5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Size 3.7MB
Sample260508-jpsjvaev3v
SHA256 5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d
MD5 61a1bd5f681297dbc2c7c4932384cfa1
SHA1 9514c86e121b77f0fc22f046c7b203ae186cfefb
SHA512 c58746bcfdeb17444b5cda72dab4c1f938c7fee20fdbb4f5221da6d9a5721984a3b3ff3c2d596b00f6607649edafb6692b7aded1fd09d878c954d677cdf7792e
SSDEEP 98304:UG96vu7KZCeyGc4BvekcWAg3fSIRYIa2KS+bbkiCQXtZCh1hA1s40sLm:UG9oekceRB1hos40sL
TLSH
T1FB06BF01FB418472F89300B596B7977E4D39BE20133895D383D43E6A9E316D2A93B79B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution ransomware spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6112	powershell.exe

Executes dropped EXE 22 IoCs

pid	Process
3328	alg.exe
916	DiagnosticsHub.StandardCollector.Service.exe
5956	fxssvc.exe
5000	elevation_service.exe
1048	elevation_service.exe
3492	maintenanceservice.exe
2768	msdtc.exe
2592	OSE.EXE
3528	PerceptionSimulationService.exe
5872	perfhost.exe
3756	locator.exe
3644	SensorDataService.exe
688	snmptrap.exe
2804	spectrum.exe
244	ssh-agent.exe
3044	TieringEngineService.exe
4040	AgentService.exe
5176	vds.exe
2668	vssvc.exe
2872	wbengine.exe
5316	WmiApSrv.exe
2272	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\spectrum.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\System32\vds.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\System32\msdtc.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\locator.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\AgentService.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\wbengine.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\68bd405e8b62accd.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\msiexec.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaw.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaws.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4c87778bfdedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed7d2b78bfdedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060f15f78bfdedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007cf24078bfdedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
6112	powershell.exe
6112	powershell.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
916	DiagnosticsHub.StandardCollector.Service.exe
916	DiagnosticsHub.StandardCollector.Service.exe
916	DiagnosticsHub.StandardCollector.Service.exe
916	DiagnosticsHub.StandardCollector.Service.exe
916	DiagnosticsHub.StandardCollector.Service.exe
916	DiagnosticsHub.StandardCollector.Service.exe
916	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Token: SeAuditPrivilege	5956	fxssvc.exe
Token: SeDebugPrivilege	6112	powershell.exe
Token: SeRestorePrivilege	3044	TieringEngineService.exe
Token: SeManageVolumePrivilege	3044	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4040	AgentService.exe
Token: SeBackupPrivilege	2668	vssvc.exe
Token: SeRestorePrivilege	2668	vssvc.exe
Token: SeAuditPrivilege	2668	vssvc.exe
Token: SeBackupPrivilege	2872	wbengine.exe
Token: SeRestorePrivilege	2872	wbengine.exe
Token: SeSecurityPrivilege	2872	wbengine.exe
Token: 33	2272	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2272	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2272	SearchIndexer.exe
Token: SeDebugPrivilege	4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Token: SeDebugPrivilege	4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Token: SeDebugPrivilege	4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Token: SeDebugPrivilege	4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Token: SeDebugPrivilege	4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
Token: SeDebugPrivilege	916	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 6112	4144	5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe	79
PID 2272 wrote to memory of 2180	2272	SearchIndexer.exe	105
PID 2272 wrote to memory of 2584	2272	SearchIndexer.exe	106
PID 2272 wrote to memory of 5420	2272	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe
"C:\Users\Admin\AppData\Local\Temp\5c68426c05991584e501927c841843f82d886eeb2bc7aae8156eea6a8aaece4d.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tmp123_downloader\download'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6112

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3328

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3784

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1048

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3492

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2768

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2592

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3528

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5872

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3756

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3644

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:688

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2804

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5340

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4040

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5316

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2180
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2816 2760 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2584
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2756 2764 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dbb75e9781ade55c2f7fcdac78e41fbe766b06125343e518c97b6b2a5e708a0d
MD5 da8d93b4fd4141affab374ebce9edb9f
SHA1 22e24d84863e7297bce182288917594f56e602e3
SHA512 1e74ce758c48eb6dcad9290280695ef97c65a6159e8bb690627b42cece8b3f0f943b33012484b0d8c19acf651028c1a7287706b0fb5962d45159a110ec735dba
SSDEEP 49152:Mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnNQ/lFTjN4:23q6HjBpLm
TLSH
T154D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a631d3688cf73c28f562e4f9905028b05d10fc86be891b4a1205388e117bfd3c
MD5 12c2aebae6d0930a7029a6f7d2bb238a
SHA1 5eecb2ccec70ed7e7ba909bb26ba8644a2b94514
SHA512 6c6eb628c0d42c960cc5fc62449f94f7abee844cec92ec327e3ae5d4ed0979283a3abb2d2d16131bd88935d9e2a351ef4f575310fc723691cb5961efb9b64c20
SSDEEP 12288:T1XLsswWkxy2lRq2czAKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:JXYfDtczAKnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T19C75F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 d51961d7e6d8eaaf277521371963b83251189ab44e1141e9becd4f72c49c65da
MD5 0a9e10a6037e2ab0843e5053d096a50c
SHA1 411e5db3b8591b5b832b98dd02223b8087d547d6
SHA512 c581b061252a78a91d4b64f940dab666183c64631535686a0abddfd7169fa8cc2732455bb92e00c41b1a792d77a276f5f9e643cd1b3a052ad54edb0d7e8f687f
SSDEEP 24576:c0Le5ji0hmxirMFnQ/tbw/2Mkjy6Fr7g0os:cPji0AcQQ/lFTjN4
TLSH
T110959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3a69d5c5e6d4fa17a0daa72aa3eacc55237ac13da5675ae14f0a66969435b3d2
MD5 93d128b0551d37c5d9dd09e6c296927f
SHA1 091a8d4e624088c777e9b670deb5cc5b71822080
SHA512 8fd5a770be3b5f5f86d4e08f19a924068b1dc0caa82d6e1df817032bf9992926255caf120e4897abf292eca431e57e6e658ea2ac4ad2bbb363159ca410c4f08f
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWE6q8wyuHnQ/tbw/2Mkjy6Fr7g0on:y/ezSC6vUzPvxHjy8Q/lFTjN4
TLSH
T115755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e4044e77286e9e1e58dd123d304accecb294c1c52adc11f14a8b47f7f2a6ac30
MD5 f7200616a0c84464aac735e4cf0c6746
SHA1 68165d8bc14319d090a55f9bc9171703939d9f0a
SHA512 3c2592e82a1196f65eb73e12cd6926f20d092c26031809fc399fab633620360dd02ccd4518629597017b3404765a78cf097cb080a2d42b594262f312609af914
SSDEEP 24576:RVbqPb88hv/l+6+nQ/tbw/2Mkjy6Fr7g0o9:RVO88hXl+hQ/lFTjN4
TLSH
T132559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 38b4cfc67f99562b6b0c4adc55a2672d2563feb765f048c7af8b85b1a5219a10
MD5 57cf0db8a698f8dddf5208a88b969c78
SHA1 1750afb736f72b97a76d21fba225c3d98aa8d1b6
SHA512 a4d1e5d802a765d76433f63c4621bdbb2dc0b3bfabd72b0c91c03282098494e8c1c10518963d6a6f05d0ce538c7e56f9f6e28f415ce21b97da74c13ba88083a1
SSDEEP 12288:KRZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:KRpnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1415523696A24F897FF2B06F15C838442AB7B0EC1BFD0A74E6B44362D857C39446D7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a0ec6e6739e9b7bca496dca274a3fbd064a3acac7429ee9be96449ca11483956
MD5 cbe4bb57d78d4aa9c54efa8280eac326
SHA1 ff196ff8311eaf549ce0f13abe093679bb72d34a
SHA512 7b2da6db43dec6227af53008dedea8c9102c781cacc6de7e4b293f5143210b64835b07d16db29f3b779e9ed9ffa2d23f9a25f32e0c2e0e642c1e99b1093b1fe3
SSDEEP 12288:ReBNUbTVO86UWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:RJIU2nQ/tbw/2Mkjy6Fr7g0oe
TLSH
T10075CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8761cf0674fb92f8c795be728e05e8424a692854ce74e6a299a3a586ba0587bc
MD5 47d53a9c01e6d7084fb301c49c91742a
SHA1 92d941771ea77f46bb3ba76a610e1518e345bc6a
SHA512 d1049116d30685d5883787b84571c916ca8e440ea4ee4735321b4ab7fdbb5204f442f11ec06f266be31e0a05f78c4be6ce0c218be87a5964398b65ffce9d9b34
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH8:gQvGAdlCEL8c/yRNw5CcLm
TLSH
T11E267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ccc05b5932a00a585d0c36a14fff9ebb4e983169d1fe15542da4bede09adbdc5
MD5 6f0c7ea470e1cadf2fc1661d6fbec6d1
SHA1 d872df3fe7351e46a2196f4a9c8ab37a28367ad7
SHA512 8c9755ccf99c010d01799182db78dacf9bc91e1dc512e4e1586288bd5d0cab063b234cfca46f8794f9c89ee4864632ad82b1ddaf44b343aed19141050d9544e0
SSDEEP 12288:TAwSfxL/2Dc34DLLmt0LDQewsAjgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgu:MdewsAjAnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T11975E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A85A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 770394b80cef3907373add011f801bacd6a7f72787abf34ab365b40da6ac95f8
MD5 adbb9c1b558910408f4a81e13eeee277
SHA1 7e91a63f631387643a7c67c174eddf8815f8e810
SHA512 c89a987948230400a872e65bc27571efb37edef58ecd2ee291252d0ed7f76c5ae2a6d727a736596b92e72068e60805786847b493e0dd2e3a48624af95e412000
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHrL:kUEtQevvqc2W1cpV2EI32
TLSH
T172474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ce36f4f691ab9ea1a133f648bd214be4146683af1c9e9f25405775d078ed19e0
MD5 327b0dc1d8312646e9b2307f0f8272c2
SHA1 c24c74633c457eb5d01a00f4f5f66050633bd329
SHA512 2c0f8ab9bb627f1f490e6771b7857d4e5fd5da58dbd6929de0ac85d9343a66be4a447b0639623076d66628db9ddda5f2e4bf469554dbef93c64c059736163f9c
SSDEEP 49152:rCbRquA/m2yL5zQfFiV+XenmE3/zgQ/lFTjN4:0oqtVjnmoLm
TLSH
T116D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4f3114a1c5677e79abccad14ecb3c2f101fc82a6e2d7cd9a5e3e387f8ec54491
MD5 b62e1bbc987a937b364c562b11ef4075
SHA1 d74dee8d81610e5c10651e2bfafe6c741db992d5
SHA512 f69b65079e1e89ddcbee398274724cccde53361f5cb93c7c83cf6fe416a46486f4d9b5733d9ebd42377549a4be59027f9c745b99dd69d92fff8d80fd4f96a043
SSDEEP 24576:rAhGLJIFoiwtA5l7S53jnQ/tbw/2Mkjy6Fr7g0oR:rAMyFoiq5zQ/lFTjN4
TLSH
T1F135AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2126e21086c03ced26a97e3f37b69f234688616b65026851715994a05797f0eb
MD5 da9155007499f7d76e64ad684eccb773
SHA1 f330e2dd5c4c41f4460c30e971a86433bbe564fb
SHA512 6e5aa655d7cb96779e8936e412617368df9443b7492c6a0063e5aecd658cb5fd1dd0a6ea6e1bf8aa0c2d56400f261fcf7304833c025b63bbcee282f0c94f216e
SSDEEP 12288:omw5HEjsChNVBFgl0WDm+CHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMb:FwuoOWcnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1F475F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 6e8a7c07a4fdb74598446bb77c251578c9fbe11ad5d7f1980bfd2c47bd7bedd6
MD5 f5083b9c2a40e0c9e6feb815b46ab363
SHA1 c9cfcad49ab95afc2f37810671eff83807421a2b
SHA512 fa51def550830763c0f2eaf83f6a00bfb51d6e43e60423b2cd67bd10de0fb07828e2b0520fb3a7b51969fcd0d81cf8ad1ea7189bdb733dd1f3355660fe05d4eb
SSDEEP 12288:wBZ1IyQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:uZu9nQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1B865126A33A4B0FAE6674278CCE28646E7733882677193CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 115f25f91c73eba97107e8ed11ec53b0fadc47322ec244cff6398e0fb89fb873
MD5 5fcc4520922927ebeb93a8f62d1ad233
SHA1 524ca30eec0bc794eeda7382f0033a4d360777ce
SHA512 b121def9a990b77e068a975ad15a2ff2f226af1bdf70e1d6ad7ab3a05b7cd43f5f6776cd8db9ac176b2bce1361efec1acaaf8a1c5d37699438367d8b5c0afd58
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:OQRQyi36YOcPQLvw2gAf+PN3NLm
TLSH
T1B2666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 78a70a35120d1430557189f7ef882f65cb730b190bdf57e512d34319b18277e7
MD5 c1502f9ca3989b5c4e5edc118302cda7
SHA1 d076e372914c0648e0c22433ed6377963310c3e7
SHA512 5bd38526a06eaa6748b7f8b943cf7b4a19784bf00e763c44f66ba2962d80e86bb460c3c017cc3ad30b8b48dc2ff2427e05e76f43a02fdd54ebef1a3b1b4f71eb
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:iQRQyi36YOcPQLvw2gAf+PN3NLm
TLSH
T1FB666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 05e23cd87dbbd659a65ba6e8813c736537af75c66962587879bdc88d433ae408
MD5 edaf0482f5d464f0cba3db59e2f6b803
SHA1 8775e19eab7fc0ff6a8b30b620a70838e41eefb5
SHA512 cc54a06bc3b2a2026a99a43da277cf6a0f01fdfae3b9e99144e248cd9d34ad1f4f20a9d435498807673db91d4c21abeb9683be0951a17986361833e0d3b91d0e
SSDEEP 24576:bwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0NnQ/tbw/2Mkjy6y:T68Qg55nhheWu7PNU3/QQ/lFTjN4
TLSH
T132B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f6caa6e4c80db8ff4dcb96b1da87cd132b4cea5e05ec9b04fc3c570f4986fea0
MD5 794563124499494b1a4e69f71bfcda77
SHA1 1656eff031757f30a2796a90c58c55ae799d1936
SHA512 080ccdc598ff0f21d120804701f769a53531263f4e550ce4c2017eea6202ad5902204c35c02b1ab5c75743668ce639979121e199d3bc54188da4757e27f440ee
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99m:0y5112gYy5azzVvL69nLKnhZeLm
TLSH
T1B8167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5d69b7e9169ef2dbd2a92a4c14d9a27466ce0b451d2c756bd95f4fb6a358158d
MD5 a929407c377a088fbf11bf6473ae917e
SHA1 e3a1caa3068121dd0cfe0eadced577a40e4b2c12
SHA512 2424f18a70e67a748eba2da388f8a690e73a184de4ac45a5525e957e6113c8fa58f2a9ac8bfbdfd39df6fe37508ad67d128ea9fe999ee6435960970e619a78e5
SSDEEP 49152:rB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glaQ/lFTjN4:9u6JmVxd2dVLm
TLSH
T1D9D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d675fcbf162b5a1466050298ede438ce3b178fbaf62bbea76d121f7be6e35eb9
MD5 870790469e924680c5d324dd0302af36
SHA1 446511aa2488c6f9c7b92166a9c05609948ef620
SHA512 a1159071370ea7ee0569842ea396714805702b992b0c53152ef912ccb344c69d98ab41bf2364f55c9fcd0b8162b05ddbcbd5b509237fb9d89b975f312dc75a3e
SSDEEP 49152:M1hpsNoJpF1A6UU44CwH7R4xWQ/lFTjN4:MmifPbRoLm
TLSH
T182B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0d5bb8430cc7435d4055614c9f955719fbd51793880fbebbe4184b2f60277e36
MD5 9ae8b38ca4b35a75e31f49d4e6913fde
SHA1 b3729ba16873b08605ee0229572c58ca768f14d8
SHA512 e78f283a19265f88387f884f693604cf577a27b5e51a383b270d727c692a1f8d03fe4a05468f3211dcd61ee6153fe0ac3e40346e8f66b908718b3758d4ded144
SSDEEP 49152:+SuZQIY0Be2KRRVtOnks6NMHq9Q/lFTjN4:Q5dKTi61yLm
TLSH
T1DBC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a9ae7cc7d168bd34773bf20574514932f62a7a79120f4a1794467cb0ebbca5f5
MD5 49d49184ab4724195682aae6bcb7d443
SHA1 7779c9e5643ec49284e186f02eba2173b69e03ab
SHA512 1f410719c6db8b438f447fedbc4dccaf038103e9565156833db7fa0db3b4adc9afece92766ac9161a42cec8e18090ac31cf2865e7170b5cc4fe16e64c666b4ae
SSDEEP 49152:UhtSn8EApI0figngiDn0AP5wKQ/lFTjN4:1X2iyphULm
TLSH
T17595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 8707b01e8d68cf721cbc36d0de0c628f6f2a5e40b466c5e9e93e82e7f173a132
MD5 e16fbe4af1d0caf69dad9f02a16d00f7
SHA1 bee2cdd014a88b73141ab76aef2a7e23809fe2ca
SHA512 b13c6fac14f9e6fdc36f5a0195c855fca92a862f3272018a306dd0744664d16f6a2c13acc42e7f284467f76aae3dd548e9556bb1cf43a607a863a4b4bce809b6
SSDEEP 12288:oRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:ohnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1AB5523697964F99BFA1706F18C828182A73F0EC2BFD1A38F77482129967D39415CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 4dae6e51afbea951d03dada17946fbc07479e35f182d3239cd0ad6b5d9720aea
MD5 27a52feb35f84b543a60d5e67c65b55f
SHA1 f6a7f7225ac49e85d60be4eb69aa60b08324fd1c
SHA512 10c3ce644e420af976150c4337debd379f661cc2deeaa4dbe4501b121359723c61f74d6e497ed8f9481a17a5e2a15fadd0dba394fa2d497a4ea913035d00f437
SSDEEP 12288:mkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:mEnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1BE5523697964F99BFA1706F188828182A73F0EC6BFD1A38F77482119967C39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 e80e8b5788455218be3791bf9a4d1bd4713b1722f53fdcd2c0c76c20b52e64e4
MD5 69a1d82dcdf5d080edb96b07b88bf9b8
SHA1 52422522d8f838c457d16b7551d216d8de1ea3c0
SHA512 87d4d921c2169afb0b47e49f6abbff107ac123d72f14b03ac14049d8925d6ec861b1a570421867151a156156ba669180e18fb0331ebdbd03406c1746e2e56569
SSDEEP 12288:sOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:sOnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T14D5523697965F98BFA1706F1888381829B3F0EC6BFD1A38F77482118967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b36efe4a07731879e59d8671a13d9e3157bca0a218e7cf44ceb2648669030823
MD5 3566531883703b2e44e7c3aa9d4ae501
SHA1 b4f56d4ca0350245e05364b4c58c4061f506d66c
SHA512 ddc5b57ade2296523639dea496623342621f17cdcbb2effb622ab2850c9bc9e87d9ab836c59b7bf14c5133e7659c32e7cbfe2bbee3f95ce5a64ecc739752ef5f
SSDEEP 12288:WVTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:InQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1B65523693A69F4C7FD2742B5CC938142E77B3DC1BBA1A3CF6B0411194E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 ba0bde1da44dc912a08359f4449b20c2093582cb2e1843c96271a9a9ab1c50e4
MD5 b5674772c8ec4f5ab55972fb19eed8c7
SHA1 f76b8472e15a7b4ac352e406fac66250ebea86e3
SHA512 81b76fc751b8c26ce78b28b4fe747117c897de06855168f457d2b5abd26982984bf221442572430179aed020e9caccd55c245a7026154e7f1c8a7fa08cca6462
SSDEEP 12288:QbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:QLnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1E05523697964F58BFA1706F188834182AB3B0EC6BFD1A38F77482118967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 8fb196c1dc538bc1c948bb6a8703bc8df2037e93ce956a5eeab34a62c36b701c
MD5 f083aff4a0069f6fcf931b0f92cecf86
SHA1 267f8bae3c048d04b8da729be67a15bff425fb24
SHA512 0df34ace0a25d1eef1ae655e1505392b5618702ecbe38fe2bba1a51f64996a0f5e477ecf6d875f224fe85a757198485918f330733c11a93640e9012b949aa78f
SSDEEP 12288:g4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:g4nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1065523697964F99BFB1706F18C828182A73F0EC6BFD1A38F77482119967C39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 b141496453c193565e9612b99e5092d0b4e83cb2e31d3c6342a48ed8a2ae69d8
MD5 7ff23754023aebf9646efa1082e3c483
SHA1 a16090aff9e5a689a3bd990c83612b5577acd316
SHA512 9f97f820ce301e9a77290670193997471448dd18d0776e7a75225762ccbb898dd45d482ad72eba2efc9d5830a4bc84c410a8e72eba41976354728057eaa0fbd9
SSDEEP 12288:JsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:JsnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1AF5523797964F98BFA1706F18C8281829B3F0EC6BFD1A38F7B481129967D39415CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 36f6a0348024ee6e3f708f90376e0667908479ab3c5ce251c4eeebbfc7efdb95
MD5 3e70751c38adfbd5868c4a35eee76a2b
SHA1 4123815bd5ecf5abdf57b22f34eb944ab30f85dc
SHA512 dd35174c5ee8d5674dfb5a9a70b9779a4605460bec5136acccd32aed731cf82a344318be483611a27a985e72db4a5361cb9cfbae93579743fc2577890f377cad
SSDEEP 12288:EiZwb6zzFEoS2cPvyEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:nZMSzFVSOknQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1537501A5B36058F9EC67427ECC528906D7B27C5A1BA0C70F13A4362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 33810ad9ff5c6bc97c2ed3f57967e6b7ac4cbe8a532c801a2f007f25d6aea6c1
MD5 cd8234e90dba3e15655cb2a2d5acd5e8
SHA1 b327a4aca06f38779937a45ea8cfc010793bb200
SHA512 2a2553c93154607b6a915bd1d0ed33a014f7db01d81919c67a0dc0ad2a3c9c037d058e1e0d092f07515e714e3a8abaaa5bd02af124dd0aea4e368fc5fe808efc
SSDEEP 12288:ZNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:ZtnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1235523697964F99BFB1706F5488381829B3F0EC6BFD1A38F7B481118967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 c873b872a53df61ee2e6b48fc2b8790b3f29d74d7ffb304372bb06354ee251bf
MD5 d6d99777b84487290ee5cff75e36f263
SHA1 c85c8aca57174ca29948a14ee472eea7d408089f
SHA512 b494923e17e01afeed2d1d5a10d6cade482263e1e665040da79266fa992aca971affbff1f0bd4e51d87f33c6a8b1f450123b0a5cdd6a5f5120b037014b76c515
SSDEEP 12288:kJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:kZnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T13A5523797964F99BFA1706F14C8281829B3F0EC6BFD1A38F7B481129967C39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0df929e49b7e39d8f6dee43aad602d2c967f9c17377efe31924cff97ccec783f
MD5 5e61df9e78afd40813adf8fddc058fbb
SHA1 b16d7ca286ec3c21f72e837cb3b0fcdc4b1f8742
SHA512 225ffc4793b8e54406f151ba007ae0a360529bf0be4c6d2aedc34a243d16f2bf29bd60ed76964278c50e6195c3fd38b2647b953d1a2bad40401f742ff1ac7c36
SSDEEP 12288:6yPz5L8QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:nzywnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T10865021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 f9d33545196b24aa3f67161a5aefa8b3980a025b5aba3eee5f98804f7673b199
MD5 43ec75c81aee6606c1ceefdac4b71665
SHA1 b8e0513a358b0ddc347413a5ba20b7634b6fa959
SHA512 2ca6b542a172d1322d0aec8bd37bf1ae0d765dd10a2bb21a09f577fab60d30c979974d7d87f461c02757e241651594f4d66692304402b95a78473030d46d9986
SSDEEP 12288:tNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:ttnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1675523697964F99BFA1706F5488381829B3F0EC6BFD1A38F7B481118967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 2acb5a4489a67e08bc2a341d8fb75eb83608ce4ead630beb7818a176d5d3d50d
MD5 e89f8ca4d5649806bb86ef2f613a00a6
SHA1 5cff9e8ec24880611b187457fe4ff2f560d357d6
SHA512 b511cd0eff72ab47b76eda4b3c36e3c80a6845e2aea434e9d0e22d74827eaeae50d84ad187aa062179af934757ad8b24435d2cb637396560f067ee5b2bbc5686
SSDEEP 12288:qNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:qtnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1405523697964F99BFA1706F54C8381829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 34a93c1696bf00645b520a8a78e4bfc6b3bec2469af4c3de655026acef4fe6a1
MD5 60d6563cc1b0a495b6301d1f34ebfe94
SHA1 bb066bac265a3787c696a5761ec6936774249720
SHA512 c72a3c72651f059b1a012f81b2ac26f285b40d6983ac2583e7ef7393bb8e349972c883b638489f4d1bddd35397361322d93d21efd44b14df1be109984bc5c582
SSDEEP 24576:mCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvASnQ/tbw/2Mkjy6Fr7g0oE:mCUxPTY+8Wg2lIL8lrIUJLWwLQ/lFTjG
TLSH
T19C65BE1EA3EC0896D4BB817589518A06FB72782E1B22D6CF2160C33D6F27BD55E39F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 09f134dac9293875632d327bcb76cd4e3110e46315e288f96eaa04328635b04b
MD5 34ca90ddecf1a0d460f3a7dc056a2e0e
SHA1 0dd15ef132d23767c0dd4c0fd659a35ef86ce06a
SHA512 3af28ccb63d503a7b7bf569b3165c20c92029728749235565db4d48affa99613faaa6050239766ef3b77858a5ff90ebeefdcfabaa46f6906be711d750e28ba8f
SSDEEP 12288:4NsfdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:Z9nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1DD65F019E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mz5wug5u.z5p.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mz5wug5u.z5p.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\tmp123_downloader\Cache\e580fda\config.ini
Size 1KB
SHA256 96a711171a54c4e84ce0653e3c8f382c486a2def6479d444ad58bcbe4bfe34ef
MD5 2463f86af826660eb9175d68f92d354f
SHA1 e69bcde703fd29591e54f307d2a79748aa1d0c27
SHA512 9f4a241c9d97ceb924646f9bbd4bdf7c142a5f5aa47b05070f9e1151ee519e66490c8a4f64e01dab4349007d26d6695422497bd3601ff3406e50ba7d0685749d
TLSH
T163219C1266F96168B533BA9DEFEE80B59B33FAD5201BC65E10D0010B52D1D001B02BBB
MD5 SHA1 SHA512 TLSH

Submit Download

en.ini

Path C:\Users\Admin\AppData\Local\Temp\tmp123_downloader\Cache\e580fda\language\en.ini
Size 2KB
SHA256 52aac0a2c096114d737fbdcbd42bd851e6d60a1ae9bd586b8ebdf64db2ca5158
MD5 1d9a2fe4ab2ea4501cc1ba2cfaee2a2a
SHA1 4436032525760f0ccc9b182c9b1817021cb6be8d
SHA512 5664932b73aba74eca5d811f00e0bec99d66c2c86af9d5f32c798588b8fc9e656474ed70595176c6210b21b759c7a317dfbedacd1eb427b45d963e6c7e3664d0
TLSH
T17851D05262E83059B6F77F88FFFA91E88B76BDD4993EC57E1181000F06E1A148A61773
MD5 SHA1 SHA512 TLSH

Submit Download

language.ini

Path C:\Users\Admin\AppData\Local\Temp\tmp123_downloader\Cache\e580fda\language\language.ini
Size 1KB
SHA256 e35032a983c4a738616087b7c87a5625c9c5a7fe54d40b0435117a78093ca34d
MD5 fab083e7bf4be35f271da165f0824415
SHA1 de47077489b4cb7df9157463279804b78e15c642
SHA512 d39e7d44387b31e4a34cf6cfc88f5c535631be767ca72ac741152754eb7f4b2d392afb98077e2ea5aef28d2dbeb6f0783dad3899660a777fee5ebcb0729515f0
TLSH
T16941BE2721CCA14DB9F76B45EE7044B97B29BC555C0FE86C66C5261A80E2840DF329F7
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 7dbd3b661604fa62701f641b4be1f24ff46bd4eb30fc75fee7c6815eb5fd89e5
MD5 9d9a688d2785dc0954838ef77e36eb03
SHA1 514e05bd6f7496983e0218ce31e663aaa9e55ab7
SHA512 c7fa06c6b6cc2cee54bee2e41b56505a4403d3b4f095247e5f3a2c49ae67459bda359706f7543026ff49c0d5c48cabaf1fb3ebbe5a753bfb407f18949fda2996
SSDEEP 12288:/uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:/unQ/tbw/2Mkjy6Fr7g0o0
TLSH
T12D5523696668F95BFA3B06B048938111673F0EC5BF90D3CFBB042269953C3D41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 3300612b15564766536a8f8742347c823092f45e7c2561ac5a46d8dd9faa311b
MD5 512629e5230df86cac30a773833d2c6e
SHA1 e61bf0160f766ead6e5529e7df0974701de4641c
SHA512 2a963a4c2a41fc1b53cf4a6ff754d444367b6069389c779ed7b9e99e37b02e14b7d8d3cfb2a7e9e378f25c3df65d3567f3e50b598538ab8c28a47e9cd4636706
SSDEEP 24576:h8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCgnQ/tbw/2Mkjy6Fr7g0oo:+RZwQCyiHiQEaaPnMlQ/lFTjN4
TLSH
T1A185B01E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 c4f1e9dd114a5b8b1c656da4e223ead730418b91fbc3769d6e48d36e4ab6b070
MD5 b6903c2cb7ce3cf7a270f9c4ccc62992
SHA1 0cfc64de3e5369e013f205a8dce1eee524dbe07d
SHA512 c84108e252bc62e37f1023df2b9042ff3b7b75390cec03fc17b408c9b2d9f3282852a415d646660f89d60aa2c11f4754ad0b6e691672a46974314c3bb31b4dce
SSDEEP 12288:hbxA1U7KeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:hbxA1UGenQ/tbw/2Mkjy6Fr7g0oo
TLSH
T18265123E26AC24E6F536967D88D28106D3327C56676193DF2284823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a7afc4b6596c14ff206401abf33533d86303e59c9c3c3c0ff509b6ba97a8e2ab
MD5 6bec2a367a7b0dcb22f3f4f89904dee5
SHA1 bb0be54f3e331df687245917ba3b384892ff0b8d
SHA512 6e2b614969f2ba23399d3b2af3e38da302776dba7f1f79e97c06f3ee0d345a3a12218f00bb4d4a58751d79f0e7ab8863122657e6a03a53c22cdb64f76960a105
SSDEEP 24576:ZjsmP0yHaqrVqHra44KDzMsrnznQ/tbw/2Mkjy6Fr7g0o0:ZjRP0yHfVqzlAsrnzQ/lFTjN4
TLSH
T12345AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 a66c753ed635806d93fa5caf997a4b2c3fad7c1d783438ba94cfcce66e0a155d
MD5 5a0aab432b12bf3c7e2e042e8f80898d
SHA1 0a527d31d6836ddd13a8bcab449382b5cc801070
SHA512 77db56cc7d1b18682dd923b45ee8474370eac96483df9b4a5b3c3817ab1629cd03c3d99019da101d40b0e49e232c4d7df2ac960a3d1cb6432b88ebb99c59f520
SSDEEP 12288:KYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:KYnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1F05523697554F99BFE2706F548828142A73B0EC17FD1A3CF77482129867D3D40AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 f5ba04b03dca6ab4b4c54ba165943d1294aab51b3ab9e50b0c981e987ecc19aa
MD5 20cafa0ec20133f531d5238c11f581ef
SHA1 dddfa02916c0c10ca305f94364750cae38d6335c
SHA512 d3922479a2e788327c1bc6d049f618b4a47f88369b59f20c8f2df3001005262b05dd1ba9a30c3314c86c3bd4d32edfdafeb5204a99c343de325f533d12d19a66
SSDEEP 12288:0Ob9A4LWO+vAYFTKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:ZpLBUTKnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1A785F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f096f428507a29c6ae46d26ea05df1e37cc7995b3ca7a1ad743fcde705b8adfa
MD5 6e3975c574a363180d2e999c014a203f
SHA1 2f760ee37c35939e035d5b4074646eca09f15620
SHA512 03751412edecb9893f7f40c9992b17dcaa7b0f0795e648da44d17fa8d171e34e08e34248f5d1c16f28ca9989da99369519f7e93f5b5c24d8508bc6cd71531cbc
SSDEEP 12288:g70VmvIYNvUyBphGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:9rYNHPnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1F375F12E62AC1CE5E53B91798AC38209F2737896175193CF15A0827E0F37BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a0848a7a55192149f027cbbd113b3f2ca425e33ce1a9061948e41b4ef346994d
MD5 6e0cf805f45d3be0ff970d6869a0b2a2
SHA1 07649546a7e80d0021e5bd01f299b66175c02266
SHA512 86f0aff6c57aff833928ba1ffc40fc4cb4c317fdb011bb9dc20d7684aa786b89d425763683703f73580ff802c0e5057235a649c2807c59735cbd58cfde869b47
SSDEEP 24576:HnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKn:HnXoJJYH84VVS6AmEcJas+cHBjSSKHPK
TLSH
T10065BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9edb7c22df029e02c795065c97c588fd33ae922c5fe3ea90ad346477593958f9
MD5 7b994ec35c4dc79c4b011fe8c12a0ad2
SHA1 d7c1b36ed6468520a098b7168f3843435108c946
SHA512 70cf3993cb4010050f68e090b13ae2d1d4850e4bf0c498ab06e0166e287ae99e6a7a5648971f77d9b511c635b6f9de7009ffbb87e0e9d0bd2437bb2482b37d7d
SSDEEP 24576:zv7Xbxd9Tuycf8M/TYlSuxwr2PCJnQ/tbw/2Mkjy6Fr7g0oy:zDLL9TuJ0M/TYW2P4Q/lFTjN4
TLSH
T114858D5EA3EC52D8E47BD6BD85A39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 3f147b6181d56d18f0a622ed846dc103ae6d19a2332bd013ad17f0e221d45d85
MD5 3ac3c76503a03f2edd14e16027bf2fc4
SHA1 ba54f11484450b7287552efa1b3a16e049180790
SHA512 c34d480740810ec98c682a0bc9cb08417dc91f9dcab466e6293bdad6a5a2ae56c094e435306186c1f1b6f7116d21e1c1f92ccf208f00443ef8d5b66a60fbbc65
SSDEEP 24576:+egJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wKnQ/tbw/2Mkjy6Fr7g0oK:+ngOJOmPOHhKQ/lFTjN4
TLSH
T1FA55BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 d74dd93454cbf63f7e93f9913cd670a25eb93676091b00389ad46ee42304ed39
MD5 c8668d9b4ee06f311348e5d4447c7303
SHA1 397bc48f336766076edb7bd58d4357c336a74e0b
SHA512 6451296bee744c29064678c8aa5e4cd28b9e654bfd13aafe1e174da0c3671d1337374fe10fe710eeb4846838f43c24b673130d862e3a0be29ca214c261030d5c
SSDEEP 24576:MLJnJiTk3R3waE4JrO4nQ/tbw/2Mkjy6Fr7g0o9:MLJnJK8R304lDQ/lFTjN4
TLSH
T14A75D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FE06A79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d5e68fb5f1715671f10362b27da558dbf2a52a892f76e43c3189e6bc81d2572c
MD5 fce012c2e0b7ecf8d8e61963030375f9
SHA1 3b32329b7f7049102c79ff0e2ba4b1f9657061cb
SHA512 0e8664e0642c40365fcc16435a81c9e795024758850dc8dbb10db9413d7d6db45416f5ab7ee9337a40d9df53b3c2777d213bf77686ae5f9a3151ab6dcc7aaae3
SSDEEP 24576:SA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pCnQ/tbw/2Mkjy6Fr7g0o4:t9GqCzDScAZmlvTcFg8Ph6sQ/lFTjN4
TLSH
T1D5955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 ac86c4aee24d0e722733ecb0db2e944a256983179ec9c5c2920d238dae199955
MD5 6d3803c0a455c97cd5985056ec03d517
SHA1 a1c55d742053f3abfe10c31c4a64401f129e642f
SHA512 57645bbe1127330b8605d00c698995c23623e042eb726d848bc3e80f0fda10dbc080e3178ac1d3aaedaf6b06ad0d85bad728cddea1e182e178c72dab1e7c07d0
SSDEEP 24576:ulYJeXm5jUuE6nQ/tbw/2Mkjy6Fr7g0oe:ulYJeXmRUuE6Q/lFTjN4
TLSH
T11A65126D366CB0E6E22F41B988924545E372B4A1274163EF52D0C27D8F7B7E51E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 bc3753f1946ed70ef84eb97ce466cf9ccd5508213993a4092566365f98e69aba
MD5 0e13879d7da0df3aa88b8b03f90b6c23
SHA1 f9d553bbe55971acf1abafe0fda6ef103fcbb5dd
SHA512 2bfb27fe643405560963a591861ef028051b32fe1ecce669551f8688c2c2bcf7019d612052ab9a85fb54df3354c74d111fa45d368ad710de83d364dfbef53ee2
SSDEEP 12288:Twu6kyjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:TVtyTnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T17965121833A4B499FA7A0678CDA38181DF3A7C50AF5093DF66C0E23E5E3A3D46975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 b985f2cfd036aedc890e38b1b885a0b8b0e56c0e7fcd040a3fd2a2f77339325f
MD5 8b2023af82119d78bc5dc602be749ae3
SHA1 00be6fec4765a74664248b845d1b4190459b6eca
SHA512 6ae1580717cc6f5b635ed00e715b80731a82a375f5a087084aae754b95e3d8267a627025ff773287f4dc35ca4c795316047f8597fd7bbf8e645817dd520edd36
SSDEEP 12288:8PKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:sKnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T19F55236C2664F49BFE2706F448924142A73B1ED17F91A3EF3784A139CA7D3D019B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2c22f3428ced7d3f38497f704bea3865c8c5765b8e44fb3bd89ec0034747a310
MD5 9bbb49839c216fee496482ea055f9572
SHA1 ae35b8ef1328ca13effdac8061e1bb0f794b7119
SHA512 f9da86f95fdf49345d316fc97106ed6d1b57491054b3c7f052e4ae33b920fb2f47265596c1a70ec4f5acf606da5052cad35983ca56308c5381eb9d128912f6ae
SSDEEP 24576:PC+TyQIu93VAumZr7jmdnQ/tbw/2Mkjy6Fr7g0oF:P/TfIq+YdQ/lFTjN4
TLSH
T15A558C1DA7E91DCAE276C675C8A34493E633B872176186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 f2aaf52bb041d4e61a6253ec3bb748caf1b856624ee07ab8741a6a014f76a5c6
MD5 9ec0d86e878fe101fb629d74342a799b
SHA1 cfe76b8223b42e3136b7222d7131ae8b456d3dae
SHA512 3ca49cee16ea1d0df3c13ac2c104fa0659b59d09380d75677b698336a51daf225f8ec204f75dd679ef9f294a9ec515d3ab90f038f0d3d71d0aa01b73bb1638a2
SSDEEP 12288:ccyrWOstaa3kcsmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:ZLQikZGnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1CB65F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6c0a643e7e3c9f48a5096ebc74b2ed40a191cfc9a791482dd9d36aceb907b5e0
MD5 28b3db01cc06ab4a02a0cff11e903d17
SHA1 d0fd7428472c22c28a75f9b861d5dd22717c076e
SHA512 679cd64682f9a076d9866bde360bd90529d22d021ffaa97df4023379d44ed54236dbc809e15856cb1bcf63b194f8e8c7d2ab8189e9c93690abcf93d0e982d726
SSDEEP 49152:7pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPTQ/lFTjN4:QpC7b4+80GTknLm
TLSH
T1F1A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 586546d1a77c883e5657a80f1d8695a1944e50c09e3288a03a087dc47640a3ed
MD5 558469d72973c79dac77bccb25960f59
SHA1 bac89ce06e70aa2259468604366e95b26e260011
SHA512 a9d4d20a708abf6849b1554ab8ebe35d4e5b14b5e1439d6381459d28869c19b91aec518acd1419ddb25c037a5d0bdae412c264578ee4606fc25a61871bbfbbdf
SSDEEP 24576:OSAwJPE1IDAo+4Kt+l44135UQrnQ/tbw/2Mkjy6Fr7g0o0:OqPCIo4Kol4/QrQ/lFTjN4
TLSH
T18F55B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 fe6818d02da162784439686b1e07d4cd90c7ecd7f133ca977b1d9e93d1caa106
MD5 cef484c9b5050796d6cbe2c4164146f2
SHA1 7b2808f0ef0f8ef569ac88df6d835b39585e4418
SHA512 65271c8c2d8027b8505aad5c58abcff606a83db2828319055496fa60728baf10ad6207d7050486f444b18c9a9e0b546058ff65a33fadda45c6b3da1f886af95d
SSDEEP 24576:CyLXPLcM94tbnQ/tbw/2Mkjy6Fr7g0ox:Cy7PoLtbQ/lFTjN4
TLSH
T13385E03EE66C08E5E53AC27CC6A38506F672389D037166CB1A9491791F7BFE46939F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 e300a64ecb8dd15f683c8be2eb3adf9e1abc8e2dd7d41a8f5e706d8b438b4735
MD5 953d5ba5f15b010d9fa1b258bd3c36c7
SHA1 49baa99535968ecb995e7bd91efea2ecfd82ef97
SHA512 d654ba689bb3434c1b650fa20523713e64f5404f722474f78f1c95adcda545dfc2d23b25704e99e23e07c97520f08a9bb3faf26c1cf819c2db9b34d891ccb2a8
SSDEEP 12288:h9lyvj3IkxjbBz2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:hWv8qjpWnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1F065126E26A4B4D9F53A0274D863815692767CB227A4A7EF32C8D57E4B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-356-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/244-589-0x0000000140000000-0x0000000140273000-memory.dmp

Download

memory/244-363-0x0000000140000000-0x0000000140273000-memory.dmp

Download

memory/244-364-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/688-454-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/688-340-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/916-234-0x0000000140000000-0x000000014021B000-memory.dmp

Download

memory/916-223-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/916-229-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1048-256-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1048-362-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1048-259-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1048-250-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2272-619-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2272-445-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/2272-409-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/2272-425-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/2272-397-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2272-400-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2272-391-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2584-639-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-638-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-658-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-656-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-655-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-629-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-630-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-631-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-632-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-634-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-633-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-635-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-636-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-637-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-640-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-641-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-642-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-643-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-644-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-645-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-646-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-647-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-648-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-649-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-650-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-651-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-652-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-653-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-654-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-627-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-628-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-626-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-625-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-623-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2584-624-0x000002417E780000-0x000002417E790000-memory.dmp

Download

memory/2592-288-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2592-292-0x0000000140000000-0x0000000140240000-memory.dmp

Download

memory/2592-282-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2668-614-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2668-380-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2768-278-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/2804-351-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2804-348-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2804-342-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2804-539-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2872-384-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2872-616-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3044-369-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/3044-608-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/3328-221-0x0000000140000000-0x000000014021B000-memory.dmp

Download

memory/3328-312-0x0000000140000000-0x000000014021B000-memory.dmp

Download

memory/3492-277-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/3492-274-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3492-268-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3492-271-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/3492-262-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3528-304-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3528-307-0x0000000140000000-0x000000014023B000-memory.dmp

Download

memory/3528-298-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3528-379-0x0000000140000000-0x000000014023B000-memory.dmp

Download

memory/3644-617-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3644-399-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3644-337-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3756-388-0x0000000140000000-0x0000000140207000-memory.dmp

Download

memory/3756-333-0x0000000140000000-0x0000000140207000-memory.dmp

Download

memory/4040-373-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4144-291-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/4144-1-0x00000000027A0000-0x0000000002806000-memory.dmp

Download

memory/4144-613-0x0000000000EA0000-0x0000000000F1B000-memory.dmp

Download

memory/4144-6-0x00000000027A0000-0x0000000002806000-memory.dmp

Download

memory/4144-0-0x0000000000400000-0x00000000007BF000-memory.dmp

Download

memory/5000-247-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5000-350-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5000-239-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5000-245-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/5176-612-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5176-376-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5316-389-0x0000000140000000-0x0000000140233000-memory.dmp

Download

memory/5316-618-0x0000000140000000-0x0000000140233000-memory.dmp

Download

memory/5872-323-0x0000000000890000-0x00000000008F6000-memory.dmp

Download

memory/5872-314-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/5872-383-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/5872-328-0x0000000000890000-0x00000000008F6000-memory.dmp

Download

memory/5872-615-0x0000000000A10000-0x0000000000A8B000-memory.dmp

Download

memory/5956-238-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5956-293-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/6112-322-0x0000000006050000-0x000000000609C000-memory.dmp

Download

memory/6112-310-0x0000000005AE0000-0x0000000005B46000-memory.dmp

Download

memory/6112-308-0x0000000005360000-0x0000000005382000-memory.dmp

Download

memory/6112-611-0x0000000000C60000-0x0000000000E0C000-memory.dmp

Download

memory/6112-607-0x00000000076C0000-0x00000000076C8000-memory.dmp

Download

memory/6112-606-0x00000000076E0000-0x00000000076FA000-memory.dmp

Download

memory/6112-605-0x00000000075D0000-0x00000000075E5000-memory.dmp

Download

memory/6112-603-0x00000000075C0000-0x00000000075CE000-memory.dmp

Download

memory/6112-261-0x0000000002B40000-0x0000000002B76000-memory.dmp

Download

memory/6112-569-0x0000000007590000-0x00000000075A1000-memory.dmp

Download

memory/6112-557-0x0000000007620000-0x00000000076B6000-memory.dmp

Download

memory/6112-313-0x0000000005B50000-0x0000000005EA7000-memory.dmp

Download

memory/6112-540-0x00000000073F0000-0x00000000073FA000-memory.dmp

Download

memory/6112-516-0x00000000079C0000-0x000000000803A000-memory.dmp

Download

memory/6112-517-0x0000000007380000-0x000000000739A000-memory.dmp

Download

memory/6112-273-0x0000000005440000-0x0000000005A6A000-memory.dmp

Download

memory/6112-504-0x0000000007210000-0x00000000072B4000-memory.dmp

Download

memory/6112-487-0x00000000065F0000-0x0000000006624000-memory.dmp

Download

memory/6112-309-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Download

memory/6112-501-0x00000000065D0000-0x00000000065EE000-memory.dmp

Download

memory/6112-489-0x000000006FB60000-0x000000006FBAC000-memory.dmp

Download

memory/6112-321-0x0000000006030000-0x000000000604E000-memory.dmp

Download