5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Size 3.7MB
Sample260508-jpsjvaev3v
SHA256 5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d
MD5 61a1bd5f681297dbc2c7c4932384cfa1
SHA1 9514c86e121b77f0fc22f046c7b203ae186cfefb
SHA512 c58746bcfdeb17444b5cda72dab4c1f938c7fee20fdbb4f5221da6d9a5721984a3b3ff3c2d596b00f6607649edafb6692b7aded1fd09d878c954d677cdf7792e
SSDEEP 98304:UG96vu7KZCeyGc4BvekcWAg3fSIRYIa2KS+bbkiCQXtZCh1hA1s40sLm:UG9oekceRB1hos40sL
TLSH
T1FB06BF01FB418472F89300B596B7977E4D39BE20133895D383D43E6A9E316D2A93B79B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution ransomware spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2640	powershell.exe

Executes dropped EXE 22 IoCs

pid	Process
1392	alg.exe
2228	DiagnosticsHub.StandardCollector.Service.exe
3180	fxssvc.exe
5856	elevation_service.exe
1928	elevation_service.exe
3352	maintenanceservice.exe
2328	msdtc.exe
3840	OSE.EXE
2420	PerceptionSimulationService.exe
5376	perfhost.exe
1112	locator.exe
3156	SensorDataService.exe
5820	snmptrap.exe
1504	spectrum.exe
1088	ssh-agent.exe
2864	TieringEngineService.exe
1228	AgentService.exe
5036	vds.exe
5072	vssvc.exe
5748	wbengine.exe
5384	WmiApSrv.exe
436	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\System32\msdtc.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\vssvc.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\msiexec.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\dllhost.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\AgentService.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ef2b596d958e99e9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\System32\vds.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\wbengine.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\spectrum.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83296\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83296\javaws.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079a8e478bfdedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025fa3b7abfdedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eaa42279bfdedc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4062579bfdedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ee3fe78bfdedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002509e778bfdedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eecd0a79bfdedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000386ce978bfdedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000876a2779bfdedc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2640	powershell.exe
2640	powershell.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
2228	DiagnosticsHub.StandardCollector.Service.exe
2228	DiagnosticsHub.StandardCollector.Service.exe
2228	DiagnosticsHub.StandardCollector.Service.exe
2228	DiagnosticsHub.StandardCollector.Service.exe
2228	DiagnosticsHub.StandardCollector.Service.exe
2228	DiagnosticsHub.StandardCollector.Service.exe
2228	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Token: SeAuditPrivilege	3180	fxssvc.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeRestorePrivilege	2864	TieringEngineService.exe
Token: SeManageVolumePrivilege	2864	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1228	AgentService.exe
Token: SeBackupPrivilege	5072	vssvc.exe
Token: SeRestorePrivilege	5072	vssvc.exe
Token: SeAuditPrivilege	5072	vssvc.exe
Token: SeBackupPrivilege	5748	wbengine.exe
Token: SeRestorePrivilege	5748	wbengine.exe
Token: SeSecurityPrivilege	5748	wbengine.exe
Token: 33	436	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	436	SearchIndexer.exe
Token: SeDebugPrivilege	4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Token: SeDebugPrivilege	4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Token: SeDebugPrivilege	4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Token: SeDebugPrivilege	4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Token: SeDebugPrivilege	4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Token: SeDebugPrivilege	2228	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2640	4740	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe	86
PID 436 wrote to memory of 2112	436	SearchIndexer.exe	113
PID 436 wrote to memory of 2724	436	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
"C:\Users\Admin\AppData\Local\Temp\5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tmp123_downloader\download'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1392

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5128

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3352

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2328

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3840

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2420

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5376

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1112

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3156

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5820

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1504

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1296

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1228

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5748

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5384

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2112
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7981468cb9c8cdc462e0ee3b093b7b3a3f845738cbe4ae2f2628c9c592c5b184
MD5 f88213731ad686f5ff7a13dfb916fcdf
SHA1 e4a33e66e5af4f67151712029193671b64653bd2
SHA512 55ecf853bb039637105e827b2ca5de04e3253eadbab6f28a3c14e7c139e885ce258d9093cd0c729200cac6fa42048dcb1f1a96369717289ca3739f61499053aa
SSDEEP 49152:+b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnDQ/lFTjN4:A3q6HjBzLm
TLSH
T108D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 5eb066dfb071fd25ad510aa3b2f92da37c18f9a4bc4d5216ab258528b1bf22e7
MD5 25ceb53ba7a5b7f37143691ccca57aa8
SHA1 570313113ab7bf6fd5b6566d46cbcd382a72ffd9
SHA512 c24b666c4fa2d06f8f6ce8b4c8d5a158bcbf4a060a958fc4d78c5faad5237375724772641317878202125ffc0b2992a1af6974f1c0c2c49a97ddc7e16a4e7073
SSDEEP 12288:c1XLsswWkxy2lRq2czAEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:qXYfDtczAknQ/tbw/2Mkjy6Fr7g0om
TLSH
T1B075F12877A449F9ED67827DCCA28502EB33788547A0E7CB03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1c2fee7ca43061864d282208a11a0ee70ff4e3d3df5aa75f8dcafdaceb0ce847
MD5 80774d9bd05bdf00cc537dcc443def00
SHA1 30442e41627036efb366b4eda38219210bf25c8b
SHA512 0e28422bb29bd7567b42461be1b57ec4e8c23ee0621bfd8d5896591a5888294b62bf8dad833063f3e2c71d8c55b15a1dd3d6fa61d18fc9ad8abf27849e3df1d9
SSDEEP 24576:+0Le5ji0hmxirMLnQ/tbw/2Mkjy6Fr7g0o6:+Pji0AcSQ/lFTjN4
TLSH
T16E959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 73313c62f0a1c9c76ac0c58c14e8833465196e86d3942bf2c9c7b50781de29b9
MD5 2034d8f91d08d418a91d77d18cd33474
SHA1 848df884536b15493c19f040e06d2188b328a281
SHA512 c59f2695bbc3dba6677808e1d21385d2e6c4c6c39aea1484f32efea84f27c06059059eefa6445fcdb50e0356d49c8f75989c02cd9ec631b74a894182f1fbab12
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyuNnQ/tbw/2Mkjy6Fr7g0oS:W/ezSC6vUzPvxHjyWQ/lFTjN4
TLSH
T107755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ee6a4cfcda00caeb35f22754b01b359309b0765914941b6c3d0d71009ff3b8af
MD5 6ae904a68813b197b25c32fdefb243ad
SHA1 0e1c39b39c2a6ce626b403b6a387e4404a4d2344
SHA512 c303b925e644fe191e742455b73bb02c5ccd81f8717160e1d45b3eff6b649cbf50a8c706fdd5544a53b776dcfa0edfaff34880969d754d06c74c623b9c712767
SSDEEP 24576:lVbqPb88hv/l+6QnQ/tbw/2Mkjy6Fr7g0oS:lVO88hXl+/Q/lFTjN4
TLSH
T137559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 fdd4c9f797549ed743a1053f01fe9e1a8b6b2d0db41cde27196d27994c6a7540
MD5 077e8740c87934d795aa499337ead52c
SHA1 2b86d76b4f98d820c912ef8870a10172b154cc5c
SHA512 075253b08c78d7b7b207aabfeb1dc704a27ee5283c4e1872820fe3f1fa1e843fb2638d5a8b8113f20e7ac735627998bc73053fb38e631aa858cff17e65cd9d95
SSDEEP 12288:CR3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:CRXnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1925523796A14F897FF2B06B15C938482AB7B0EC1BFD0A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 82660776e240d6b416f79c7e5aa92185208db7f5c88274690d82e52d61de7a91
MD5 ebaeb6cade25547253d2af8626172f18
SHA1 c637ff5d93cc6d7676122b55d3e4836927150fc0
SHA512 ba9b99f2ed81e1c76f97b7765bf81af05a9c126e2b999cebe9430f15571d33867e35e43f29fdedbe8278fd7f602e0c5e1e75e80230600b9d85e75ded8a8ee8ae
SSDEEP 12288:ceBNUbTVO86U4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:cJIU4nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T19775CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4bdc88ab7906ff19b5af2fe4774f649d6144b0196de7dd78984dab7e7aec2b30
MD5 c8170660f1983f701543605132314415
SHA1 1fcbd79bd3ea8b6d3cec73db7c028f165a7a2749
SHA512 e98fef69f8a59c4531a5e3e666c2129f35f2cda77ddbf2a88d2e5785a36ec288e1d80d56713dce27f92044aa87bb2551df7ac90d662f507a84bbb463e7f1f7f1
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THQ:pQvGAdlCEL8c/yRNw5CyLmj
TLSH
T1BE267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 9827d36cd90a6a5a75139b527690c8e2dbb2f2761585861a165a2bb6056b55ef
MD5 d727e9b4543922e1c897a8a919053cbc
SHA1 89b478281b7ed5ed1c996b0e3da4fa846f3b8df2
SHA512 31ed9b237050509090500a461fb6870833a408496d8290443988cfdc65691f74751a29f5c104e956d5efef8b3f4a93c6c5d8269eea64a82fb0ee18d9d72cc339
SSDEEP 12288:BAwSfxL/2Dc34DLLmt0LDQewsAjCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgh:idewsAjCnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T17275E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A85A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ccb587dd411cac4b049ebd6e6fd6790021db5ba35bc93bc6d957e3abcd3adf58
MD5 38d4a844cc054f0ab7b9e5baf3b93b74
SHA1 71a2088ab2613adada15ad6d4d1afcdb435cefbb
SHA512 6224008e64d78df2519e45831556d4a40a52dc2bf192605296dfe63f39e844bfbd26e559848896b6d4ffc5060ae5477bb5bfe8cad66d4c0292999d1a946b4961
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH1L:1UEtQevvqc2W1cpV2EI32
TLSH
T1E8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 337034260d5da5d5c4a859f5deccc9d7dedd0692883f151aa6eb1964843425ba
MD5 ea4516a98a069bb5d9b9db23173c5733
SHA1 a4081a7245909d6d314e448ba45c0627e388924c
SHA512 13919828517c82427c64af6262246f77ff013ae581a9cc65ddb916274e81f9340e7df04e9169da26aa1b64ec6cb2053ea9fe5c25dd6995574b61df51a89553d3
SSDEEP 49152:NCbRquA/m2yL5zQfFiV+XenmE3/ziQ/lFTjN4:qoqtVjnmGLm
TLSH
T107D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1729ec971de6e092b27f364c7ee652fa941c6747f49209e5b5e87b912639d979
MD5 b0cae25be90ddf0797d4111f1fc61289
SHA1 d9cddad5bed2760cd5977c2c579ddcb416dc2a38
SHA512 664d8350745fbed507e111b5cfedd65589e665d00bb0648b095d6ccb35b820fcaf145b16920190af0afbad8c85b7be47549cf8f5dc2c380ea4dc40dfa685c8b2
SSDEEP 24576:CAhGLJIFoiwtA5l7S53BnQ/tbw/2Mkjy6Fr7g0o9:CAMyFoiq5RQ/lFTjN4
TLSH
T19C35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 fb8bef7319641085d34df39b68090596cb02681a7b0bd427e5d4304e2551ddb0
MD5 415139d1109001d163742ba915cc1065
SHA1 9cb43c88831f0bf7b06bed86831ba129a4470e2b
SHA512 360e1c4d48789fba922d96cc7b7752dbee5cbcea8a5d2d526484da98ed75e975c0fe82b4a8f3026b41803a620c687ca955b7b2cebd203a33e5da2d334d223799
SSDEEP 12288:jmw5HEjsChNVBFgl0WDm+CNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM2:iwuoOW2nQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1EF75F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 6621ca139aa0dc728439a5dafc7d3d20d5b42bb1d2838e0935f86a5d9d58bd3b
MD5 eb02b8eaa53d519dfbc483de1591d7fc
SHA1 d61d4075bf4b23abbc047f2a95968b88273ff97e
SHA512 a0f519c65e2936bfff33e09dede3e098cc8b9ea5228ebea07c53e00532d701d3e17b88e04bc2ecbc5a4d0507b898f4c9ec8fdc51405f088ae190f446d00ed422
SSDEEP 12288:8BZ1IyyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:KZuznQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1D865126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a6fdc084cd59bae93d448dcbc50b4f84f7d4170aacb81f2dde5f26739e22eab5
MD5 6e80cba7f4196f6317a81b93093005d1
SHA1 5794bc880657b2bddec3fd9188c94f41e8778ca9
SHA512 16983baa76c1a2a24a60db86dce609887171765ea1a43983f7ff4ae7eaca22fa6b812102a154bb007e5794a1c26b5f1f692efdddf7898c07f19492a47fb2d08c
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:9QRQyi36YOcPQLvw2gAf+PN3PLm
TLSH
T1A1666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e432e08f38ec932663aa0e6685e61af7b7f5598d322ad2ef122c7ffbcb3435b2
MD5 8cbc5e071e818472ac888f9c21a3b976
SHA1 e547b15cba27b8ee9221e3579125405a2581e2e9
SHA512 40633b5f2b06b93b33d15f5d7c2d1a1edc031a5bd0778fbdad0d8e559f0a85fca635ce257846b78192bb2899a5fe4b61d3673356bd8c2210ccb4d4852dfd2029
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:yQRQyi36YOcPQLvw2gAf+PN3PLm
TLSH
T157666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 654f3a332310395b88f20d5e729932a25438a17b73da283a1bfe032de9bfcc8a
MD5 e7211e963217bc1c497a19d5ce4011d4
SHA1 10bb86f33e331d8fcff150d3a225d2bd2902d87e
SHA512 5b112223a16922482be5c43a95086996da4d9bfdd01cd25f2f83c533215d7dfd6846ef128b6fa6944658672a68624feff0c0a200d8a976d672cc6e42ce2057bb
SSDEEP 24576:5wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0DnQ/tbw/2Mkjy6j:l68Qg55nhheWu7PNU3/SQ/lFTjN4
TLSH
T124B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 02cf6e06907d0ae1852355cbb09d0ed738bbd2f9616d6d175cd9fc39f16f7db6
MD5 478120145f3c585f1d1c94d93fda845c
SHA1 1fb9ac9accad6ba836611ba3321e49a18050ad70
SHA512 8b20a5260526a3062890ea1d79a6ec82385f8aca443eac96f85868376abfc1b060b7b506f215c6447da343b032d089b1a1ea6fcaed1d3eff65069dff1b3c7a2a
SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Q:My5112gYy5azzVvL69nLKnhZ8Lm
TLSH
T167167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2df612c178cde49b4f5151ae188e6256a9c19b22a2f80de47b253775787920b3
MD5 741e5e6738f698d831f8da1d9e04f133
SHA1 03e46d59c05eaec5a935d9bf0b0ece84ed668af7
SHA512 ed49dc845346a4a180a8eed31d7074135a324a916ab3740152a73f77fd0f1e9a47ad8e0276db03cf2b68ac87ed45ac00e63113ebd070e6fc02255132532b91b4
SSDEEP 49152:uB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl0Q/lFTjN4:8u6JmVxd2dnLm
TLSH
T1D8D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 985f13bd01c033d715bc13d24efca8a537ec44bd4a0a90d93182d669b4a824c3
MD5 b3cb8744e5648e3c861aa5682a08619b
SHA1 205c7c9d314a7f5c70939b882f5cb18af7fa8d30
SHA512 19e3827ac9033b3bffbf90276388e86d1293423ae6ac2fb9c31f0f6f30d92fed93b575ae2ca83332c8410d74faee5ff6f75e8035884494262dada29704e4a89b
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4xYQ/lFTjN4:amifPbRGLm
TLSH
T1FBB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 65ed9b93c937ad0d51ad022ce2617bb407bcad49a7314939941e23075d42440b
MD5 3998922d838a10d26bcad010260234a2
SHA1 368e61ca8ca2030afa415e220c9dbbf93a20517e
SHA512 af65ff4d92ea52166cfa514a5a5043439c611ea156f4bd9404ae1beb6c0cdcf96a8d90062065c7461adc930e4521b58ed05144dd135309bafe86f522393a9fdf
SSDEEP 49152:5SuZQIY0Be2KRRVtOnks6NMHqzQ/lFTjN4:X5dKTi61YLm
TLSH
T13BC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0a966bdaadb53665d0fbf75265a700b52b2e88bc41b645e5508a81dfb108bcb8
MD5 48600e0e206108c8eb61c299ab90aa84
SHA1 de09892a9d78bdd9b43128089c1fc77e840234f5
SHA512 9e0733c1fc045757051eebe8f57a4e62a91e6a94b2ed36d63dc09ae8c6d440a2f34e1b683bb604e85d1defef6be5d84ee2d585cd488afb0df0279228a064e505
SSDEEP 49152:thtSn8EApI0figngiDn0AP5wkQ/lFTjN4:8X2iyph6Lm
TLSH
T13595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 dc5257020f44c6a53877ec973b1cf9111df105d455b244afb748ee1e9d1edb2f
MD5 054490cf12df68cfd35bae2afbea720d
SHA1 31609ce5126b3170a03ce8e4766bb61f00a9ee78
SHA512 68b923a5ec860755ab00308140f1c854b76b40923498bb7df0e9967b6a422d973e006fd0e10e477c6841293c1bc9ee5994bf44edb119ca08fb5efd3c726b05e2
SSDEEP 12288:4fGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:4/nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T11D5523693964F99BFB1706F18C838182A73B0EC6BFD1A38F77482129967D39405CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 b6b641f5af416aab463e42dafb7223b294caaef29e53a29374aa3352d861d8c3
MD5 0f83486c917b19017367332741a9a6f5
SHA1 40d3757d4ff1f9b91a560541e64cd76fbb329411
SHA512 47eb97b5ed02266fa9d3392805c80bbb07241576552a71466dfa2e92c8bfc43dacfcb8deeefdcecb561febc0eb37b97ef225e900f3c8b45502453d869a9807d3
SSDEEP 12288:KuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:KunQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1975523793965F99BFA1706F14C8381829B3B0EC6BFD1A38F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 79b030d6ca98349b34ea28224d2474770016d8d544e84530cd6ef283995b2ea8
MD5 9109bf3772f377fe58945e3c80059fa7
SHA1 8b032d517efe0fb689bcda9acc71ae4b9305d564
SHA512 9ee71267e57f65da3d686a7d1100fd78715e5016f7e6b704bb4432c0f848f36dd208cafb04932147778dbeff6ecc74d8bbaa674c2031f925a7a14e81e0be3e0d
SSDEEP 12288:SAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:SgnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1B85523697965F98BFB1706F14C8381829B3B0EC6BFD1A38F77481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a8478a2ca9dadde16c66293b3db1fe53d0e67cf1e2783d105efc5a6ce7203907
MD5 840dc9ddb4f021a02eb148736e128c68
SHA1 71f34d72b02ea028d339f51172a96d443f002420
SHA512 3dbe6ff4b80d509599c9b164908f5ffcbc2661e43617b4deb8eac89642a82c5e573e640dca208141b9aab556bd5a89d92558a7175d7871d1e3d67480c4753de5
SSDEEP 12288:kVRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:8nQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1C25523693A69E5C7FD2742B5CC938142E77B3DC1BBA1A3CF6B00111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 c958e351fabb982be3aadc26e3c58c10cb33817e796f316d1a3734a9de6421bb
MD5 c2eca1bb641274715b59391ec0c9d0ac
SHA1 cb859efb480777d299e9ac3f96c6b95fb40158e7
SHA512 2f51ae3c7eef6765d3e500235b1df9dbe69828e7f946a45e308bc496033d7ad99f82dc078b255f2bc85f4459d5ca1ec8a9358807a857c6c60110682b6e6cd73b
SSDEEP 12288:5pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:55nQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1095523697965F98BFB1706F14C8381829B3B0EC6BFD1A38F77482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 5a7d3f5733a55f7d9c2b3cb4208500b8ad062afd45f5ba1688bea120f44015b6
MD5 bf96ec5afccdb8469f340bdec2bf5a8f
SHA1 4fc09c208d58d28ec42670cffc24d7e996e70eee
SHA512 d29e40d9c3c4dde54cd1c3346d859fea4e989f793168cc1029513e4fba636ae91a9712e5dff7c11cbc6bb3656bdcd2ae2b1ff3616bb338e833007a8d888c1c3e
SSDEEP 12288:2qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:2qnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1065523697964F99BFB1706F14C8381829B3B0EC6BFD1A38F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 2eadb24a7c1d88bec4ec984d0ab7606484fc2a456d4007b5146892e897cdafe1
MD5 2d643c725d33b4f15c0be06856301e2b
SHA1 c6a0c0795babfaa485b5d08542b5d7ab20465b68
SHA512 ad2c0d5e9c6aa3771508118cf2cff592313030a084aa89d476b34105daae09897dcfae4f8650d84a68f0af91dd182fbfc2075498bbd9a754d7920f920ff0f38a
SSDEEP 12288:5mGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:5GnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1C45523797925F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 7e14f6909743e559720eb26700fd44fa3ca0f7bc444ca4a45b333dfe7bca98ef
MD5 de3d22d813f73a715f99d481a3913344
SHA1 e717ffeab831eb289ad121b32a912b1ce7a35025
SHA512 084c4289c8b7144173ae4c53375d51a5ef049c67be86918e984aa010c2c98441cbd5bf01703467e96d2a741897692c24312c6aebc8b667ebdbb1cb2cf2a3bbd8
SSDEEP 12288:BiZwb6zzFEoS2cPvyOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:EZMSzFVSOOnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1AA7501A5B35058F9EC67827ECC528906D7B27C5A1BA0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 88eb5141bf99e98bd34e210d9ea204947cd7bbfa1b69f633f89c2e76a1e3cd38
MD5 b75e98704953ac3f077e2476def3ef51
SHA1 67c204a21d650ad8d301a66808e03d703d9766f2
SHA512 4f22b9724e49f96f2d56317a4887cf05713642602f26e0abb47391d56551024fe846874f5de83f8d3636c24102851ee48b1fcfba9aa97069e027f5d4a845b880
SSDEEP 12288:vzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:vjnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T12C5523697964F98BFB1706F54C8381829B3B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 1da16a069ff83aa7d8b70b99d60ac809f3946c4972d6c23e64f59fb0bef66695
MD5 d099d7f612e01c11db334f35aee482f7
SHA1 8d3c3e0097c13f8f15358420d18d0e8050208949
SHA512 00bfe0dab7e707b0773de94daa14c20fb8eb60be9aa7a5940ff8b1515f2ff185d1333d89b80eab9c3ba5c3ee8a18fb3c8746dba079ac28cba2ba37e69a8b101b
SSDEEP 12288:HnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:HHnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1C45523697964F98BFA1706F14C8381829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 88561c3c5354b3e23eef5c7888429c94179b68c39a3a5711dcc49e0aa760776d
MD5 ec1c81056764964e9a5b1e9ef8d4c3ee
SHA1 6be8dbed2f2b1d9979da2ab7bb9c46e40fd9181a
SHA512 0471c6dda1b34224105ab0c9ae003663b3fcd56849cf380487729836ae9e7c26b7931bb4038b907eef73d1740c816d7d8e9ebe67bf88bfdf6cc5debc57259970
SSDEEP 12288:LyPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:mzyynQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1DF65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 e922439c5d379984d0b9ef7b1fbb7781da3c261c0567f99ddf39a588c799f206
MD5 758c15519ef65180a5c5f6da46f1ecd3
SHA1 956a4ea2f143750baa31b7479103422254b8e56c
SHA512 434766d8e4fee14070a32e8cccf283245cdd0226a99b718f44c7361bdcf7c722a3b9e318c8094c22d17a99f8a76a438154ef84022e78d14c5d81c14d428304a2
SSDEEP 12288:qzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:qjnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1705523697925F99BFA1706F5488381829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 c09b5086fd25bf7f8efc85dbbcae921fa1a3a325a9b71b8ffdd7cdb5e1d2a65c
MD5 d0d27e4a91a18343252e631046e7e64e
SHA1 d68753a1ec0990f321c0f0eee028851cd61191a3
SHA512 31d418b084bb7dbb49aa625c5d28474f1f66804e51fbc3d459dfc64f5c6818e734f3a0852b726ccc6b5ac93cf4f4254b01ecd979307771e8a61a700c4abab2e2
SSDEEP 12288:EzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:EjnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1255523697924F99BFA1706F54C8381829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 4333c822f87861dc704acb09225a549d9e3c570b9044d54373d88b753bcc773c
MD5 702cb5bd61ee19fd373f1e81bce3e3e4
SHA1 47c27093c4730eb39031fc0a0eb76cda50b2d6cb
SHA512 eab45e4975de931c1690a6c347a1c16ad9a5e9db7604f26c827a15d897335f2bb819563184aaecd737bb47f38c3447113ec39cb5710f6e4e08e9dfd7ce0d8d3c
SSDEEP 12288:tyPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:EzyynQ/tbw/2Mkjy6Fr7g0od
TLSH
T11365021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 94007b5dea9d641a6f67b0e942a9926720e8b653d98a10a07bd2d9aa8084f5a2
MD5 087f73a76a5fb30a8353d7298536cc75
SHA1 b8278c7c6fb9c0135cc35fa59bd9ba0194848e08
SHA512 9a4fa38aa63647ab77b7298bbd569230c299b2f7df0f03299a8690bbfeddd3386739481916f06d00de5957b101dcb34b2362fd60fa1096ff7b11339ebb021e7d
SSDEEP 24576:zcP4mcvIjkGOxhKP2l71nNKbrh/8KBbnQ/tbw/2Mkjy6Fr7g0o7:IP4m4IpOO67W8K9Q/lFTjN4
TLSH
T19265AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 7d52f243eed74bda69f7ec93a507999af9846ddeb1ad8874579de5f39963ed92
MD5 8dd5eb749b06e83589b1628abc110a86
SHA1 c4232f4b358a090f18fce4266919325f14045aa2
SHA512 8e20647597563f4ce5d94f086f51c57a79e926bb44838c3326f6e4280faec756b786ded1b71b3c7fab7af008ea78f1699f5b642298e08081c261d97a270a728a
SSDEEP 12288:INsfDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:pznQ/tbw/2Mkjy6Fr7g0om
TLSH
T1F965F019E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hbzoek2p.po4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hbzoek2p.po4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\tmp123_downloader\Cache\e57f4b0\config.ini
Size 1KB
SHA256 96a711171a54c4e84ce0653e3c8f382c486a2def6479d444ad58bcbe4bfe34ef
MD5 2463f86af826660eb9175d68f92d354f
SHA1 e69bcde703fd29591e54f307d2a79748aa1d0c27
SHA512 9f4a241c9d97ceb924646f9bbd4bdf7c142a5f5aa47b05070f9e1151ee519e66490c8a4f64e01dab4349007d26d6695422497bd3601ff3406e50ba7d0685749d
TLSH
T163219C1266F96168B533BA9DEFEE80B59B33FAD5201BC65E10D0010B52D1D001B02BBB
MD5 SHA1 SHA512 TLSH

Submit Download

en.ini

Path C:\Users\Admin\AppData\Local\Temp\tmp123_downloader\Cache\e57f4b0\language\en.ini
Size 2KB
SHA256 52aac0a2c096114d737fbdcbd42bd851e6d60a1ae9bd586b8ebdf64db2ca5158
MD5 1d9a2fe4ab2ea4501cc1ba2cfaee2a2a
SHA1 4436032525760f0ccc9b182c9b1817021cb6be8d
SHA512 5664932b73aba74eca5d811f00e0bec99d66c2c86af9d5f32c798588b8fc9e656474ed70595176c6210b21b759c7a317dfbedacd1eb427b45d963e6c7e3664d0
TLSH
T17851D05262E83059B6F77F88FFFA91E88B76BDD4993EC57E1181000F06E1A148A61773
MD5 SHA1 SHA512 TLSH

Submit Download

language.ini

Path C:\Users\Admin\AppData\Local\Temp\tmp123_downloader\Cache\e57f4b0\language\language.ini
Size 1KB
SHA256 e35032a983c4a738616087b7c87a5625c9c5a7fe54d40b0435117a78093ca34d
MD5 fab083e7bf4be35f271da165f0824415
SHA1 de47077489b4cb7df9157463279804b78e15c642
SHA512 d39e7d44387b31e4a34cf6cfc88f5c535631be767ca72ac741152754eb7f4b2d392afb98077e2ea5aef28d2dbeb6f0783dad3899660a777fee5ebcb0729515f0
TLSH
T16941BE2721CCA14DB9F76B45EE7044B97B29BC555C0FE86C66C5261A80E2840DF329F7
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 0017555c984d1af7efb4b358a7cac8274641974fbfcd2d9357f8bcdc1615d446
MD5 50dece61f20a6b04e6267d67f89405ba
SHA1 4176637191fcaf44b0f94861b0650f9841eb9a0c
SHA512 b21ef52fd209851fccfc8405db76155033b3c5c330c182dfa2d707a3d5aa5d8fbc6ca910ec465fb67a2f58e30cd21ccc566aa3bfed60406251c9003592bf2e85
SSDEEP 12288:ZjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:ZTnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1435523696668F94BFA3B06B05893C151673F0EC5BF90D38FBB04222D957C3D01EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 3e017c6b6ee9d2d69234d3d5c73920277f8d61c6ab2769ea927be3caabd1fa61
MD5 dc1cfbfa0d16baced59235ceec8ddfc4
SHA1 8b7555757a41b4d592dfef90fd4bac5d88fec7a4
SHA512 b7c22b586d16f6accfe334d2e02de8c565ebe9135921fa642540514850459c9a5aaf1464e8c138b2b5ebb00500d03f5829c5422f9e54003fa039a07830802256
SSDEEP 49152:Za0h2GEkuAe73q3pp46zwwQ5Q/lFTjN4:Za0hNYG4Jw1Lm
TLSH
T151859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 487ccdc7eb7aa69d3bdad44f829e58d9909c42ef23fa7eaf3ae5a101e2518364
MD5 7fe4ffcaad13a54b793a808a650aca08
SHA1 9cc75f8ebd143101433e456e0a3d2a015ad23afd
SHA512 61c83c66b585efcef55711383113aaea7bd02c337b7e134f635f136f05c00fc6f8355d7eae45cd520d78183425ebc1610281a630567c4b600cc9c8156399ed81
SSDEEP 12288:MhbHjfX+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:MhbHjP+nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1C465027D26AC20DAF63692BD88928546D7327C552B11A3DF2381823D4F3BBE41D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 080afe012dbe1cf03817b969706e365def87f446bf46bc9c53e29d271e7d9537
MD5 a1d7e3846ec3cd6d4769a1b46bc0d657
SHA1 0a81317688550d19ff0c9da3189b366d3341c335
SHA512 e0d01666d094943636c5d1e5ff3abd55c9e99379fbcd8401e34958962e738f7ddfb64c29521f3f8e5d942568073001760bbced5394397fe8bbed64efcf7adce4
SSDEEP 24576:g3YgnJcRTk4yti+R5dBR/2nQ/tbw/2Mkjy6Fr7g0of:gIgnaTk46pBR/2Q/lFTjN4
TLSH
T17045BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 b7dcfc9d3fe42892ddab023d01fb37a6bb5c0350b1e9117aa95a54a409af77ca
MD5 b07fbca75356c3a5a81856a2c276aa75
SHA1 ab7522d50999f4266a75803daf45e940d6d4890c
SHA512 57a78a61ae5e2a9c2cb1f54750a09fcc21e1561439d0af8e349b0ef273388962ce9ac10cd947fe834919a731ff5de8451282205904a224dc57aa67ac212a273f
SSDEEP 12288:QXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:Q3nQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1025523696624F98BFE2706F54C838146A73B0EC17F91A3CF77482129967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 a6644146d1be566c25fedde6ef9d84e99f49feaf736fc5607895d4b978b2fc30
MD5 7aa33b8789ebed27fe7141689c9a3abf
SHA1 977dfa3ac2110b8403e7b4ac5003b4c5a333295d
SHA512 0ceb9f5beea607f84749d4022141ce11161a09d98001ecffd58b1c5e899972eef15410fb7d1cfd6f7a101bb8ce6dabf391e09d7816c4021f2bde38d746c4bb63
SSDEEP 12288:yOb9A4LWOsvAYFTEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:jpL3UTknQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1B585F155F7A450F9E92B813CC8A28A16E772789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 94e90c5442b15ed0fc7f541ae35c46642ca16ff2557a8272ddfd451e7977a650
MD5 a6078f56c3dc0c38ecb0128d9f9e4129
SHA1 25abd23967a404e08be11e110ba2e41efa6350da
SHA512 a133af799214cd6e6e8007d42445d4b6e4aa7358096965360cc35942bba1e17c818a3ccce1413942fc799cae6687b85f71f69cd4f89b40ea9445babc0f4cfe55
SSDEEP 12288:LpFtpOYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:XOYnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1A865022D36EC60E6E536527D89838249D37278921B6253DF0780817E5F7BBF81C7AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8af041bd7263d99a908dfa07b6f486701d12aa14385b85ad317345faca653dc6
MD5 47d3e9ea17a0ec24e0d2145a42e8fc27
SHA1 5fc3c59018eb7725ac6195e6106eaddbdf1d5e44
SHA512 172e7b1c7cd6a1b3690168b5b85acf86503068898af09f85124836777a40a8e003d53a325836287695640b7200e31040af7681cab3f424c3c338cf5e33e28acf
SSDEEP 24576:D7NM9YqZqmWMUkPjZM48Mv6bEhsjnQ/tbw/2Mkjy6Fr7g0ok:D7cBWMpPjN8DbEheQ/lFTjN4
TLSH
T17E659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1252833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 a6ed5d17f88565180d93679bb9ff9918a5488dd79f6feb7378a5dbb41482a842
MD5 e70aa9ee980215ab1ee7b3f2ff3198ce
SHA1 456badbcaab8c65d7ac019cf49f7b502155d19d1
SHA512 a0d56ab4d5e569f4f672f2f9631f17a0874c86a1b9475c1be4dacb11d2a0c14413ae72fd4a0579a34014c141c362ce20311f9a9a5dcecfc2f54f1be46ba107f1
SSDEEP 24576:TW6BApg2YuyuNDYTabvcdvNYf8km1lnQ/tbw/2Mkjy6Fr7g0oT:TF2YuHNETovAvNYf8kmDQ/lFTjN4
TLSH
T13D857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 9b50c5466e3270c3fe143f46c0d4d82c6b9b776d76c5bce4f5ddca4ebc20a175
MD5 bfdb705844893e2bea18bd5a498ff414
SHA1 64e50357ed05c66c38e5dd68021b01b6325d0b13
SHA512 370397ea4175ac35476c611a76c502822dc017049544f8d07f48944563ee7c8c3598ed7118ee800b277212696046f3bd2bd45d2944cabccf199fde45a3147b42
SSDEEP 24576:3AFs06+Omlf3NXEbToMnQ/tbw/2Mkjy6Fr7g0os:QFs060lVXuZQ/lFTjN4
TLSH
T10465AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 cf2b4ef84bb0361e8e6546a8b6bbddbde3cf3de20336bf912eb9f5d00dcaec87
MD5 ac442314edbb297dde13fcbbd83a12bf
SHA1 db1b06b16740ab84d5ce75247a42a5ab93df2402
SHA512 1959081793d948f53d7145dc78766edcecfaf404213883c0f8f65ddefe5da5cf14bf981ff46bd687cf4e893f8db6d79b291b66ff98ef580fae8921f40da135a0
SSDEEP 12288:/CJnJ5D3VkrDzxTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:6JnJ5D3WXZnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T12E75D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a6f0fea05c1f9cd53aef7ba013e44fe33579e99e6ccb005dbb3724edefb7d673
MD5 a2be0fb4de1cd54aea3b6b61a852d30e
SHA1 93cc982371f7d0c9ee6d511dfe75d8e3b157bb0a
SHA512 84d8b535930cc583e6a0fcfe9a826be2d562ba16032b4adffa547ae5b4ed4f9f0b8937ac249f8db7785c405be94d07e269615ca93e1b7246649501532a087eda
SSDEEP 24576:FEPghm6/7IIXdwcXrif7qQncjlP65i3Vu2nQ/tbw/2Mkjy6Fr7g0oJ:Sg06DIKdwc+eQnSt65aV/Q/lFTjN4
TLSH
T1E2955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 8f137ad8196488c774d3c3a52e68a3e5b556f8bfd14036f359f38716a9f1e61d
MD5 aad14d88cc9d58e3db0b4fae100dff7b
SHA1 17ec97a4cc1e8c79ced9a33dffc8b5db1153549c
SHA512 b8d7bc9614bea98cd08b447c1d75fd87a156fcfd90d2429548199b102b4bcf96a8933bd0ed761693c10156666ecba340ada5e1074cf91803e840854872032230
SSDEEP 12288:UEP3RnNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:PntnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T18765126D27ACB0EAE52A517D84918145D373F4A16B5267EF2780823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 b75f8b6dcd9b411d83765727834de67001b6eebb5ce01f69e908bdae270c93c0
MD5 7f0a0fe75f988853f17126ba6320d5d8
SHA1 0a716f32cdb2bf593283dcbea76a763c6498a4b5
SHA512 9e31885f94aa1ea3c28df8410260d67bfc1970a19bda21670e4b49dd81519343b6f599d5c9f710b84b371b443546b2d2aee599d88cae9bab8266797866555c6e
SSDEEP 12288:HjkyuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:HIyunQ/tbw/2Mkjy6Fr7g0oc
TLSH
T13F6512182398F4D6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 fc83e6dea73daa95c0600cbf202d74f521803554b5fde860022704635e42f934
MD5 c5fc01d109ab5bc4569a5d8e825c9ad0
SHA1 6af15e3b464fa3866a3f6174e52fc579bcd83590
SHA512 6c1b8944af75f4991d579ab093a7a2d6a95320d976b9ec14bc2e1fd81d2caa9b400c685d34cf0f7d5a8ff9a2bfc5fdee77a407e5330e5a6f8783a7ce3129a0f3
SSDEEP 12288:EyIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:RInQ/tbw/2Mkjy6Fr7g0ou
TLSH
T18355236C2624F89BFE2706F448928582973B19D17F9163EF3784A239CB7D3D415B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 df192315351e0a989adf6bef0ff1360e7e553beb00d414fb1d2f4a5055f6ca1e
MD5 f8bddb5ef96e418d7c8ab6ea06501cda
SHA1 c68a16a1f032c2cdca1d0fa1d8346b52d6b6c412
SHA512 853e8163871900a6d5ccc602fae55af2bcc147358a9fb89dc71db9ccd18877f19761dba2ec42c0dd3c1b592abe85ea332e2cf10437141afb14e10393e2e1a085
SSDEEP 24576:AQ9MxZKdcz9dw3rnQ/tbw/2Mkjy6Fr7g0oj:AVKZrQ/lFTjN4
TLSH
T1FB558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 d90973c69d9d3232d47130ec6e2707ccbe6fd907cc65a51c2cc6d9a6d41cabad
MD5 1dee63ccf9fc861dc83b83ee94ce8b43
SHA1 081a9432fb592f5c46033eeb5bd3119e15ffdf68
SHA512 7002af00a77c8cc8f35956e1d87989d04b15707b34a1a060d7ad3f4bb8fdd27421491e1d9df7633a978141093300cff466f9d31a47d1934393408b817be525b0
SSDEEP 12288:syoKo2JRple9pCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:syocDApCnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T10B65E01FBB6D90A2E136813C88818645E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f9c65b4d3a7358ae35907878dae8a13605fa77665878057ffcd8d60330aa320f
MD5 84d2de34dee7530fb1eb10cac9cd2ba4
SHA1 bcea0ea5d97d184e4a98a203c54f66886731e84b
SHA512 568f626061ec216497c6b2892557767fe955119d3d3530b67758bdfa8c1a51388778dc5482c244ec4e84496f90e782a5ed5f0bb6ef9d74a08fd14ceaf2fba0f0
SSDEEP 49152:pWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKCQ/lFTjN4:R0zuNIXLm
TLSH
T1BBA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c9501cc24039607e9607a2731fde8a0a7aaa3fbc76a9774c5aaca791a50ae30b
MD5 7eb7463d5fac938b04a96d2b3d9f7203
SHA1 af31d9c9e050ef6f97add927304f02caf955129b
SHA512 0a33e93c1e33120ef629cab0311ebf73eb6c57ab57cc754ca5e032cdad168df648eb0a1f7884134484353f342dfff81a9623c432a2358e802aef09c19a98abf2
SSDEEP 24576:e1QT7EcpfxR+N5AWAz3ooiYtjMqbtnQ/tbw/2Mkjy6Fr7g0o9:zTDxR+N5YzTfjM4Q/lFTjN4
TLSH
T10855B02EA7F855E9E17E85798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 90fa736780f268ae4de7443cad8e01a094ca976a9f0ac8ebe60fc551bca87924
MD5 5efeed5e92a50c7a88d4b4f677b4ba62
SHA1 bc71af924a2ea0cae7522382cde010316d12800a
SHA512 e63d489cc3533c949ddf3fc636276b711acf72e8717b79c4d78e4e577610b06487ae54a8e8f4cc76079a2848acb945c072a6dc0ad75bd71a2edf41367a26fc09
SSDEEP 24576:/TMdOz0FFS+imSLhnQ/tbw/2Mkjy6Fr7g0oF:d0K+imSLhQ/lFTjN4
TLSH
T19275E17E636D14E5E53BC27DDA438906E67334620322A6DB0690C1792F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 2a09fc47b8105dde92ac79c78e48336f27541e34ddfcedc18dd83171143ae5ff
MD5 6d454a1681fc77539c65f448a533f45d
SHA1 423f96b98da317cd0255eac2e336b1dfc0481a06
SHA512 b66ba549f8b279fd612a60b62c0c0a0e71a628880ed6466013a68bc40cb531c6337b95856b12f98ac18c83e078ef64bf28c622de916f1625c0009ea4440091fc
SSDEEP 12288:q4KEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:QknQ/tbw/2Mkjy6Fr7g0oB
TLSH
T17D55122D23E874D6F93752B48962414297327CA22B6167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-614-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/436-412-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/436-438-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/436-422-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/436-455-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/436-606-0x000000000B950000-0x000000000B958000-memory.dmp

Download

memory/1088-358-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1088-364-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1088-605-0x0000000140000000-0x0000000140273000-memory.dmp

Download

memory/1088-367-0x0000000140000000-0x0000000140273000-memory.dmp

Download

memory/1112-405-0x0000000140000000-0x0000000140206000-memory.dmp

Download

memory/1112-334-0x0000000140000000-0x0000000140206000-memory.dmp

Download

memory/1228-386-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1228-389-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1392-309-0x0000000140000000-0x000000014021B000-memory.dmp

Download

memory/1392-144-0x0000000140000000-0x000000014021B000-memory.dmp

Download

memory/1504-590-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1504-354-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1504-351-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1504-345-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1928-353-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1928-251-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1928-259-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1928-257-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2228-230-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2228-221-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2228-229-0x0000000140000000-0x000000014021A000-memory.dmp

Download

memory/2328-381-0x0000000140000000-0x000000014022A000-memory.dmp

Download

memory/2328-277-0x0000000140000000-0x000000014022A000-memory.dmp

Download

memory/2420-391-0x0000000140000000-0x000000014021C000-memory.dmp

Download

memory/2420-299-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2420-304-0x0000000140000000-0x000000014021C000-memory.dmp

Download

memory/2420-293-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2640-388-0x0000000007100000-0x000000000711A000-memory.dmp

Download

memory/2640-320-0x0000000005600000-0x0000000005666000-memory.dmp

Download

memory/2640-410-0x0000000007330000-0x000000000733E000-memory.dmp

Download

memory/2640-329-0x0000000005790000-0x0000000005AE4000-memory.dmp

Download

memory/2640-321-0x0000000005720000-0x0000000005786000-memory.dmp

Download

memory/2640-415-0x0000000007340000-0x0000000007354000-memory.dmp

Download

memory/2640-330-0x0000000005DD0000-0x0000000005DEE000-memory.dmp

Download

memory/2640-387-0x0000000007740000-0x0000000007DBA000-memory.dmp

Download

memory/2640-454-0x0000000007440000-0x000000000745A000-memory.dmp

Download

memory/2640-400-0x0000000007380000-0x0000000007416000-memory.dmp

Download

memory/2640-457-0x0000000007420000-0x0000000007428000-memory.dmp

Download

memory/2640-394-0x0000000007170000-0x000000000717A000-memory.dmp

Download

memory/2640-378-0x0000000006FC0000-0x0000000007063000-memory.dmp

Download

memory/2640-376-0x0000000006D50000-0x0000000006D6E000-memory.dmp

Download

memory/2640-368-0x000000006FB00000-0x000000006FB4C000-memory.dmp

Download

memory/2640-366-0x0000000006D70000-0x0000000006DA2000-memory.dmp

Download

memory/2640-319-0x00000000054E0000-0x0000000005502000-memory.dmp

Download

memory/2640-331-0x0000000005F40000-0x0000000005F8C000-memory.dmp

Download

memory/2640-307-0x0000000002770000-0x00000000027A6000-memory.dmp

Download

memory/2640-318-0x0000000004E70000-0x0000000005498000-memory.dmp

Download

memory/2640-408-0x0000000007300000-0x0000000007311000-memory.dmp

Download

memory/2724-629-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-655-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-621-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-620-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-619-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-618-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-617-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-623-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-648-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-647-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-646-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-645-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-644-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-643-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-642-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-641-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-640-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-639-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-638-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-637-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-636-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-635-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-634-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-633-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-632-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-631-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-630-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-656-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-628-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-627-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-626-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-625-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-624-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-649-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-650-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-651-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-654-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-653-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-652-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2724-622-0x000001B6772C0000-0x000001B6772D0000-memory.dmp

Download

memory/2864-382-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/2864-608-0x0000000140000000-0x0000000140253000-memory.dmp

Download

memory/3156-610-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3156-411-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3156-339-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3180-236-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3180-305-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3352-275-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/3352-270-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/3352-262-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3352-268-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3352-273-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/3840-385-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/3840-291-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/3840-287-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3840-281-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4740-290-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/4740-0-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/4740-1-0x0000000002520000-0x0000000002586000-memory.dmp

Download

memory/4740-6-0x0000000002520000-0x0000000002586000-memory.dmp

Download

memory/5036-392-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5036-609-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5072-611-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5072-397-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5376-316-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/5376-311-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/5376-396-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/5376-310-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/5384-406-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/5384-613-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/5748-401-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5748-612-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5820-343-0x0000000140000000-0x0000000140207000-memory.dmp

Download

memory/5820-543-0x0000000140000000-0x0000000140207000-memory.dmp

Download

memory/5856-239-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5856-248-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5856-342-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5856-245-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download