddc220fec8f1b739e1e08620388d48f9c7eaf269e44835270f6aac1887099e1577533657a173a5b1e70046c7f3067fb5a4f3b6
SSDEEP 12288:5ARGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:5AhnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1536523697964F98BFA1706F14C8281869B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 a9100b295088a9e3327cd1b5bf666d3c1df3b9f903db6a7d4fd100c034c98eba
MD5 dadf52ee7d452c498db9379458f66db9
SHA1 07a472f3fdfe16b4fc81399f8dd644088ee0d620
SHA512 d43835c64758d26d5529367d679c07ac9655aaf51a06519e49f33dd2d135d71bde08432b0edf6a2a595eef4e24abfc949f7a83975b5a415e722c6c4962e928a2
SSDEEP 12288:6yPz5L8ZRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:nzyZhnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T15975021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 0b1bb46be853d4f4ac9b3b8ccf3e8e9e9c0c98701f83e31b793f96121c0abc82
MD5 e0641639da2bf1a804c3c31cde38f58b
SHA1 39bb2c42df593254eae46bf7fde0c3ba9e5e6ace
SHA512 e5c87da001dd3b14b36208460c2e9f43b2e55ac5a22ab72a4711fc4a2e0208b10227634914f3d369183f69140b0c6273b941f02725de305a750c26d6464750dc
SSDEEP 12288:b8RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:b8hnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1836523697964F88BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 f0137854a2ea86be99d2f01fe7335a1e653ff7774029db0090e47ffd7e4fc6cd
MD5 6547124a5bdf6cbf75a7064f3b61994d
SHA1 861f9db22e2e87eeadcc9bc2d296730a17c930de
SHA512 17e1b99d891a861031dadef548bc6cb04c38634331ea15b5f4bcfe26e04b0be7a8dca063be56d24dea61ada55f242f9945bafa4f90c3ea090065f48ae299090e
SSDEEP 12288:j8RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:j8hnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T18B6523697964F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 d8b83a548baffae004ee6dec8e66d8ec0ef614cd5877ba9c65f4b6989c0d0572
MD5 c97b0a11033613d9955bd784caa24ae9
SHA1 e61af2ca24a4c91fad490f71411c3f4e300f4374
SHA512 314f3bf83bfc90be08ed548b21b20d08ddf141229a688a6b28c15ffb714adce934a19d364e7ebeade92d880ddc83356c73079d63838975748ea58b22d2989246
SSDEEP 24576:5CUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAvhnQ/tbw/2Mkjy6Fr7g0o3:5CUxPTY+8Wg2lIL8lrIUJLWwUQ/lFTjG
TLSH
T1AC65AE1DA3EC089AD4BB813589518A06FB72782E1B32D6CF2160C33D6F27AD55E75F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 1be78dcb89fce180f58faa06171cebb7eb2084dc2fb7723d04542a39f5f9fb05
MD5 efcc1ca1b50b22bd3798a1ccea6193ed
SHA1 32cd17da8fa8f64a1ca2f5a1ed291e949b3a8478
SHA512 6e0d358d281566a9bef78817a2bebddb6a348f7a2e59cc7afdace3e310754880cf70d772a1c9a692dc71250a1c88148cba1e09c01139dc13f44f56950a1875fb
SSDEEP 12288:sNsfsRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:dshnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T13175F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 ad5b5c691df11720756b1264991276b85447f589b9168e69d8789a647bb39f66
MD5 5bed0c42e67d6abdd526f944299a29a5
SHA1 733d9b692d294c38e6c69113dcfab2e93ae71367
SHA512 e575373bd30d07fe487b58a97cb2d1f84b8e3f519630fe36db35d9966aedd50bcc9f3f2741c4a736e81879d323130e0ca14517a3e727ec04d23d714bb71f2af7
SSDEEP 12288:KzRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:KzhnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1896523696668F94BFA3B06B048928111673F0EC5BF91D3CFBB08226D953C3D41EB6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f372cc25dc293a32552b63c264cf4fa9b1f2093758486b189104aaa48ac21758
MD5 32cc59cf85726069959ce44c5bbec293
SHA1 c842cf9d7b5de973a6cbf8be1a53a2e2edaa2a3e
SHA512 c0e0605e9e0384b9f625dcaa4e8f66235ee301270a85f61b842584ea695f0ca6b3ffbcefaa9f1b28d69f16bf151be581272513d1a924359df6667e339cad1a85
SSDEEP 24576:K8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCphnQ/tbw/2Mkjy6Fr7g0o+:7RZwQCyiHiQEaaPnM6Q/lFTjN4
TLSH
T14285BF1E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 4eaabc61980bca4f223753339bf8a0f4fee229914ecd25ff8502a8800d26604f
MD5 6bc4b84738e2176813f12374d85171b6
SHA1 ae04dd4f550e0b94d1baa81b7d46068f7d10545e
SHA512 e0264f6e9b5cc96eb77dd2c9d8680210395b8bcba9090a141b78a5d3389ea153ddb892757352598f44184a200d45c5cada4142867b4a577cd80a9a9ffa5f5092
SSDEEP 12288:JbxA1U7KDRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:JbxA1UGDhnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1E275123E26AC28E6F636917D88D28106D3327C56676193DF2584823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 4b9b68b30778f15e7add880947795477e02125ee37c27c47312addfb9e9a2386
MD5 c83493f947765b45b367918d3ddbde31
SHA1 b3ea138f1ea9521a6018f0eb0cf37b8e82fa76f1
SHA512 011000491b69656290001eaa4a729c03582abd60213bfbe69ce9343321bb49f2283b50f2296a52d14f0010c17e1ea8ecbe9c157ad305d5fd67a1341ba0f66b31
SSDEEP 24576:/jsmP0yHaqrVqHra44KDzMsrnGhnQ/tbw/2Mkjy6Fr7g0oh:/jRP0yHfVqzlAsrn8Q/lFTjN4
TLSH
T11D45AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 742530d6cb32f4348d7ea5a8fc2f600d83e0641bbd0b40f1ea12956c267574b1
MD5 9348c280d5cae4bdb22ebf9ac85f02be
SHA1 83276232669a2d5ba63cd6b17aa8b02a4d5e2de5
SHA512 5d7be6f27b2e29d092eb556e8ef166185e46771712627c8dbb9750b6ffef3b809b7f6f0680c11a07b36429c1d00fc2f59cd46e239ad6a0bb9d00c896ed678d13
SSDEEP 12288:VhRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:VhhnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1656523697654F98BFE2706F548828142673B0EC17FD5A3CF7A482229967D3D40AFB780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 dfa838d7ea3a4faf9eed025d60b85c9ea23bbafa0936e9775ebfecf30d34b913
MD5 59403ee62cf641ce7402afb72b518531
SHA1 892f402c7f72c5b58b782ac247a95a91f9f81890
SHA512 47982ddfd23182c4462e56380ddaa784d3fa9fa37f3c54ca31ae9db2e2cc66c6fd79623bad52b725f1fce12a79a530ccf8ee7b43adbfa04d13214b60366cb372
SSDEEP 12288:5Ob9A4LWO+vAYFTnRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:upLBUTnhnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T18785F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 cb108b51586e3acc26e726f16c26bbe845a9a6562bfc5bb26ea5b929da5360ad
MD5 2962d69141ef9293442223abc4f27ead
SHA1 804de0365df4ab1d0daa8850d44316eee39096c5
SHA512 cfd8e98fa531d81832ee15f7863e8023eeb098cacae3d4f59a69d20f8a9344cf3aace1eb2a93f547d0965180bc82bea07c43a94617cb3c5ffb4b2fa3da54962e
SSDEEP 12288:l70VmvIYNvUyBp4RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:CrYNHKhnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1CE75F12E62AC1CE5E53B91798AC38209F2737896175193CF15A0827E1F37BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 aedd57080ca18b71ba9a8ecc464d3c1b32afd1b6b1605367549741e5a7f74022
MD5 31f05e63ffc6bbe10c6218356400451f
SHA1 57129936241efd3f44e867dfb96488e80d2bea6d
SHA512 4c387cc5ed38714ed7aa866d936a7bf3ad3c4d58a53f78eeb5f3b70059c06a30ea5834e5610d19c3257bbd9235a8d45e5f28ab1fabe8682a68155157eff6369b
SSDEEP 24576:XnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKn:XnXoJJYH84VVS6AmEcJas+cHBjSSKHP/
TLSH
T1A665BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e8cd60f6158f518441980f1823ef387d1e3445a78719d63fb7c159b5700a9f1a
MD5 da68f691e5130542c769cca5cfb4ee00
SHA1 8097ea429dc45df710ccde1e712672e1612cee7a
SHA512 47940e37480683a6dd529acddfc15e02741404f42638b849b3551022430d433e70067c3f0c2203fc1626ce3764dfefe7b44d23731d4461474f13c1f9bb067486
SSDEEP 24576:2v7Xbxd9Tuycf8M/TYlSuxwr2PCQhnQ/tbw/2Mkjy6Fr7g0oF:2DLL9TuJ0M/TYW2PTQ/lFTjN4
TLSH
T127858D5EA3EC52D8E47BD6BD85A39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 0b7759346d7a21ea31b078356ce4964bcad306141b4efc6ba71e51b50ce1990b
MD5 7967939e4cff1ee80a8f23456650eebf
SHA1 efcffc319bf53818a42e690424116a8dd9721cc8
SHA512 0a18a0d3bd5bff008c3d2c9accff9c479a2421f67680b5a377f2dc86ee1fea486bd7f0ef600054133795a7ce71ce22425352a1abb0b87dfcc9f561d07cf9492f
SSDEEP 24576:legJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wnhnQ/tbw/2Mkjy6Fr7g0oC:lngOJOmPOHhhQ/lFTjN4
TLSH
T1BA55BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 c32e39b3c812132f9be4475e9246dae5a7164c7baca4a750f1d5f646866efbc3
MD5 a0d5f60471289d7fabf0665eba62c7dd
SHA1 48790b0f599be1e29bf1c8a6840433b1096957d3
SHA512 8c23f686951d82528f26a6251f8dd470924ee51eef6a71306641ebc56f0df1ef14d12c7d73764ca1931f90218c44af88be1244c17c3e9907e50f1719431d193e
SSDEEP 24576:3LJnJiTk3R3waE4JrOBhnQ/tbw/2Mkjy6Fr7g0oN:3LJnJK8R304lsQ/lFTjN4
TLSH
T15685D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FE06A79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f6951d9f78bbe43578314db88d3d18773ba9ec1681488b975ef5a4481442a46a
MD5 d36775a168f39a551ee66eacbeb9bbe1
SHA1 b1c3fe8a270990c7ca082dbd6620c2bab12d339f
SHA512 95fff4cf9dc1fbf357172b234fd220c6d91bdc840b34a56bceb94636e970b064d1a8450e57c249e4ff212fd32e2270fb7ca66eff5d0eacc6777f24b6b7256030
SSDEEP 24576:oA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6p/hnQ/tbw/2Mkjy6Fr7g0oJ:n9GqCzDScAZmlvTcFg8Ph6fQ/lFTjN4
TLSH
T199955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 0733ca3981169485d6fb495cd46266585d0b927995be3b7bb9d3875edb2c8cdb
MD5 d872f47a02e8132bd6e982068ab7231a
SHA1 aa6b137574851c348ed4812d9b6565952d40fa7c
SHA512 969cddb2c66c2abb2ef12297bbf99d840f6cd6b02ef2cc508f67a958674cfe9bc6ea1e96d74f38f5267d0513d1c63a51797b989846adeba08f3f70f1b26a07fe
SSDEEP 24576:PlYJeXm5jUuE3hnQ/tbw/2Mkjy6Fr7g0oh:PlYJeXmRUuExQ/lFTjN4
TLSH
T1C475126D366CB0E6E22F41B988928545E372B4A1275163EF62D0C17D8F7B7E41E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 1b70a57e95f0980d38ee7bcfebd772756c79a667862eb2e4ee3824343c881030
MD5 7a19717860506204f6b18b9a8dad526c
SHA1 3eb72fe8f5cb9bf3172d43dcdfd0962983f047dd
SHA512 57047d2340b6a04274c15ccc43b825d16f6108e5ecd4913f2acb84945b95abcde25b441e05d8f096589c6e6b6551c54b2b9efffd7ed2fa9eeaecc7f077044c36
SSDEEP 12288:swu6kymRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:sVtymhnQ/tbw/2Mkjy6Fr7g0og
TLSH
T10475121833A4B4D9FA7A06788DA381819F3A7C50AF5093DF66C0E23E5F3A3D46975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 5b365eff33b7e77c9f045cfbb82c04e4b67366d95018a9c6bf2f8f1864e8c134
MD5 a7e4cc1c5370a9ca9451201d1f87927d
SHA1 0bbf97a810a591a418d9dd31a719caf8c6e51e05
SHA512 fbfc4d31d44334c68a6eb6b4cb55f9d3e46de52bbe339c050055db39e341059728a11135a3246c6d5eba35537c1d250ef52ce66602875709b96c780916fe8c58
SSDEEP 12288:3PnRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:fnhnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1EA65236C2624F49BFE2706F448924542A73B1ED17F91A3EF3684A139CB7D3D019B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 dc8cd0270cdcb7908f61a318d30e019464c2c91c68ffcffc0617b1de4ba56e90
MD5 b2d4fafc74d504052cb30db8a0ee735f
SHA1 0ad5fb2cf269dfa78287a53ee8b4721e62010e84
SHA512 7641d4c1f072850b00428bf16cb4f10058abdce6f43ee6fcf638f82fb5779cc17f5972736df2a646567e7085cf4095263c0dcb5533f5b06983f7b2ec72a6c9e3
SSDEEP 24576:qC+TyQIu93VAumZr7jmMhnQ/tbw/2Mkjy6Fr7g0oh:q/TfIq+YSQ/lFTjN4
TLSH
T172558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 0261b82dcd990ac6097babc7a6ebf5093ab181a6f45785d3c6c537a2a46ae704
MD5 d63f6b1ae4a9a932e286bb4c51c73395
SHA1 378f93738803598ab81934131a39efd0f8dedcb6
SHA512 d616de81b55cec7179af3d30da3732cb05c4d49c9c936b8fe252c721e23f079efbdcff0a7318eaac43e9a69b8095ecec267d50a18e0b0d69231efe6ae8ddc654
SSDEEP 12288:GcyrWOstaa3kcsLRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:fLQikZLhnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1C275F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 82c7bccc91bac78e68d4247989600986d1984c4803df4ce4af25dcfa91abf96a
MD5 16413e20fdf941e5def3c32f41e73450
SHA1 ad1b91428d62aa408b91d17a6b8fff7dbf7e27b0
SHA512 1d4424d2d374c0ef0cd896f85c9045b8ad1217e7a9cb3bbca1a07bb2b6672b04ce77a45556b346f7d359bd652febac369215e40d172852b7d3a47f83d01d144f
SSDEEP 49152:VpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPcQ/lFTjN4:2pC7b4+80GTksLm
TLSH
T12AA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3adc8744427f547e42abe6ba62882845ca24c52ad4b81a37dc12ceec391509ba
MD5 4fb8197188374debc21c2e9ccb3c7c18
SHA1 0b636a08a8cb7618269ba1b09603f9c59a122f90
SHA512 de4e5fa2a78ba3949327a4a2937c31b7219833677b230b4381d3499ee033210e5e8448c5ab9dfddb3e23cab58a9f6a79c41bd82dcd609591a5c6d3d69faea972
SSDEEP 24576:dSAwJPE1IDAo+4Kt+l44135UQehnQ/tbw/2Mkjy6Fr7g0o3:dqPCIo4Kol4/Q0Q/lFTjN4
TLSH
T19755B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 d0238772c3dfe4617bcf25f62e307af31cc15975902a0136a0330ecfc52cd0f5
MD5 548d358781d416632ed49a059a6d0719
SHA1 513695cf9d2a1af16ed1a8930946551f885758b8
SHA512 c97ac4894a6104dc0213570b6a8bb08650cb5809b8d1fe729b942f16b9b93e5c27687056ff48096b0f1468be4c555258ff80398ec2484644e937ac09520b5ccc
SSDEEP 24576:RyLXPLcM94tuhnQ/tbw/2Mkjy6Fr7g0o5:Ry7PoLtEQ/lFTjN4
TLSH
T15085E03EE66C08E5E53AC27CC6A38506F672389D037166CB1A9491791F7BFF46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 ec3f9af8542d40465247ccea580b720024024c5b5f117170539723dab7ac01ae
MD5 ccba29bc09179bd797cc16d6eb52058e
SHA1 b8217c803301f98e884cc74da3ac51a666b3b673
SHA512 18d0841b79625c07c7cb3d0017b9bb0aecefea37ee77312c2c5c0dce25ab8c5decade26a7530b24495dc9ef3ea7249cdd52b1dfdac011d027124d5928498b034
SSDEEP 12288:y9lyvj3IkxjbBz7RGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:yWv8qjp7hnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1D175136D26A4B4D9F53A0274D863811692767CB227A4ABEF36C8D57E4B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/900-167-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/900-109-0x0000000140000000-0x000000014023F000-memory.dmp

Download

memory/1500-147-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/1500-368-0x0000000140000000-0x000000014028C000-memory.dmp

Download

memory/1800-155-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1800-369-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2516-16-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2516-22-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2516-25-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/2516-114-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/3368-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3368-42-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3368-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3368-61-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3452-0-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/3452-104-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/3452-6-0x00000000025D0000-0x0000000002636000-memory.dmp

Download

memory/3452-7-0x00000000025D0000-0x0000000002636000-memory.dmp

Download

memory/3900-71-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3900-80-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/3900-77-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4020-115-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4020-371-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4020-178-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4348-67-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4348-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4416-139-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4416-347-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/4416-133-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4416-142-0x0000000140000000-0x00000001402AB000-memory.dmp

Download

memory/4564-159-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4564-370-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4684-97-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/4684-162-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/4684-105-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/4684-103-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/4744-154-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4744-150-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5176-92-0x0000000140000000-0x0000000140273000-memory.dmp

Download

memory/5176-89-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5176-158-0x0000000140000000-0x0000000140273000-memory.dmp

Download

memory/5176-83-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/5192-163-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5192-372-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5264-176-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5264-186-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5264-170-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5264-377-0x000000000B9F0000-0x000000000B9F8000-memory.dmp

Download

memory/5264-179-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5264-374-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5264-202-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5264-218-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5304-58-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5304-65-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/5304-52-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5304-63-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5308-126-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5308-279-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5308-128-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5308-120-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5404-145-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5404-31-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5404-37-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5404-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5596-373-0x0000000140000000-0x000000014026B000-memory.dmp

Download

memory/5596-168-0x0000000140000000-0x000000014026B000-memory.dmp

Download

memory/5904-81-0x0000000140000000-0x0000000140263000-memory.dmp

Download

memory/5944-12-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/5944-113-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/6068-223-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/6068-117-0x0000000140000000-0x0000000140241000-memory.dmp

Download