86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
Size 4.1MB
Sample260508-h4k8msd16w
SHA256 86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3
MD5 81bc9d858514af2841badd13f2029374
SHA1 9cba131ff2fd48b7bee90371fe1e60f1772e89d4
SHA512 f5731c3ef41f92a43e2d96fb9bbac1647e93f2d2a7f0805beefd6070c073f7824b02323e62b3a4f0f8f903ca9eaa3a032ef363b01b3b66f51f59b36a2c780476
SSDEEP 98304:0vDO3/gUrNLt00F8vaKTXASc9DgdXBQucmDDWGoZqnc:04rD0TdTXASaAbxDytq
TLSH
T16F160111B5419537FC7301328ABDD62EF128BD51077828D763C83A2E8B75ED12E3E95A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2604	alg.exe
3300	DiagnosticsHub.StandardCollector.Service.exe
3424	fxssvc.exe
3816	elevation_service.exe
4136	elevation_service.exe
860	maintenanceservice.exe
3464	msdtc.exe
4980	OSE.EXE
1544	PerceptionSimulationService.exe
2300	perfhost.exe
4408	locator.exe
1776	SensorDataService.exe
2464	snmptrap.exe
3192	spectrum.exe
1488	ssh-agent.exe
2092	TieringEngineService.exe
2944	AgentService.exe
1096	vds.exe
3324	vssvc.exe
5536	wbengine.exe
5676	WmiApSrv.exe
4044	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\system32\spectrum.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\System32\msdtc.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\system32\vssvc.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\811e7a8b8b62accd.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\system32\AgentService.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\system32\locator.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\System32\alg.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\java.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fbe558cbbadedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f5c6ecbbadedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2115dc9badedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e84d39c9badedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5ed17c9badedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072ae5ac9badedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
Token: SeDebugPrivilege	1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
Token: SeAuditPrivilege	3424	fxssvc.exe
Token: SeRestorePrivilege	2092	TieringEngineService.exe
Token: SeManageVolumePrivilege	2092	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2944	AgentService.exe
Token: SeBackupPrivilege	3324	vssvc.exe
Token: SeRestorePrivilege	3324	vssvc.exe
Token: SeAuditPrivilege	3324	vssvc.exe
Token: SeBackupPrivilege	5536	wbengine.exe
Token: SeRestorePrivilege	5536	wbengine.exe
Token: SeSecurityPrivilege	5536	wbengine.exe
Token: 33	4044	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4044	SearchIndexer.exe
Token: SeDebugPrivilege	1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
Token: SeDebugPrivilege	1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
Token: SeDebugPrivilege	1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
Token: SeDebugPrivilege	1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
Token: SeDebugPrivilege	1076	86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
Token: SeDebugPrivilege	2604	alg.exe
Token: SeDebugPrivilege	2604	alg.exe
Token: SeDebugPrivilege	2604	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 560	4044	SearchIndexer.exe	104
PID 4044 wrote to memory of 5804	4044	SearchIndexer.exe	105
PID 4044 wrote to memory of 4888	4044	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe
"C:\Users\Admin\AppData\Local\Temp\86c1329dfbb6d7354929890107dcb758219e1bab678fd40dfc26b3bee46b8af3.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3300

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4012

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4136

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:860

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4980

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2300

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4408

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1776

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2464

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3192

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1488

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1780

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1096

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5536

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5676

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:560
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 944 1664 1668 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5804
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 944 1868 1648 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 01b2455ba25d85242547d4245d9958ffeddf66812d80400c9def374b9a5fa9a6
MD5 18b2538cabe545e986e6cc5738615433
SHA1 1cd82099ded7eb8ea146901275829d5237a83ece
SHA512 94d149d3e3a03519e72145e7754960fd0c362cbea70cc3f4afbfa00d160bfbe1fa01dae9b49e23617f21b2698ccc0053a148df4b41536badd4e33777b384ba96
SSDEEP 49152:ub+632BuPkFKRrdE6ohrstBhuXjfS4LWxnbDFwwdoZYjnc:w3q60jBYDWGoZqnc
TLSH
T126D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4db75473302aff0826a28d588537e2132a486380565ec74dedbd15e8d6a9a71a
MD5 cea664c2a80010bd4bdd3b7f29757733
SHA1 d3fb7a286e1ad736ca3802e6629c08d695e5a367
SHA512 908411727f72e49c47596803b587957aa4b74ef736595fc690c047e11a40dcd7355ab6f10ee4611a32b9afda3bee3d3f80394f348bedee948773ea01ce7c520e
SSDEEP 24576:IXYfDtczA7oCRtKKsFfYwGlgoZYnje0tWXLB:ftcNDFwwdoZYjnc
TLSH
T1D905F12863E508FDDD678179C8B28512F672BC5583A0E7DB03A49A661F333C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 fa64a30beb6a5f5ce500087c88402ef7c85f32d35edaf5afe949cbd9e03863ef
MD5 844afea4330a1857d85bfa15cca9f8fb
SHA1 381a62f67c4988ef998a98ed352a6358dd0b9d1c
SHA512 f5e21510b120f1ff7bf1cfc82ca84dc7557c17b34242bc8399026eb81130ec5f5b1feb10f125e1fa4faed7bc08c9b239738a2584920e2a51fda97dfd762a5abc
SSDEEP 24576:B0Le5ji0hmxNrMGoCRtKKsFfYwGlgoZYnje0tWXLP:BPji0A7yDFwwdoZYjnc
TLSH
T1ED359E26F6748335D073C0B9C5D2A69EE971308657308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8e9e28d6a41acfdab6225a66f33d73cdc018c8c334f9019f5d78b6fd2fa7bef7
MD5 a8d1335f3b953818efd513e20f638b37
SHA1 a0f4fa60632ada83d8f5b7d1bf9bd2f0ee520cb2
SHA512 98f03f63cb85e6836bfb1963b092f9f34b8f95eab1d51e28eca6eee5a43648296fc39463cf8efabf49054b77f10135f57b440f28ba5e59bc69ea7a2a98b9431a
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWr6q8wyuUoCRtKKsFfYwGlgoZYnje0tWXLi:Z/ezSC6vUzPviHjyODFwwdoZYjnc
TLSH
T111755C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2c726e009fce4aa45006a9c200e6a108e6d73a186e1d1d1ab6a9de90c31aec87
MD5 c588773d019bba868ffeb6c314229443
SHA1 fc8d6788e0926a8ef5481e9d0e1d079037bb87c0
SHA512 3067348379372627600bff45f7dfbc7c41ada523634969244bdcf3cfbaa6b2dcb493d34df5a1ab25dc2ad77598186a1f3f764bb8852a0046630c273ef56ada3e
SSDEEP 24576:nVbqPb88hv/l+b3oCRtKKsFfYwGlgoZYnje0tWXLc:nVO88hXl+cDFwwdoZYjnc
TLSH
T16B559E65F6748335D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f518427f49e43834518c5a3bf202a4d2661b124f80f3832cbf12feb306e398fb
MD5 577c3044118bd50ee07fd2dec13b0648
SHA1 4b56b1e2b97e8d3c9e8914c35a2e1ef587d4c68c
SHA512 454c750c229a676c42463a58c8296239c3390376216126b90532e839686ab372e7e4bafede7b7bc62b05ee97ed9dd9660983cacaf4fc095c0155a768aa52a9da
SSDEEP 12288:2jCojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkb8:2jCoCRtKKsFfYwGlgoZYnje0tWXL+
TLSH
T1F1C4232097AA80CEC73E20B2D9B90756F4FCDEA9E18024930366B7D329B46C5CF5F525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 47f332945409490183e6e2e74d2dd209e67baff0b277aa302f24d1b34040e2ef
MD5 12a5ed8787e30ef806544303b8651d60
SHA1 f8aeef9a0dc12e0f6c51987a35004640d43b4fb2
SHA512 d8523bf3756fccb9b3888ea83694e1d88eaab064508bb91b9fa367fdcabf36f915cff70dba660df130a265cf94b0ed6aed8a24d7b08f2ee83c3fa35ea7298714
SSDEEP 12288:+eBNUbTVO86U/ojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkX:+JIU/oCRtKKsFfYwGlgoZYnje0tWXLd
TLSH
T11605CF3BEE28FCD2C27E4DB95A918700E77278708B51A3CBD165834E9E235D14E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 aa738c7b368a4179c706bb60a67e3ce14881d6dea1b6e64b004cabc736c03a7a
MD5 9dd78f08b40ee90ec8e65451debad8b2
SHA1 930a7dd3affd29710f487e96e19a371abac30361
SHA512 fde4940983d1a9f69c1c8012c295274627737e421f89294dcf3a606f29d853385836257e6f9f30c3bf6f78468d263966d137116941f76bb0df158eedfc95f341
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THb:yQvGAdlCEL8c/RRNw5CtDWGoZqnc
TLSH
T17A266C656BF880F5E0B7E174897A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e36207637ede9caeeebf8af3553ba9ef3501dbd421e75f9145363b593f3ccf1d
MD5 57a75b06338d42ea487c634b6e6a50c8
SHA1 ffefe3552cf6879edadc3dff40fad2cfee221462
SHA512 561218a571c56ecb0aa72dcfd7c713bfca6b6893c17f2874526963c633ae1fc2ec72c1af71546788360a455b07c0891a1b24c7004841f53af76fadac9b40cb02
SSDEEP 24576:nSewsAj9oCRtKKsFfYwGlgoZYnje0tWXLi:SljCDFwwdoZYjnc
TLSH
T18115E030FA75D036C37F0DB21B36C716647CBA608B5119C3E3A89E9E19702D2677AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 19adb5d9d9129a9847d58fd5de1f891ddfec98e675016fdd5d892be858b2730c
MD5 d65d9078f10367264050006737f573a8
SHA1 85e2a52b9124382048deb55dc1925d4f853afdc1
SHA512 50d3269761bd461ef8cb65eadae10884a1ca38e38385c7ae6c6f0b3363aaa93907d73e2c57384a235a4d479f91b380934acfa73b619aeadb4f4e47a1ec70f26e
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH6ytq:YUEtQevvqc2W1cpV2RI326
TLSH
T1D4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 891bda20c3db6c8bff60df8e85ed064a4e52072a5ebd5f10dc6e85806827fb40
MD5 1f5b8ab950051a55dbebdfb7e737ad00
SHA1 afffb8aecfa0fed21ecadfcdfa8fab4d82fbf184
SHA512 3af19651ebe2d53312c8d33f6a8eba4226249b6cf8c0e250eea8983c6fecfa5f927b078a37ea6e18af547d19ef1dc393d230ae0628cc5f62bb3e753e00fcdeda
SSDEEP 49152:vCbRquA/m2yL5zifFiV+XenmE3/ziDFwwdoZYjnc:ooqHVjnmZDWGoZqnc
TLSH
T1B1D58D1976B8C1E4D1F6C77886A2C647F37178158B30A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2bdee286069f2de41ff6d13a2fa1cfbd3ff6e2bc9639c4188b505959ab2efa5c
MD5 2c2d246288dbe47f6e04ae76ffd3cec8
SHA1 6bd7ddf5902c2e1ec6f682addf44b5a266fa9221
SHA512 12ffd62be4eaeb5e2bc764cf402700ba0b492f436b0d28ccbda704a450ec3ae4a4d034644824802de3290e1e4571c89339e8e6f20d0a8f410c32c6f564626fc9
SSDEEP 24576:hAhGL2IFoiwtA5l7S534oCRtKKsFfYwGlgoZYnje0tWXLe:hAM1Foiq5pDFwwdoZYjnc
TLSH
T133359E80E7F955D4F5B3AAB899B68171EA76BCAA5E30D20F1160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2b82cc4f478a20075f2f127219abda8ec3cc5c1a3eecb30e4026a8ee45b7f47a
MD5 81fe1b9218c947024b82e40aaefc246e
SHA1 d7abc366cf1cfcf223da0eb67b8d90477aac5409
SHA512 e72432a37d32fa65951fb34b4acbf178eb4648c0b689730284984376c90de3fdcb6e9936c210c5bce11716d134f029e4001ea067473d1a6a825f5b56d9501223
SSDEEP 24576:RwuXOWhoCRtKKsFfYwGlgoZYnje0tWXLz:RwsOlDFwwdoZYjnc
TLSH
T1E105F04577A50CFDEA679139C5A78236F7F2BC162620971F0360C65B2F37251AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 dcf138801c7b6807b74960746efaafd336e7836933b9eb6db12163d01a454dbe
MD5 7b8ab5494adc0446877d33898b98dda8
SHA1 40530c659efbb5edf184843b089f27c18b90b859
SHA512 f2c04ceead3458fb515274cd6a427f069e53f37d53f2fbcb50aff3ccee50b6eecff1d469cd668f6faab2596b3cdfd49c4a256318ed138c124ffe01a6ae0144ca
SSDEEP 12288:j/Z1IyNojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkb3:rZuuoCRtKKsFfYwGlgoZYnje0tWXLx
TLSH
T1F0E4125923E460FED2675179C9F14606F7B1B8A6A37003CF022562A72F72AC58E3E731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f1b36004e78aa926f901acc9217fd97025f2a4489bdead366fd4374ec3f7df76
MD5 ad734e987cafc3db11cd922dc9cd8cda
SHA1 45aa512b1df641349261d140728f740d6dab3739
SHA512 f41a43bd51fe5ec536482278aef8d1d5ce2609c68879d9c3fce0d179e13b56679b3e082e569958972d3f8556e5dc7c8e10d5d75b8f277ed091743ed7bbc13e30
SSDEEP 98304:8QRQyi36YOcPhLvw2gAf+PN3sDWGoZqnc:jQyiKahX+PNcytq
TLSH
T1DA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 74365457f5415ebaa1f396a0bc304e1a25fee9c510b8966fab23f7a94d854d4b
MD5 2f9e04f830407a5707eed1ceaa4ed0fa
SHA1 ae89c557b5039e08165a50f47b74f6ad79d76e54
SHA512 c520c7d52001903fb5690e614fce480cce357281b4c91bc5a36a9d79fbf6dad0802ff470c9469a4b838190aa3e8d868a345260515bc9cfc981f170c348c2f7ff
SSDEEP 98304:7QRQyi36YOcPhLvw2gAf+PN3sDWGoZqnc:KQyiKahX+PNcytq
TLSH
T1DF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6920f72c390900e071be2e41f16a16635bba04f2f34aebecf0bfd63b9c6b2974
MD5 c5c3dd2170e54e87bdd1f1d84759175a
SHA1 c134d80345e6a4697987a28dbca4af4d59bec02e
SHA512 768285490d1e5c3305b7791a0c288fbe6742063da36f4d1eaa619a30a421c0c910e0a5d72a88f4016cbd4e041962a856aba001c3b92cca2638bb071090b94422
SSDEEP 24576:HwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0eoCRtKKsFfYwGlO:v68Qg55nhceWu7PNU3/yDFwwdoZYjnc
TLSH
T1E6B54933B2F600A9C45DE1769F4A872196E17C75CFE0E3DB811172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 43992ebbb7fd9c65b48fc605372758a8109d64508b253d3d042aecd3cf30deab
MD5 426d93e0054618167eb42f42e49fa169
SHA1 137bb13a5f10f24e7abf443a35010119ad2be3b3
SHA512 e051fb76226ac22ebc5447e6fa8f4889c8cf37f36c63637e8025f8222c0ee21032c10e8dff2da0069b6cf91a36c591377b53b70a75fe6e349359cfc0da92913a
SSDEEP 98304:iy5112gYy5azzVva69nLKnhZHDWGoZqnc:rLIHjWhxytq
TLSH
T145167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 51a651766c11567b7a8073aa119a3a0ece0b2a8cd5a09b2204daf3443bbc9895
MD5 ade0c5ddcfc6303b61493ace311a952c
SHA1 719fe9a8730feda8d84955cd0514c09efa744464
SHA512 1686de76ebfc3c5eae214e08425f75e9e0f38855f691a1768090e8fbac708f3de189d9ead5e43465edd7e37ddf1bd591cd2e6b1dbf4ccb297ded8157b5f93317
SSDEEP 49152:8B+taZ3usBWOBr4tEG20bqx0z+n217aau1glUDFwwdoZYjnc:Wu6JmUxd2dUDWGoZqnc
TLSH
T113D59D13F1DA01E8D06ED478974A9233FA62BC494B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 29d063127618b3ce431913a882f6649485e6c4ddb906f607031ca5f50c6b2699
MD5 d26cadbb1368dbe52e6493d50c5b3b0e
SHA1 818d01bd0e626a4f4c6a201d72bf4cc784508690
SHA512 6584419aca93e87716d0eaf2f1cb00c7708a7d6c7f144ce49481ad3a021a45335025429e25096aac5618725837bc5bc4804ba3943a18207494f61e06efdf76c8
SSDEEP 49152:B1hpsNoJpF1A6BU44CwH7R4xwDFwwdoZYjnc:BmifPkRZDWGoZqnc
TLSH
T130B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0ce5c627e771372075e05b6c364cbb9dd5dac83d333aa9b0a203628d4bb0517e
MD5 13b5bf1839c06cb29b13daad0ac99bee
SHA1 04bf8e8dce7b6f140f5795d6c546ef63c043570c
SHA512 aae1272b52fb9fc9bcf0d8d5398a7e788c58e21d5ac53511bacf20fdb289ccff6a3af6f660e23914f9477579eeb19c6842f3c69e1302fad6e7f863496ecb8f19
SSDEEP 49152:zSuZQIY0Be2KNRVtOnks6NMHqrDFwwdoZYjnc:x5dKvi61rDWGoZqnc
TLSH
T18AC5BE13F2E940E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f6bc2c51a6f28e6908ae87e4be01a74e6cb1df4a0d400a4f639f80ad3ecd45c7
MD5 8c0375d377eb4dd87526e8fde6d02c8e
SHA1 c3173b9c72179d70100d842c5959e17ed9bc182d
SHA512 ed97985ed6a4a1c2b0781641d0a2ddbe8deeff526d1895631827e29a4865b6e7a66a11590785eca4aba08787bbb6a7c23e5b5f1f2189c80ffc6fa55add1c7c2f
SSDEEP 49152:mhtSn8EApI0figXgiDn0AP5wkDFwwdoZYjnc:nX2iyphFDWGoZqnc
TLSH
T18E95BE13F2D900E8D06ED179C7568632E962BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 2925b3ebd3990ad543c640a0070f3a3c0211112a8962ba64200734659704d058
MD5 e195c27985e57d60cbf30c460243ca34
SHA1 eb47ee9952fbac2cbd733e79407dc7162861ee48
SHA512 cdae12516b7e63d9fbe8e22ff99da676b6cb380319e9d6318a396531dc2e3a0fa241340d2f6f9c592661905b6b858e300c0c2994f37ac472cb5eee00b03bb558
SSDEEP 12288:CKojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkb4:CKoCRtKKsFfYwGlgoZYnje0tWXLK
TLSH
T1AEC4232497AB81CFC73950F3C9750356F4ECAEAAF2801097131BB2932AB56C58F5E578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8e5885c1cb42b63784abe43209f6d1da226905cb20d64a90b7a4b27d4b5a2663
MD5 a5eed45d5e15cdd0727ef2a2cdcffe45
SHA1 9c85471a120105058923ac1e1f045b647cedec7b
SHA512 99c299e00cae87469aab3360c4a41a9217484ff8a0d744196827eee9b111ca9b9b31f47dc3b8f2ad6b6b80c87417ac3c954984e4db10476a832a969fdce09116
SSDEEP 12288:kZojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkbE:kZoCRtKKsFfYwGlgoZYnje0tWXLm
TLSH
T12CC4232497AB81CFC73950F3C9750356F4BCAEAAF2801097135AB2933AB56C58F1E578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3f089628887a740365fc08354f9c559a4b39a4b0001803e60c3367353472c5b6
MD5 ab31ac91e6632bc58819451366a5f8ed
SHA1 773fcc69c538f60fd37d2acec665bec6a4d96cbe
SHA512 1c0f787001e90cf864b6c4597f3f143f57562855c1dba7472af3f071da52161a488944f1920d8462c8913f736e32d41eed24c8ade3c338f14c2482cca040ef05
SSDEEP 12288:vnojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkbE:vnoCRtKKsFfYwGlgoZYnje0tWXLm
TLSH
T1B7C4232497AB81CFC73950B3C9750356F4BCAEAAF28010971357B2933AB56C58F1E578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 66112b7bc510819e81b6756b74566afe434ef109b17b6c4d1bdf461de283eb0f
MD5 c30bf49028873160a15f3d4932714667
SHA1 1fe4a04f4a559049fc7342df7dc3e3803b442693
SHA512 d32965ca9a28f35d692fbe68f2965c916af5c080122dfac3d76e0b38e51aedf0df2ed9083879dc7e7b873775e6c8eb46fdb0322132bd26fd7208a3c9882db71b
SSDEEP 12288:+VYojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkbJ:NoCRtKKsFfYwGlgoZYnje0tWXLX
TLSH
T1C5D4232467AA41CEC63A91B6C9754356F1F8BDAAE36012DF031276931E717C48F3DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 216f4c6630addf8c3871af875693e05eb891e27a8b3155d5d9173926f52fd00c
MD5 6132d3c519ba716e1a57ec5ef48c096a
SHA1 db0eddfb0f05985440e491ffc6dd8f7eec1d3ec9
SHA512 3188ad85f3f7272ea23c3e62830eb635ec8604e69cf8f12cd8a4597afc00d658c3bd7067ba5983690b86d66e61e6b24c7e660bfba5b3a8774aa73b680ccb2be2
SSDEEP 12288:qwojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkb3:qwoCRtKKsFfYwGlgoZYnje0tWXL5
TLSH
T181C4232497AB81CFC73950B3C9750356F4FCAEAAF28010971357B2932AB56C58F1E578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6ad17c1ab76cb5d74ed200df586facbb5df17ca43b7a7fbbcf540c97e9c3079d
MD5 9a75585382c1725509301959c1461c7b
SHA1 a312139976bf90c1f42d0aed35f15cc402bac158
SHA512 3c30f7742aabca22dca50d17782e5bdf1d32462a5b2fe061466ed76d808ede7e7ead1ba8d826273d72c71eef499864b371410e89ef75a3019adebc130fa16a0b
SSDEEP 12288:/lojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkb3:/loCRtKKsFfYwGlgoZYnje0tWXL5
TLSH
T1E6C4232497AB81CFC73950B3C9750396F4BCAEAEF28010971316B2933AB56C58F1E578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 77d8d24f7c6e600ebe656e1d00835573e013b67897c81a457b515aeef4209b25
MD5 70d3d8152d6768bd6e9c55c3f5d0801d
SHA1 0830220be33d7fbdad3789fea6c0625e7dc468d9
SHA512 051335de98003659fccef8b07b5065bb43c8adc2e4ea94e630714a5d386b0cdb42370be2550be0250aeaf5faecc44fc1e9127951f27fbad2da4f6dbb9b57c7a0
SSDEEP 12288:XRojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkbW:XRoCRtKKsFfYwGlgoZYnje0tWXLc
TLSH
T1A7C4232497A781CFC73950F3C9754356F4ACAEAEF2801097132AB2933AB56858F1E578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 24a42be69faa49431d01f30ef9392582a4237e38d51ad868d0d5f572cb326421
MD5 4ed0c7b9a1238d39b84e590cfc79f7a4
SHA1 1590a3d788ac4daebcbddaa19399c6b1160b84f6
SHA512 c5e9e65edc9bbdba21c39636d648b985597118f0106ececaf52b85c65e22d25ecc3aa6f934c98d90c527dab73b64cd8287de69e7d5f7c9b7db3c4f6824670837
SSDEEP 24576:xZMMzFVSO5oCRtKKsFfYwGlgoZYnje0tWXL7:xZMMzfaDFwwdoZYjnc
TLSH
T12B0501A4B39008F9DD67813ECD658906E6B2BC6A47A0C65F03B436671F733910D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 4022bbe993adfad972c000eb0ac935a2323fa7c62f73473c425811741e0dd6f6
MD5 e049194265a20aedf3c82a5d16a963e2
SHA1 1e43618e4cefcc46703cba3a09b1ecae1d9620ca
SHA512 ab13023948783cfbd17791425d4fa74313252f806aa26a5771272eff9c19dfc0f7051dfd85734e6087f1067fed9c3ff34224f630eb3ba2a86edf7c5f14dc0f8a
SSDEEP 12288:x+ojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkb/:x+oCRtKKsFfYwGlgoZYnje0tWXLl
TLSH
T118C4232497AB81CEC73910B7C9750356F4BCAEAEF2801097135BB2933AB56C58F1E578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 1626ecb1dea57b313d9c1598577508fd6e5c45c61731d766032844167f24b0b7
MD5 4b9fe83ac2affad0bbdee3889c46c540
SHA1 e5d3e1dacc0573e9d88f7781c80504d31a242144
SHA512 0350c43fd2220d20cee858dc44f5f0a50f744b86dd540f8ed895fe48c21b7be5a0602eb967db40e49f8ed2b745b11205e41c12ce97d6b5443a592fc84d8ce23b
SSDEEP 12288:QSojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkbP:QSoCRtKKsFfYwGlgoZYnje0tWXLd
TLSH
T111C4232497AB81CFC73910B2C9754356F4BCAFAEF2801197131AB2933AB56C58F1E578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 6235ac40c26920da9328de9e29c89791c08d4d959e1873623c7f482dfcd3674a
MD5 ef5c11a41eed55c28737cf3ad6475d7d
SHA1 db7291dad5bdd78abb44808a0c8b20152c8add1c
SHA512 814b4ada4e7134310140625cfda5b6d88d268ff91286b3abdca127c5012d971fac22f0c8350b2c47261a45216d4ff5e4bd4248f76124ef13ad68161b5b6927d6
SSDEEP 12288:iyPz5L8NojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkbF:/zyNoCRtKKsFfYwGlgoZYnje0tWXLH
TLSH
T1D7F4011773A620FDD1369175C8A20A02F7B5B87697605AAF136457B72E336D08E3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 cccaba30eb78239e7b2baf6c088cecd45a6ffdd9330c85ae1daf6a9cbe649c29
MD5 3e38bdbb6f90bc84a58acb7aeab30552
SHA1 008d699bf8b6a6f00018032356d631c63dc22149
SHA512 7931370d4a7edf2325aca22c2b601f04017caf4509b8c84f4a30282c824f31a9c3dc709a9440c7c1c18277c7084be5775cbde989139f69938ffb86e802f682d6
SSDEEP 12288:P+ojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkbE:P+oCRtKKsFfYwGlgoZYnje0tWXL+
TLSH
T16FC4232497A781CEC73910B7C9750396F4ACAEAEF2801097135BB2933AB56C58F1E578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 139ca68b95e0765b443651f61bd0e5101a656bbb93a559ba3382d3682ae57173
MD5 9c37d2f9e1ff0fc628e10c16be8ebdbe
SHA1 5899e2d6f07b5a33d555592fb95899f08c1bb2ad
SHA512 f3860a274754dc4e41f275a58c3f77408c5a5d76aabcd6913c748242fedb1e56b536ee00bff7aff60c4d1829ecfa7f2bb663e4a2f2536bafc5fd47f8d2d52710
SSDEEP 12288:U+ojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkbE:U+oCRtKKsFfYwGlgoZYnje0tWXL+
TLSH
T1D8C4232497AB81CEC73910B7C9750356F4ACAEAEF2801097135BB2933AB56C58F1E578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ff2b1a70e24067b763af95b317b5d9f6acaa937bc9ce129a3c3059ac2109dcfe
MD5 51cd763685aec16eb4281e32b5876734
SHA1 62de4426c4802451cd5e6b34230c03d61505089b
SHA512 c49a9e8284c1fe75c1b3a3bf126555f0ffb806dade6bf0a9a65a406b5d926a6a4ed1ab51d774788509c761b55794df1bdae5c8f86617755f1a4ef8d7439ac345
SSDEEP 24576:3CUMpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAzoCRtKKsFfYwGlgoZYnje0tx:3CUEPTY+8Wg2lIL8lrIUJLWwRDFwwdo/
TLSH
T1A765BE1DA3EC089AD0BB81358A518A16FB727C2E1B2196CF1160C37D2F67ED55E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 17b5144d593777b72eebababee31ee244e49d31b45771d3b32ce3e7edd63518a
MD5 13149aaa9dd9d94f6cb54f9b210e18ff
SHA1 8470f70e08da8f028bfc6295470eece5b585acc7
SHA512 e1333cef5459bf8318437d7b91b5209d1c0338ac1e9dc464d788d213873906bf8d4a693a5fc6cac0a27e8473e1f2468f50bdb3fdb8286996b328d612f8c560fb
SSDEEP 12288:yGsfuojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkby:uuoCRtKKsFfYwGlgoZYnje0tWXLw
TLSH
T105E4F019D29802E9C06E6176CB664641F3777C6993E093CB13D0F67E1F766808EEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 657435c6021b0a20e9552184e44e23e74121356efadbc7d8b660566552c88cf1
MD5 1e7aa4aa3a08bcd9cf2c4be167902b41
SHA1 95e0895ec47e05548f44e9a04058680bd586092a
SHA512 caad867e9e1cac59b5d1ade5628ac033020c93c7dc9413b014e0db9cb803947c291553a08cbab170feb6d7d99f137cf2396aa531f425db5757ed755caf87ca33
SSDEEP 12288:kHojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkbD:kHoCRtKKsFfYwGlgoZYnje0tWXLB
TLSH
T1CED42320939E858EC63E61B289794325F1ACFEB9E34010D7521673D33974AC5CF3EA29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1c2e93ac6083d47d1d52550a4971cfc50ed9c0469bbfdeeebd317c015ebfac19
MD5 f5f6aa8fdf722092dd7e7ed8ee272e40
SHA1 1f98f5bea3f992b7a7b162fc2d9d357a825a779f
SHA512 3752161678640ab0d14911442163667ca1d5a4854a9022486ac638d50d9e46728d72c060c76e9781fa863c494485a2913991ad4692787db1d1925bce684be05f
SSDEEP 24576:W8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCdoCRtKKsFfYwGlgoZYnje0tWXLd:vRZwQCyiHiQEaiPnMjDFwwdoZYjnc
TLSH
T14D85B01D63DC42A5E0BAD278CDA74407E6B27816573197CF0291C27E1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 c5dff6c77cd98ba9e2b86c9cea30986df5100fe959ac25da8d55318993a19e10
MD5 d89bc945d6c52990d344dc6577c94e2c
SHA1 1e4fed2da99d45cbc69987c4ac351070b879d5b1
SHA512 6591a07299a7acf3edbc861d5e60966c4e194fcf7074e22732137b20a81638ab69e6bf955d0af1e4c2e541f0221bdb0240d17106c051205fe4960a4cff67778b
SSDEEP 12288:2bxA1U7KXojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkbm:2bxA1UGXoCRtKKsFfYwGlgoZYnje0tWw
TLSH
T1E1E4122D53AD14E9E276A07AC9A18206F371BC2AA32053DF1191D27B1F37ED48D3AF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 eba00727d5464a3581118d7288e289b230ccdd8ebc731075255d89638504c4c3
MD5 1ce69d3a49525edc759823f454fe9ee8
SHA1 d44c9a5a38cb8256b2e0e80ade2eb69538617405
SHA512 6f76c854fbbf637eee343960fe57ff18ea46cd6082573a4a6739170d62c5892b4c534e0d47d5bdadc918ab925f73d3b03c472d1da55d60121be44dcce0e55a47
SSDEEP 24576:hjsmP0yHaqrVqHra44KDzMsrnooCRtKKsFfYwGlgoZYnje0tWXL4:hjRP0yHfVqzlAsrnpDFwwdoZYjnc
TLSH
T1DB45AE2EF2B910ADD4AAD136454107B5FB71B82D1F209AC70170C635AF0AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 a1bbebe538bfdfbd3f1e4f347688ea907abd5fe6da5789ddbabf8cdb5cb060d1
MD5 4825b476f7dac332ea4b937a2f340d6d
SHA1 aec5fa627db8c6cf1783bb756df2bd4005922782
SHA512 ea1fb4ba64bb4082dc60748524340c7ebac980c48156aaa61774ccbb0cbcf0a80c79832d359faa22b978c11aaabb42cb3a7fca74058497d21ccab518c256090d
SSDEEP 12288:GFojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkb1:GFoCRtKKsFfYwGlgoZYnje0tWXL3
TLSH
T11CD42324939B85CEC73A50F6C9754356F0BCAF69E39011D31226B2D32AB56CA8F3F524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 acd63571d20f4a6ad20d57d9003e8aa736a67daf914f1e6b598ebc417dbd8aa2
MD5 eb08df2df3bbff798364f5a66db18881
SHA1 61e6eb636593912c0feb7cc421260c6fe46366ff
SHA512 58845bd7d1805c12dae0f78a074d9f0b1a0e0c97c2c7e34e4c16aaf253713e04c80f5086093662bd84d46b577661d2845a85e314d07e66f4a23cda3b5b60924e
SSDEEP 24576:QrLBUT7oCRtKKsFfYwGlgoZYnje0tWXLX:QrLBUQDFwwdoZYjnc
TLSH
T19325F114E7A500F9D97B913DC9B28616E2B2B85D0364E7DF03684B661F637E14E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 020fd8d083930f47a59f493786643661f8597dbd0d2e937e2872138591882f18
MD5 df425970de72af07dce4f5e725ff5ca3
SHA1 5abefac31be57811e891ed4d90a8e582fcef65a9
SHA512 9ca2b50e764f2979cdceeb6b42b64c1b8eb18853a64b239dd4a699f4b31ed2b1d6353d2230789f10366f1029e4937482c2d45e97071e156b927c66a874190a86
SSDEEP 24576:S2YNHsoCRtKKsFfYwGlgoZYnje0tWXLP:S2YtVDFwwdoZYjnc
TLSH
T18305F12E52AD08E9D53BA17ACAD28209F2727866535152CF01B0C27B1F17EE8BD3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f459bf9a8b11a09e5be685f6c24cc9775dbfd8f117b7d2498c00ca9d5895d4bc
MD5 0cb4793335d4e6d1de785ec6bc145da1
SHA1 bf63c42404a7c222701c993aaf0712d9e785a90f
SHA512 19b1f4c3594964c0354a2583a68b900134432ea62d8dad0e8e85bd234148ddd632308c7d1c898397aa0b0b0d4c5f531d5b825516774d57e9de5a9e2de5fff70d
SSDEEP 24576:VnXoJjNYH84VVSNAApoEOQ66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKP:VnXoJJYH84VVS6AmERJas+cHBjSSKHPh
TLSH
T12465BF6EA2BC04E8D5BBD17DC5C24506F5B178665331C6CF022182BA3F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 053e986301eb0c2269106d42de795b3f2d7e6569560cc5cf20b2b37408b28a83
MD5 2d6b62ecd634c357d00816fdb67bb87e
SHA1 98206637ae78a1922cefe3dff4582b5dacd82ba4
SHA512 8aecc3bc30512780a2bda79fbe7316cf5a78fedb0d91d1659268d023d88fa3eb83b5f3df86ee00fe124f8f1c2f470670b87fe268af8faa54bd1b7ed469d0f5b3
SSDEEP 24576:Kv7Xbxd9Tuycf8M/TYlSuxrr2PCioCRtKKsFfYwGlgoZYnje0tWXL0:KDLL9TuJ0M/TYj2PKDFwwdoZYjnc
TLSH
T169858C5EA2EC42D8E07BD6BD85B79146FAB2B855273081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 e04eec539dce566abf29335f2e39217b43a2131126fd4d97ed40c5d153318f32
MD5 1619d1fb2de9ea5717ae09805769bdac
SHA1 358a9c6f7d98c61b04e0c819b5fdc86feb621b2c
SHA512 d9f966cbd62692f60a4c3daaa66a7c37bfad81a0cfca439ba37712341f64e42eaa2905b055005ddaa4a8f0a4d8780007c604c8bb18b3d3bcec1958c0e1fc7d85
SSDEEP 24576:9egJgpwJOmPOHWAKR8ZguIGyPsxr5Vin10w7oCRtKKsFfYwGlgoZYnje0tWXLC:9ngOJOmPOHckDFwwdoZYjnc
TLSH
T11A55BF3FA7BC15D5D03EC17E8A968916F6B1782613255ACF0160827E1F1BEE46E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 4d6efe34c6adb84648d6a0d096f8b5bbda03982efaf328ebc999da7f41db93fe
MD5 0e2e38a2d2605580a3c59fa9d821ae54
SHA1 23fcab4f8eb1b318985518f9298d7b4f5de1bda8
SHA512 9cd9317b1fe83a76322b0f5abc7fac82cc6cb93861b9b2e2bbab1cbef777f1039e8088cc628a0db9e1b0517ff8aaa4aa330c9cabbfec44d884afda61b8104aec
SSDEEP 24576:1LJnJiTk3R3waE4JrOloCRtKKsFfYwGlgoZYnje0tWXLL:1LJnJK8R304lZDFwwdoZYjnc
TLSH
T10F15DF3CD2A910E8D4B7C2B4826A1756FF71386D2B2169CB15B4D5323F12FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 02e1aa57600328d5bcef7f91bf065b746cb9c159b70cb3a1a7426f894bf9b63b
MD5 0c17d6dc1d732d227a3903b5f9e591d6
SHA1 df17ea4e61b50c8edc23d08aa9d01b28a21c9b76
SHA512 a476cc8e4087279665ab00c78469437b18039cd0429951f5755bff88bc82e154e2e7ad864df6f676bc3b295a0cd7803fba732042e753a600c3f14b094c267cd9
SSDEEP 49152:P9mqCzDScAZmlvTcFg8Ph6eDFwwdoZYjnc:T1DWGoZqnc
TLSH
T1BA955D05F7EB5298E8B3C9F1C96294159B327C509734F7EF0A80CA6A1E32BD1D939B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 8d7b8d770f2474cde1c3a94013c165b18f58133f4c23c5eee03014a3ba0a8732
MD5 c1db6604a1bf6a9c2f0e76be5278a993
SHA1 895436023a1f7ef1414f39c137fd61084b3196fd
SHA512 a45eab1bc0cc6105c30adb563d3b8fd5b6d75df845af4025cca9684248d3f36dcec70b8541bac90ea36e2adf45d4324fc161aaf99a3f88bdca55ab4f1fca0dd2
SSDEEP 12288:JlYJeXm5nkEUuELojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzD:JlYJeXm5jUuELoCRtKKsFfYwGlgoZYnC
TLSH
T143E4122C67AD60E9D23E907AC9B14615F3B1F4B5A34023EF02E0D2B70E66AD55E3DE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 6e679f73ab8412bba875cbfb69bef0f9185bbafc2d78dd8dd76291a54260a483
MD5 3a93cc53f989c3077bd426b85e123741
SHA1 be5b6c0060e41e049b02a2d21ee0e5f6e08eccb0
SHA512 a91bd2389affb325c8b2ebb9cc49d4adc322a10acb541ac7db223ee528353b5418bb100c276585c7d7796377ce95c3e426a6998a4af9c8d0e5ebd297b76f3fbf
SSDEEP 12288:fmu6kyIojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkbM:f7tyIoCRtKKsFfYwGlgoZYnje0tWXLW
TLSH
T1D7F4121463A590DDD67A1179CAB242A1FA78BC34DB1012EF11A1F33F2E727C49E39B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 68737541a7a4498e02053caf72bca91b1a4ef50975363b9aea9562cea30edebb
MD5 53a0c753ea71420ad7d1293c5abc19ce
SHA1 5983781e336285aa5e2d5d05f1a98d72c87d5b55
SHA512 f21b53677118d37bff6d88acda96d3970858b7070b54cf47a8fc708729ff67d715ba9f5e004ce8ebe52984dd22b93f7022dc8c469cc323e04611cea3765f135f
SSDEEP 12288:5P7ojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzOkb6:97oCRtKKsFfYwGlgoZYnje0tWXLA
TLSH
T17AD42328536690CEC63950B6C9750356F1BCBE79E38020EB12A6F2B32EB55C58F3ED14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e15294d61b867cae03e42ec3f5e9c8af6a2149d82f2dc1ff969693c4260db0f7
MD5 82e9cd051e6265a335cedada6d5b6b2a
SHA1 f48cf80096909b11a7a5615cc88930b678ed8163
SHA512 54c8096c3011f453d281fd5743bb373057a1d0a4028385db5fb5352bb100e2e6c643dfab8bc4bda52989fbbcb46931a51ac690b8f302052e7f5f35a9ff408a45
SSDEEP 24576:0C+TyQIu93VAumZr7jmOoCRtKKsFfYwGlgoZYnje0tWXL7:0/TfIq+YLDFwwdoZYjnc
TLSH
T133558C1DA7E91DCAE276C575C8A34493E633B872137186CF2044C17E499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 3402af11c53450ea6c3bdda870d1300851b4c04d74aa8b3814449bb70c51d759
MD5 330866fb72be956f64d8f476bb1742ee
SHA1 f496dd9a3eddcf60323481d5c710a0f8a3f4d040
SHA512 9210a87208b8c46f888ef5941e9613cba587dfb0e3fde1ad5d457f32bca12dc7938a838206c15f54ec86efc5b172a21109938dfc9339a7aea9804561157fb49a
SSDEEP 12288:RcyrWOstaa3kcsvojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhzb:kLQikZvoCRtKKsFfYwGlgoZYnje0tWXP
TLSH
T15FF4F10EB3AB0099D17B817CC8954252F6B3B875931123DF02A1C77A1FA75E9BE38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 28be2f7c81a429188ae8393646dc928dfc596f4cef482df3ecc5e8a739081f67
MD5 93d34d27019d870c10c12a4c7515625d
SHA1 49377c677a91017f4ce44c2d346d02c6a928cace
SHA512 0165910a73b697df753c6b2981cf839d10e10553d1805c8dc1b532eb0aafbd6c5043126ddbb90fc39d4352eadfd481203b7706086ab8abbcca3c7dfc552066b2
SSDEEP 49152:BpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPJDFwwdoZYI:SpC7b4+80GTkWDWGoZqnc
TLSH
T137A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8ce3a54de26128043174071d44b4abce7025077ae8b203060d609c6ab1ffdf48
MD5 757a9cfa8516445e8d51910c4c0adab1
SHA1 9c1edbab2e6f048b2f477f62fe73cab180c41fe5
SHA512 d1b1283394688f48dfe95d83d2f2696e648b3d99bb194eb71b64bcdead92a45ddebc9e80a7ca9920cf7eb70f710c0f91a677572e02ec0dbe78e797d19f1370cb
SSDEEP 24576:kSAwJPE1IDAo+4Kt+l4413AUQQoCRtKKsFfYwGlgoZYnje0tWXLK:kqPCIo4Kol4KQxDFwwdoZYjnc
TLSH
T1B155B029A7F946E5E17AC7B4D663C601FB727823533163CF4290917E0E169E89E3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 39b58ad3eaf3b165825f53e6df5b08d0fbc66829c43b91693dec95665d722f57
MD5 32d978c82a9a6c6121f7c7d4ade1b823
SHA1 ef994d29ae0caa64430cb2e08a023d0e510aa740
SHA512 7b98fd88f853f7535ee25e67c0c49b1bb8033be20036a42382a5e65c078eb3563223df21f3de5141566c97cc418d1360ff14966072a6ef7f80e740a2de8e2ffc
SSDEEP 24576:7yLXPLcE94tgoCRtKKsFfYwGlgoZYnje0tWXLr:7y7PoTtBDFwwdoZYjnc
TLSH
T16325E03ED76D04E5E47AC17CC6A38606F67238AD037166CB05A091762F6BFE4A93DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 c3ca96ac2cb7d076cf0839bbbb44f7bfcbb56904cd5edb9e82c48e6468057d0f
MD5 7037b8fe10fe4a0e16db82b1ecd85769
SHA1 dc8ff088aa1ce343ccf91ee5cc2f91cc50a0e280
SHA512 9b4e3b2dbc3685a809d944dc42d8476ce21970e642a3bb48faaa5e4ce938c0abf2713230952ae6b20be720cfd23c420b042ac539f29df2e63c4d40b92f99b6b8
SSDEEP 12288:M9lyvj3IkxjbBzfojwXRtK+HPsFfmxXwyZlZf2oAiYMwje+WTQaHg2EWMW2mFhz6:MWv8qjpfoCRtKKsFfYwGlgoZYnje0tWm
TLSH
T142F4121D53E464DDE1394274D9328226E0B5BDB6A3A425EF31D5E6B70B35AC0CA3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-488-0x0000020DD14F0000-0x0000020DD1C9E000-memory.dmp

Download

memory/860-100-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/860-93-0x0000000001D20000-0x0000000001D80000-memory.dmp

Download

memory/860-99-0x0000000001530000-0x0000000001CDE000-memory.dmp

Download

memory/860-83-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/860-79-0x0000000001D20000-0x0000000001D80000-memory.dmp

Download

memory/860-73-0x0000000001D20000-0x0000000001D80000-memory.dmp

Download

memory/1076-82-0x0000000000400000-0x0000000000814000-memory.dmp

Download

memory/1076-0-0x0000000000400000-0x0000000000814000-memory.dmp

Download

memory/1076-491-0x0000000000D90000-0x0000000000E0C000-memory.dmp

Download

memory/1076-6-0x00000000026F0000-0x0000000002757000-memory.dmp

Download

memory/1076-477-0x00000000025F0000-0x00000000025F7000-memory.dmp

Download

memory/1076-1-0x00000000026F0000-0x0000000002757000-memory.dmp

Download

memory/1076-476-0x0000000000D90000-0x0000000000E0C000-memory.dmp

Download

memory/1096-236-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1096-233-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1096-227-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1096-475-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1488-197-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1488-187-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1488-193-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1488-445-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1544-238-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1544-119-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1544-113-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1544-123-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1776-156-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1776-273-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1776-160-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1776-479-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1776-481-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2092-205-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2092-474-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/2092-208-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/2300-136-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2300-482-0x0000000000D70000-0x0000000000DEC000-memory.dmp

Download

memory/2300-133-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/2300-240-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2300-128-0x00000000008A0000-0x0000000000907000-memory.dmp

Download

memory/2300-483-0x0000000000780000-0x0000000000787000-memory.dmp

Download

memory/2464-285-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2464-162-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2464-168-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2464-171-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2604-122-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2604-12-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2604-18-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2604-11-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2944-220-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2944-224-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2944-223-0x00000000006D0000-0x0000000000E7E000-memory.dmp

Download

memory/2944-210-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/2944-221-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/2944-216-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/3192-179-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3192-173-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3192-182-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3192-345-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3300-33-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3300-24-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3300-147-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3300-25-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3324-243-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3324-248-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3324-241-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3324-484-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3424-37-0x0000000001580000-0x00000000015E0000-memory.dmp

Download

memory/3424-43-0x0000000001580000-0x00000000015E0000-memory.dmp

Download

memory/3424-36-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3424-61-0x0000000000730000-0x0000000000EDE000-memory.dmp

Download

memory/3424-59-0x0000000001580000-0x00000000015E0000-memory.dmp

Download

memory/3424-62-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3464-95-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3464-86-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3464-219-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/3464-89-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/3816-53-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3816-47-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/3816-55-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3816-478-0x00000000015C0000-0x000000000166F000-memory.dmp

Download

memory/3816-181-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4044-487-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4044-283-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4044-286-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4044-277-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4044-311-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4044-295-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4044-327-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4136-69-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/4136-58-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4136-196-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4136-63-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/4408-138-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4408-148-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4408-252-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4408-144-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4980-235-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4980-111-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4980-102-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4980-108-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5536-254-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5536-253-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5536-260-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5536-485-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5676-486-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/5676-264-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5676-274-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/5676-270-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5804-498-0x000001BD15E60000-0x000001BD15E70000-memory.dmp

Download

memory/5804-499-0x000001BD15E60000-0x000001BD15E70000-memory.dmp

Download

memory/5804-497-0x000001BD15E60000-0x000001BD15E70000-memory.dmp

Download

memory/5804-496-0x000001BD15E60000-0x000001BD15E70000-memory.dmp

Download