c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/05/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
Size 791KB
Sample260510-menppadw2v
SHA256 c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed
MD5 0502ddc718a6ecdd6721f42baa4594f5
SHA1 3978953fd06e1d985dae94050ec640202eda0abc
SHA512 1adbac470d2b01c0f4ee076e5a5fb6706d46804097da7587a56a5a99a0939e64e8e440fd794f0b8441e2fa70c6429c89b9b8c6e79a4c2153fbdb14ff36a15ca5
SSDEEP 12288:JrrlVnbiDZ3NJWDl+caqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:JrrlC33WDl+caqspzB7B3xiHrPq
TLSH
T1C105F120330684B6E79607B15DA8FAF95068AE784B9581CFF3B87E3999314D3193361F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5068	alg.exe
2904	DiagnosticsHub.StandardCollector.Service.exe
3064	fxssvc.exe
3428	elevation_service.exe
3980	elevation_service.exe
2524	maintenanceservice.exe
5028	msdtc.exe
396	OSE.EXE
2780	PerceptionSimulationService.exe
2952	perfhost.exe
3504	locator.exe
1152	SensorDataService.exe
3788	snmptrap.exe
1700	spectrum.exe
1084	ssh-agent.exe
4288	TieringEngineService.exe
844	AgentService.exe
3148	vds.exe
2696	vssvc.exe
1864	wbengine.exe
5016	WmiApSrv.exe
2564	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\System32\vds.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\dllhost.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\System32\msdtc.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\locator.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\vssvc.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\19dab7b8c8368bef.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\wbengine.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\spectrum.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96484\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9aee40267e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac04990967e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a711280a67e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000462f620967e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000411aac0967e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009331240967e0dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000076a5d0967e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2ede20967e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000427c700967e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a319d60267e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc2ba00967e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2904	DiagnosticsHub.StandardCollector.Service.exe
2904	DiagnosticsHub.StandardCollector.Service.exe
2904	DiagnosticsHub.StandardCollector.Service.exe
2904	DiagnosticsHub.StandardCollector.Service.exe
2904	DiagnosticsHub.StandardCollector.Service.exe
2904	DiagnosticsHub.StandardCollector.Service.exe
2904	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3852	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
Token: SeAuditPrivilege	3064	fxssvc.exe
Token: SeRestorePrivilege	4288	TieringEngineService.exe
Token: SeManageVolumePrivilege	4288	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	844	AgentService.exe
Token: SeBackupPrivilege	2696	vssvc.exe
Token: SeRestorePrivilege	2696	vssvc.exe
Token: SeAuditPrivilege	2696	vssvc.exe
Token: SeBackupPrivilege	1864	wbengine.exe
Token: SeRestorePrivilege	1864	wbengine.exe
Token: SeSecurityPrivilege	1864	wbengine.exe
Token: 33	2564	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2564	SearchIndexer.exe
Token: SeDebugPrivilege	5068	alg.exe
Token: SeDebugPrivilege	5068	alg.exe
Token: SeDebugPrivilege	5068	alg.exe
Token: SeDebugPrivilege	2904	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 4876	2564	SearchIndexer.exe	109
PID 2564 wrote to memory of 3248	2564	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
"C:\Users\Admin\AppData\Local\Temp\c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5068

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2460

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3980

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2524

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5028

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:396

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2780

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2952

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3504

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1152

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3788

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1700

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2072

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:844

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3148

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1864

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5016

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4876
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5903c61aeab9cf7cf4480dca7d030fc9cb63d49d438fdcacf50d1e2a9eb36342
MD5 bc573ce3ffa60a3ebc87d089a7de77ca
SHA1 d2fdf2a613e9c90f09004a4fa23570eef73c7803
SHA512 b7db2f66b57b2a048bd5a5605e28426ea35b52d8b141fe2acde5ba7f1da43130af82ef97a50a955aac8e2093ffb619b956eec18ffb9321eacd5488c82a2a3e99
SSDEEP 49152:Cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn5xpBG7q:k3q6HjBYpBCq
TLSH
T199D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 fd2e2b1d32121da6ce3f73312a7b199f9d01ba999a2f44472e4ed93646ec5df8
MD5 ec595572519a2f6aa0f4bc23ded94e06
SHA1 7dd372d5db407b642a1f459f8c923a31c01b9f27
SHA512 3d656f52b835c187e82f4d4e8c01b4e3a8d13427085bdf3c7aa3bf74bf6d5ef1bd3332701ed2417cee68d3f72f911947a48de66f18f6d46cdde03714652bb98e
SSDEEP 12288:G1XLsswWkxy2lRq2czAQqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:kXYfDtczAQqspzB7B3xiHrPq
TLSH
T1E905012873E408FADD678279C9A28105E6327C9587A4E7CB03E4E9264F337D85E3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a2432e151dfbb404dcca2701adf9dca19b88c5f73b002045535fc7c768ad8d28
MD5 1a1d733413abb5c1f13c6574ea1ef1fb
SHA1 d6e1e2d3c8fc2b41dcba0628243cf7e07355c5d4
SHA512 34867f6ccb70349225f1be96e28e84ccbe8cd0d5d35d50ff7bdcd490562fa2fd532d96c0f77f00181853c619066958a7c3f6084763d423188e0385cba9bde098
SSDEEP 12288:9XZNYVLeyUji0h90ZD0wxpGZIVuFrHs3qyDpCstpdhOWjUse8PBUAxxue6HqAhp:T0Le5ji0hmxirM3qspzB7B3xiHrPq
TLSH
T1FF35AE16F6748371D073C0B9C5D2A68EE97130865B308ACB4286D77C6F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b53e0dd4062422d649d45c36739a8a2e96ce4598c392e8fe711dce446c0c16c8
MD5 597be92dc962f7645f8b086f6d0f0590
SHA1 72d76c378bae995c0a89227203cf2a600734a0ee
SHA512 1037176139b05e578aa1d302d720810e3290b6e0f9330192780c1af9661834e7105f2494a7bbe3a1946b708bcab4af72d6184310f300aabc73a56bab0c07a2e3
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWE6q8wyuVqspzB7B3xiHrPq:1/ezSC6vUzPvxHjyOxpBG7q
TLSH
T158755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b1a7922f1dc6c1a10c8f7eaf90d6a11697e3c2810d64f9b8526f12773cf9d414
MD5 b4c37a25f3a4adf6b1f202acc0e64021
SHA1 431ef4cc2a222157cf8304c5a556f6912cdb88ff
SHA512 c630ff363b5e55db791bfa93550059845e6bf0ec8290b026105e254e0664ce7a9bc5c0b68c0d4708be51fbd011e16d626ae78940b18a3bf12ed8558b95e8fb3e
SSDEEP 12288:bVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im980qyDpCstpdhOWjUse8PBUAxxueT:bVbqPb88hv/l+60qspzB7B3xiHrPq
TLSH
T1DA55AE66F5748331D073C0BAC4D2A69AEE3234425B31CACB1246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 7bfc3b394daeeace7d8cc4fc9a97c374d694a32eaef1edff78baa9179a261e71
MD5 a466e08d36bbb60b9431cea3c2ded7d8
SHA1 2b3aa32e5f7178d616386fffae3f9128919ce387
SHA512 1d6a62e6bc9a13435f46f243fa32509f852ccd453229367ad6ebe4a48dd5b7f838029b4abafe5ae14d5c9098200e8f86b101eb0bfce1c5c124a718414944ec56
SSDEEP 12288:tRrqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:tRrqspzB7B3xiHrPq
TLSH
T160C4231A076958C7C73B4EB286EA40C836181EDCDC8DCB872D72F55AC834B56E55CB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 0a8403c39b2b5cb408dadd43310cf48d13a147e372f8de55aded885e0db9e43d
MD5 0463d5386ee7aaa1ba5d838eb8f54d0f
SHA1 83cc3e4806f9333402037483f1db1f0a6048d0f8
SHA512 ffda3e9a9f12db50ec84b31eebe34fa7f9950ae58caeba06c8c05d1093ed69ef3938c747a832649965ed5de8462dd4fa25a546123730d5f5a37c6ba7632f9f1a
SSDEEP 12288:veBNUbTVO86UsqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:vJIUsqspzB7B3xiHrPq
TLSH
T19005CF3BAE28FCD2C27E8DB95A918240A77278704F5293CBE175C20ECE235E15E79D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ec5b60d1984b79210a7f1366a592283c2d1ce9a8e00e365178d766c1f8334dca
MD5 fc9a124962d406d3380ab7756576bf51
SHA1 d291648330320874135b30dcde8a50e368496aee
SHA512 203851501afa67b83e60d81d2c1737430fba4aed8ff81b77dff28255605ff3a5bf338c91683e4757bdd84aa69a9861ce7bad6d4aee16ff84d8192d88f012c889
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THq:xQvGAdlCEL8c/yRNw5CVpBCq
TLSH
T134266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0a6c50bb22aa56cafafa2f5237e286b6c4d1703d10d5431a974f6fadf4039e47
MD5 d1d848cfdf5e462bb0e0c0641382a607
SHA1 316dcf9684daa35acdf5ca72f375dfe8eb869fbc
SHA512 eba73ccb2852d892dcb13397d0b4c9a4a5b3f952fc6fc4c2537f51b426e2e0f40efa86c67e6fbe694e98a656da29ef1981b63cf44a64cdaa8501a71061697882
SSDEEP 12288:DAwSfxL/2Dc34DLLmt0LDQewsAjyqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:8dewsAjyqspzB7B3xiHrPq
TLSH
T10015E031FA74E436C37B0DB21B26C716142C7A604F551AC3E3A89D9E89306D2677AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4e1c73c71b61d4fde9f851bfb85cb827239ecf10c4467a5cc19cd95f031a9ba1
MD5 c34e3c703976f461434f36e1469116f9
SHA1 ef601b00c04cb781aaf4814e623bb6bef210d648
SHA512 49818f829749350565d1bae58d672403fc79e7d734dc5512e9112d9969d6f4ce224f57767a687e32eb9df47c748c1a1f82312b8cdfb01379a59e89d1510f1694
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHy:1UEtQevvqc2W1cpV2EI32y
TLSH
T18B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 baf16dc8bd3e1f8d554d0bfa4cade3cd47a526925708bbc44eac7b8d6af634ec
MD5 2944296a8325bd39151bade277f161fd
SHA1 16b5d6f7ddb92b4504dfbbc17f389367e608e9da
SHA512 1618775e33aedcc561bd3c8b1a50c99a8db9fd59d0ff9ae51512d7c0bc63ac5d28f82e509a96856e5ddf571df379fc2f53d643007f4844132aeb2778c8827c55
SSDEEP 49152:ACbRquA/m2yL5zTfFiV+XenmE3/zyxpBG7q:JoquVjnm5pBCq
TLSH
T1B3D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 98dbea9e1a9eeff9a0f6a19174863f6e343e82b6eefa360515850a8b629614c4
MD5 6f42aec1dcb83961fecc3ac0cac2263c
SHA1 3ec0a25f66f1ada071096cc96a9f80c584c6a543
SHA512 cac4e16c4432f2da1cec6ce83c09d267975d6e872f93bb00fcbaecfe1896d4e1226d66ceb6be4d7a84c6b1ae24ddd1bff40f4e1e4c53ee0efe8f8c5823f6d904
SSDEEP 24576:YAhGLJIFoiwtA5l7S53hqspzB7B3xiHrPq:YAMyFoiq5vxpBG7q
TLSH
T11F359E81E7F955D4F5B3AAB899B68170EA76BCA95E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2682412677d6abb7ef6e52818fc3c5063701c5aa45542b9b94f4bce5a713e078
MD5 68f435446e7b94d7a13c32d687aaae88
SHA1 b6b4d5f64aaf7aaf3ead79fae5f0f1b2c1d75515
SHA512 77699e2fdc366c2ce26cdac565265fe50f9d12b7fce83ec5a4d2038944fc32484090a50f2d803f52277261070af0ac7cc0b6fa420521bb0b191ad24dd5f18b2b
SSDEEP 12288:1mw5HEjsChNVBFgl0WDm+C1qyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:wwuoOWeqspzB7B3xiHrPq
TLSH
T19405F14A37A40CEAE9678639C597C135F7B2BC452A25CB0F1760C65B9F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c057b9442e7760fea2d218f9b13ef55fd62ed40313a517d33979a16abebd3621
MD5 19fb63b3c5b46507032ef2f46c9ed10d
SHA1 45809f332e6a04333c627d6f2507dcf9d38aab93
SHA512 c5fb0b2587ce6a17893a668eff4ed43bcf478fbb3bc4076cbff79fefc9916fc02482b7b721ea751cc1037eae3d9bc74f2ef4105f5e0a838dde66d0083c04a741
SSDEEP 12288:NBZ1IyCqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:rZuPqspzB7B3xiHrPq
TLSH
T1FFE4125923E420F7C2774679C9E54188E3703C9A677683CF1A65A16A8F32FC25D3C726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 516d643b3e7fe6a2b7e2c79ac5be063fe4d7973c2dbac53c376d07e51a6fafcd
MD5 d51c05b49ba97afef133c2a8bec87229
SHA1 604d34672b97fe14d171803aae9a2070f1634fa9
SHA512 0a67492dfd5c4f0fe89c9b8c3ffdb5899d74472c4a716b5d09387f57990cf0b91acd64b44b0702c5182916ef2f4ffe51095e81166db6f81a512fe5c2ed7ccca2
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:rQRQyi36YOcPQLvw2gAf+PN3UpBCq
TLSH
T110667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b75901b3d1b6a63497a2d83e04c8ecef410ff78e105ad2a99377eef5c09e4ddc
MD5 effa9b6d7685b64f7d3cab9b73accc4c
SHA1 0fba3edfba61ca615982497e286be9c8c1dcae0d
SHA512 a6649ed4d88bdabaf1908ab329c81078dfe0345cfbc2cb718dc107bf24b33429ef08145648c1d0175f24fbb260d610b07a6417419218c18fb1db51940b69140e
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:1QRQyi36YOcPQLvw2gAf+PN3UpBCq
TLSH
T16D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5181af5b0ddadab7ffcef05be269481c92896e077f133c5ed6d7ea287dde515b
MD5 150a2c6719d3f8d41828cc14f7475241
SHA1 1b48401768e04019e6b814ab3af45b0ac6fe5b4e
SHA512 51f9e446cd1035ccf6f1ccf40457911d0cdc14552315da791610232c2a4640f21b4c7dd13aefba8aa944ffaba0845b23f9722722fb6dacc8fa0e48b905166f03
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0/qspzB7B3xiHrPq:668Qg55nhheWu7PNU3/ixpBG7q
TLSH
T167B55933B2F600A9C44DE1769F4A872196D17C75CFE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 20c8181fbc6b44594655ac6bf5afd8a5d9c62720c13dc260e857f7c4db0786f5
MD5 61fe46bda80c75f773d7a730056f1601
SHA1 94548e800b953256ed7bfd2338325d4e991b0052
SHA512 d2aaf9b84df8fe5bf3f9f21499229dd583c0fe32e595bfc585211d506c4a4acc921cd8e7bc712c4bc9b9abae11988d25bbe478451ccda94cd25606c2bcc81b0e
SSDEEP 49152:T3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99E:Gy5112gYy5azzVvL69nLKnhZPpBCq
TLSH
T1FA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 939ac5f9f9fe6fb81c685f451c7ece0688974b03b3915b2a0c8730709e0b1a61
MD5 928b67beeffe19dd86bd8e4be355576d
SHA1 540b7ef72736b9c7d9b18e89a344b6e88e941c71
SHA512 f4613eddefcad76500a485ede422abeeaf98a65c45767e550f0d9c1f37583d6ca6611ad2e8054e7bf75859317f6ff8d4b293639024b05f3532774f9c48b649d0
SSDEEP 49152:FB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glMxpBG7q:ru6JmVxd2dspBCq
TLSH
T1A4D59D13F1DA01E8D06ED478974A9232FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 211400328959b54b2efebb2efb89641a897269e262a78f707ffbea45bf58b2ca
MD5 0c7f18b45aaf3d8e363c53a636185b2e
SHA1 b58d9b8ea3fbf3c20579a8ac3a79b8ab70422690
SHA512 0ea5334b9637be20be1141b4e402ff37c7a5ba68a9ddcc7451aeffbb1948e5d0ba59843a74770f955cfa57e922ff7a33ced69bd45b12a1d4f7fc910eef597599
SSDEEP 24576:Phv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3cqspzB7B3xiHrPq:91hpsNoJpF1A6UU44CwH7R4xoxpBG7q
TLSH
T182B5AE13F29900E8D06ED17887569232EA61BC460B35B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5d56be9bbbbc3db83f588f3612449c5c6ca37d97f6c53bc2952055340d915855
MD5 ef70d81401b861a0923ff2a8fab926fd
SHA1 36ceb77af8ad38241fc1f1be113818dc43fb5577
SHA512 b8101b69ad09dc1bc85d72f17907fab25a7b6478a5f95cdb3d5315c800b44dbdfd0450feb9127dfdc2d84b98df680a7e25cf6dd497479b65eb470f86c0918922
SSDEEP 49152:GSuZQIY0Be2KRRVtOnks6NMHqpxpBG7q:I5dKTi61bpBCq
TLSH
T1FFC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4a4a7ba40a8a47d870c0bb9903a17fa067951d32dd9f1a6322a8482c1f86955d
MD5 e0b9d527e6672efae9a1f6931bacc987
SHA1 40d325eee50f714b2cae9d04f38779ec04963d72
SHA512 961177669c5a394d2ed1da3c814d456de637b5f4f5f0846026ec572e7365bc88382ab39786011ae938f7f8cb9245fe986a735f6c95869de2da5992374ed747a2
SSDEEP 24576:ohiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLcqspzB7B3xiHrPq:ohtSn8EApI0figngiDn0AP5w8xpBG7q
TLSH
T14B95BE13F2D900E8D06ED174C7468632EA62BC160B39AADF0A90B7561F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 71470f9afb6b77d51b6060ae9c897115cdb910812eb208994fed3432210514af
MD5 6d6a5307c8e67e9b001034981a498b83
SHA1 b41dba9f9fc315c064abf1624cdbbaab5779c2f1
SHA512 dceaf61cf7c7319644f8e526d340a39cbaf49bd89a05cb26164d4316de57eef67c45092cedfaaa9dac38b951232ae3277e6a6a7b358e7e33e7377a7cf08197f2
SSDEEP 12288:CDqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:CDqspzB7B3xiHrPq
TLSH
T1BDC42309176948C7C2378EF2C69A41CC76181EDEED8E82873E66F016C935F56A51CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 51b17317a00d910bc5192257a383e7620371b7eab08288a13d112c42b56b2122
MD5 39503ec462d321b28f2ccb16ddf9c54b
SHA1 ca0a9ac976bcdeb8bc42b2b97beb81d9e8ba75de
SHA512 0f61f94c6f1723ea8dfb29d183d92456e14b3a5e3841bb7693ef91c039cee0d20da941cc70930313b09eb02bd809cbf5e9762e446d246f293ab619426c272e29
SSDEEP 12288:WGqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:WGqspzB7B3xiHrPq
TLSH
T17AC42319176948C7C2378EF2C69A41CC66181EDEFD8A83873E66F016C934F56A61CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 2c076c9c26abfa2080639f0d4d886205c653cb09179b8a8006f97adb4d783330
MD5 82ffa72bd5754c79b2af93f16352aaed
SHA1 38ba60294b32e51b6f68c41bc5d36500d44f24b3
SHA512 4bc26832e115a8ecff806321bf5775c60ee420472fedbf86860c2a3bdce31f092ba5f450fffeb1fa41b2b128d5d9d2d7f5795f62d41124f19070e66e2372034c
SSDEEP 12288:akqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:akqspzB7B3xiHrPq
TLSH
T10AC42319176A48C7C2374EF2C69A41C876181EDEFD8E83873E66F016C924F56A61CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 e2a5fcec63116030c90aa00480a0f27887f911d192dcdef1966fbfa1ab731e80
MD5 a2e06c7d910de51ac806d0e71ceb6818
SHA1 c71d77a34edcb6022798508ab793113b58e26a0b
SHA512 80bbb0b01848780fa4b50a69f08b8468a327183469864f29debed9497aa3bb7c6e725b54360102272b61e7c0b958ce11c91ac8418d8fd1c14338fad4fb33eee2
SSDEEP 12288:iVBqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:OqspzB7B3xiHrPq
TLSH
T156D42309176904C7C537CAB2C9A640C8B3747DDDEA6AC7CF2E11B416CE31B95A92CF89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c95c671622d19738c721f72af445c9315db3c514eac3cc372176feac383fd301
MD5 905bee5a1d435084fad6d593c599902e
SHA1 6159c7f5f4211c3fd00bb6c51315bbaea3b002a2
SHA512 b0a48d7ca90f6b9fac8ca02ee276829bc9aac867f5b21c1656353a430834dd3d7291396009906771ce07c193cead78b75e0c7c17e428ddb8e367cb3c477397c0
SSDEEP 12288:MJqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:MJqspzB7B3xiHrPq
TLSH
T178C42319166A48C7C2374EF2C69A41CC76181EDEFD8E83873E66F015C924F56A61CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 f12fe8ef6a1d958337d0bf03bc6d9cf86b682f123e2faa1ddb94808833c6a0c2
MD5 339c0d8573020bca33fe775669e3eac3
SHA1 a8f59c6f9ba8ea928e8690a6b538c4328f207742
SHA512 60566a89d5f67bf345b70658a3fbeea6037f9125ea60f3d27b00195a4bd2fa1247bcf5fc73f6480ab4a439e4faa492d127aee77c614db84c738343eb4384c510
SSDEEP 12288:kqqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:kqqspzB7B3xiHrPq
TLSH
T19DC42319166948C7C2378EF2C69941CC66181EDEFD8E83873E66F016C934F56A61CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 c55eabd2bbfc1ff281b7afc2979a5c381bd62e358e86ffca79da4da81464aa7c
MD5 c7d814d1332f2ffe61bca67c093fea50
SHA1 d0afa23642406626df834bc04c2ad8a7a1c7b65c
SHA512 180b9764576fdcc29a81936308469cfe645250cb074185ac3c6a1cfff63f96c7f8af72e0111abe12c33bfa50870f671905fb36eabd547e22310cf2e4aa66e8af
SSDEEP 12288:TOqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:TOqspzB7B3xiHrPq
TLSH
T1EEC42319176A48C7C23B4EF2C69941CC66181EDEED8E83873E66F016CA34F56A51CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1794c6592e61b42a4ea8dd9d0167ecfe9cf1475c8b6a8827412bc35257c96daf
MD5 79549244e7a7749217ab6b0b9add3615
SHA1 12c3597861b5a5ed181d30227c23097f46331080
SHA512 4a171501f3c22d4abed25e4e446be5c1625933b636237abaaca06dfa22853a89347fe2287b47d1a6a3e78347d3c586fc02cb5b7d06b03af78987b146e74baf2d
SSDEEP 12288:3iZwb6zzFEoS2cPvymqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:yZMSzFVSOmqspzB7B3xiHrPq
TLSH
T18C05019973A00CF9DC67863AC9658945E2B17C5A4B60C60F17B4362B8F333A11D3DF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 209f5c7543b8e524786feb806915b978fc60796812c44c06eece9b98122bab37
MD5 75edee3885db0fddcb8ae52221a6fd57
SHA1 d64ed0ef1a27b3c8ea1ebaba7648e5977da3ab1c
SHA512 475fe1c825cba706f7162acb8b355463f850077ba83bc77ca51537ee799b2b9490b36975937baf2ed39e7f1a610a8654afdf1c3a2595d941d0d5dda0cb1df31c
SSDEEP 12288:wfqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:wfqspzB7B3xiHrPq
TLSH
T104C42319176948C7C23B4EF2C69A41CC66181EDEFD8A83873E66F016C934F56A61CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 0cb7cfb770eb382537434096bdbaae95d6978a31070fa0746d381ca0967b2d3b
MD5 3b0734c06ed0961cf5fa5748ff5738ea
SHA1 5fbd654767870fbc146fc66b5d8df6d2ecd7a1e6
SHA512 e09278076ed15ad291afc434447bc887b6fc0868b6027d492f0cde98b22a5723c5d105c79a663231d585e8b194089f99c8196ecc227fa3ea4d82ad357e8d4c11
SSDEEP 12288:t7qyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:t7qspzB7B3xiHrPq
TLSH
T169C42319176948C7C2374EF2C69A41CC66181EDEFD8A83873E66F416CA34F56A60CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 2053db0fe1eb0187f06a7abb303cf0ebc6d8526f0cc3e48d9cd07dea879cf86b
MD5 836b7cedb12172e5ad5528f385c75eaa
SHA1 adaf3aeec5561e409272eac00cbcdc4a9a09d756
SHA512 a2f6a16b7d77c31bba6e79b63309f2169c2cb8502749eb30c45db36313ca41d16a1d63c2b1d4fd85892db036a90a8b14d9c35b744ef7aa2b9f50d6af447f4c5b
SSDEEP 12288:ZyPz5L8CqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:YzyCqspzB7B3xiHrPq
TLSH
T1B8F4120B33A530FAC1378275C9A20644F3747C7A5B248B9F2B6066769F277919E3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 f51858be865eb2e24581022654fc29dae13881e1c7ed1d16f9eb84f052d0c9e6
MD5 7f725ee01d746fd387efc5b6a22233b0
SHA1 be33ed296fb0da2f2f81580071f7e46323d4c919
SHA512 a30bbe676a94773fca77f74619cdbddc34e7d1c3ffa110a2f2691c0d9092927f157a4f94ee10ae8d6487e25ea1ddc787ee29f0d7d0cf2173a5cf9abeb7d1e36f
SSDEEP 12288:wfqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:wfqspzB7B3xiHrPq
TLSH
T169C42319166948C7C23B4EF2C69A41CC66181EDEFD8E83873E66F016C924F56A61CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 01ebaeb8c55e9af44bd4c0544fd97ed8962874916261b4754b64f8510b8fcaca
MD5 a97ea3e509fe3d656738b466d1bb40e2
SHA1 c1d1ae092abdad64f7b76829676b8aac8fc95857
SHA512 9b3df56e4b057af15ab577afd4339dd194f10116ba3c13b4a202488156c5f5d1618a0adfad84b9642962a99e4e4046f14f1ad7233d1e44a5aa901b6d490ef82e
SSDEEP 12288:mfqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:mfqspzB7B3xiHrPq
TLSH
T16BC42319176948C7C23B4EF2C69A41CC66181EDEFD8A83873E66F016C924F56A61CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 c9eb68836c9023b543a440497c6bbddf1ca59701610a4dca5ec3d662723918f8
MD5 821de1a5287f24b4279104ec0a25ef1c
SHA1 dee857522ce09fde8d399988b87aa3ad47e641b9
SHA512 04627321ad2d9ed506afe93aef364fd9ce304f2affda50dd2ecae10656e4e64cc47f18781d8eb6a610e359a4fd6b69f8e29f4850fe64f4574a750b25584734cc
SSDEEP 12288:EyPz5L8CqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:dzyCqspzB7B3xiHrPq
TLSH
T114F4120B33A530FAC1378275C9A20644F3747C7A5B248B9F2B6066769F277919E3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 091605b2e4ae0c67c7f84a36625883f4c04ea3aafb001f2fc51b5cfa571a1d16
MD5 ea132568a22123c75ee3153851df7452
SHA1 95a0c551b9834a61f30d2a755923f1cd4fd08cf3
SHA512 f434421e12033dc4b390506a1005adc937cc1efd2aec8e830c62a73969fa5e2f7b8b7eac2326bc73c24dcd346e7a22af02eba75c41fe79aa78d313a94d7116e1
SSDEEP 12288:aCd9eWYoaLHF3z0z04PDvhUqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:rTHaLl3z0zDUqspzB7B3xiHrPq
TLSH
T19E05019873A01CF9DC77863AC9668945D2B17C5A4B60C64F17B4362B8F333A11C2DF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 21b828561a0cdb7e6b06262a4bcba0f4220d5695422fe8a224714dede949a53c
MD5 4596b6108cde9559e2090e3026de6aec
SHA1 1dce7b8b7f0acb7272a03cc0c70c53ee2f45e058
SHA512 6a85b9af70be46baf1014d03027264f8aae270e9d83855b3a8f4af7aea56595ef2ac037b7888f3778952b9da21c55682a390bb011fa445da80ae28e70da56d02
SSDEEP 24576:PcP4mcvIjkGOxhKP2l71SNKbrh/8KBnqspzB7B3xiHrPq:EP4m4IpOO67N8KzxpBG7q
TLSH
T1F265BE2DABDC0096D0BB917485658A49FAB1742E2F3286CB1160A33C6F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 b8ab2fe9d0b78a664c72303cb12dac86d39939c11fd79cdbeac5bcf54268effa
MD5 e1b4bc5a68c1d2812701dc04d545f52b
SHA1 d9ba6e44011f95f94aaacca71e659c080ef49555
SHA512 6cee778245e5a69ed5b03c44a42b08da7cd5beee882fab9d0f24470a33b2155b6c0fe1febdb6090e36adf11c7a49d50d31e04f466ac64f399b66fc0b37d7f63d
SSDEEP 12288:KNsfPqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:DPqspzB7B3xiHrPq
TLSH
T1F2E4F109D29801D9C12F5676C7964684B3333C6997E1D3CB26D0F43E4F36A91ADE9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d9b23dd9458c5ac2ea683b70b25d6ee9dc8c643fa5d66748f0c38ae8406422e9
MD5 5acb3bfd9316abac169ab77de2040b7b
SHA1 501741d2e73d5a2350e1dd2329e4984c7e4c37e7
SHA512 34f73322a3bf8544ff6354ce43fcf7abb50aa0cf7e08e3f2faff98fe319307573ca561adeebc520077aba4ed778216d2f766aca7e2c80c9aa275bad49a8399b6
SSDEEP 12288:6vqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:6vqspzB7B3xiHrPq
TLSH
T17ED4231A176D48C7C23B4EB185AA80D8321C2EEDEE49C68B7D15F115C934F96AD2CF4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 56a3e4750e2a2c93356c266ec20229a6d92263321bb5d9add2d210fc7d005329
MD5 7e4aadded824c7bedd1cd011c2d70659
SHA1 b82db3413616783201dff8cf7f0d6035431c0bd9
SHA512 2032b37e2ad537fcd96142d00768becb34784311eaa62194fe4d8a051a90e07a332659b38230b72bc4ee080cda4220c078a1e7c12033843d4bf75986383dd068
SSDEEP 24576:uoiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBq9EzwwXg/bVqspzN:ua0h2GEkuAe73q3pp46zwwQXxpBG7q
TLSH
T18385AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1150853D7F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 19fb0abc2115e339f2a2e17cc57141af8cd6852a76f54d84aa3899170c94e059
MD5 f6c6e7ce7aa6db69a7144114ee8cec7a
SHA1 8bbc5d1647026d380ce2931bcd95b493509122ab
SHA512 c6561d06d2901f1602d80fc450f125cdc54ff1da6525f3c6a5e2a6418da38c485fbfdbfc1a704f26275707b5fd030a51e3e0746f8b7690c50c1f2ab580790f9a
SSDEEP 12288:ThbHjfX2qyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:ThbHjP2qspzB7B3xiHrPq
TLSH
T1A3E4127E17AC10CAE232D6B985968189D330BC691B1593CF2691E13E8F37EE55D38F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0f288134e2a34b5b0bf4904063811dae728dc54ed4bada276c8b56d97fa5b7cb
MD5 d32c0978f209e813ddb4ad7dffe9d9d5
SHA1 ddef019c177257432f13aecea2b45749759de06e
SHA512 28090bc38c4732f96ba2dfc50e88cb5ef4af58c52cc248bf0c452882d893be0857e54bc38e366796999a1e60ba168b0d68cb7052558a46aa0e4a920c303f2a64
SSDEEP 24576:/3YgnJcRTk4yti+R5dpR/eqspzB7B3xiHrPq:/IgnaTk46ppR/uxpBG7q
TLSH
T10745BF2DF2B910F9C8AAD636450147B5BB71782D1F209ACB0170C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 c368c270c6e0a34ac29eafd54f02015f4c17e4843fdc54f4a57a5daa64c7e09e
MD5 fd8456b263c9c215196a7f1cd35cf25e
SHA1 58f4855bef76cbc567f52f21a8562b6aad73324c
SHA512 1083e9c015b74ac0a97a6e800f28adb6f675ad8993026b341713112c43ca62cd66cc3b097986d1159e44fb8989f8d644ec795892d5dcdbc6d71c878eb41429f1
SSDEEP 12288:XLqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:XLqspzB7B3xiHrPq
TLSH
T156C42309175948C7C63B8EF2859A41C832181E9DEB5A87C73D66F016CA24FD7A93CB8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 ce1fa3671b9035876d67884751299af4125403d5690c30ceba3531174dce8de7
MD5 ff35b2bfb031a8031acba7e582483d1d
SHA1 a45aba430a0bf746a33471d17b165ae016bc6d1d
SHA512 0fdaa7f18750e5cd3ec8d0dcb3fc1626fb83f1d3384e5d0576f5dec0b10ab3c47b489bed150255d570a42a1097eb2be76f6b28f135d514ee91e768c2f583d2cf
SSDEEP 12288:XOb9A4LWOsvAYFTQqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:4pL3UTQqspzB7B3xiHrPq
TLSH
T1C5250219F7A400FAD97BC13CC9A68516E271789D0764E7CF07A88A654F237E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 cdc2a90b98ba702dc8c042b2f5ffc55e14d2ebf193f8c2981826182caf44da08
MD5 41954ece0a5233d3224e45f99a0f8ed8
SHA1 7909eb17fecbd567017bfb46ff10a78ef754ccb2
SHA512 1142532b6d35b533fd0a3683ce14a8cc606bb3a230298c70c6cfb8f3ddf5c9940cb683b42f914210d49baabf4e8483e6f363f30114df35a8318146457e3eef2e
SSDEEP 12288:YpFtpOMqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:qOMqspzB7B3xiHrPq
TLSH
T11FE4021933ED10D6D13695798A96824CE3707CAA5B1293CF06A0D07E8F63FE8AC3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4d02b91198f3b03eec1b829f9bdf808c0593c8f1096ab3899c70bfcda3a294c6
MD5 f820d156f6364156b1075f1830c24325
SHA1 e9963dcc7134ae74673c00c97a2689672a149bcf
SHA512 02ebc4c687580f3e4133c6148379e300f0ac044c9d73d3a21d6606d4012141121fcdf4e101f6273d86502689a83a83cbe691dcc4c5950172d4a8971753aa1f00
SSDEEP 24576:V7NM9YmZqmWMUkPjZM48Mv6bEhsfqspzB7B3xiHrPq:V7cBWMpPjN8DbEhWxpBG7q
TLSH
T14765AE2E6BAC81D5D577D13DC9E28245F2B1B8611B318ACF1162833E6F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 a16da1c024e12de18abd655257146e827548186b2154a664c5c368b67bfb7416
MD5 3e3ff85900917fb6201f04259df4b55f
SHA1 1c35330d9e6c5c6e6e0132a53541d73bb309d990
SHA512 427e62c535c5661fd21b02b1b549b2786b62d044ca1d4e316dd7a7a1bc6d2c31ab7fdac6bef40f247197babc01ef289b839cb31276d063d685d411cdedeba136
SSDEEP 24576:QW6BApg2YuyuNDYTabvcRvNYf8km19qspzB7B3xiHrPq:QF2YuHNETovcvNYf8km5xpBG7q
TLSH
T162857E2927ED80A4E0BBD27D45B7D186FAB2B8551B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 fa1a8b440c95cf2b40daf972b16d981c727b82443fbecf98e0025861034d4e68
MD5 08d859e403329eb807e1831afed7d78e
SHA1 0ff6254944025b65705337c9b8f56824accf74e9
SHA512 5bddfdb8f747c929b1bc999d2fe45d16a118ce74ad985954d0408fdfac5b83041671ad3978b5bca7f53f3aedda49861e92b6d875d4d33a4344159f0f9bebae78
SSDEEP 24576:0AFs06+Omlf3NXEbToIqspzB7B3xiHrPq:5Fs060lVXu3xpBG7q
TLSH
T18F65BF2F62AC00D5D07ED17E8A97C91AF6B1746707255ACB0160C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 c56e03f601ae686f06b004ec7e9636420fc669b2218893e81b9ffd14a34b8f90
MD5 fb6f78367f218c6b7a3054de30d66622
SHA1 84727e499b761f0c92a5446e0a80b8168d44731a
SHA512 fd661309761fd9d984a8ce8ae201e5785f5e6b1e664c0b3245190ee7a66347b4b27014233bb6eb90760d490b8c85e7b8b0b058581afa2f3864fa328eac4c3764
SSDEEP 12288:3CJnJ5D3Vkrlzx/qyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:SJnJ5D3WtpqspzB7B3xiHrPq
TLSH
T1F415D02DD2A810E9D477C2B4819A1785BF71387D2F226AC728B4D5357F12FE0A979F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a695a5e255cba00283bdb1a58c7ce7e7697df0f4490a142b616e18b2fb2611f1
MD5 7ce16f4147bd2b6fd863cfdca9924c41
SHA1 8c01e85a939dcad863fe3ba33a41da5660c1ebb1
SHA512 49aa9406e5d0d9ccb1c26aefc1634eddc3ca95ef6f817422dd297b55217cd1b4c3a2af14d7876d73d586f784a9f329e3ed45d4f98ce687cfebe2337072ec9c54
SSDEEP 24576:6EPohm6/7IIXdwcXrif7qQncjlP65i3VueqspzB7B3xiHrPq:to06DIKdwc+eQnSt65aVtxpBG7q
TLSH
T12C955C16B7EA5295E8B3CAB1CA6291159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 68ab6596896dca123b29010607a6963e36a24e774c1e20b3cf66a4dc4c25c113
MD5 04e7469eb0e4fec289407c20b477e0ce
SHA1 93603b54b5e9ca24c01bf643195a8a321fe44091
SHA512 c9316ae4bb0146cb1d6247979d65cc02b07b8e8c1ccc8da2d7b72ac0341dd579d80d1fc48eed2029b0547d459a35ed37d461d1e5fcbc3281177339c38145054c
SSDEEP 12288:nEP3Rr1qyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:sr1qspzB7B3xiHrPq
TLSH
T1BBE4125D27AC60D6C137957985918188E370F8B86B5257CF1AA1E13ECE37AEA2D3CF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 c2d9bb8a0882856fb00f0504e810b73e9c2dbecc3fd2e6ddee005daa72b192e6
MD5 74c6f21c46cd7b5118df612e7714a748
SHA1 947273aada56b5698275d63ae5945e906a64a890
SHA512 310a9fc30f3b2dc64d30c2815d9f42467611810ef7be898a82efd81933c64822a1ee994c9ee3be7f65421b233365e5aebee479bc36c520f2a1c898f87322b577
SSDEEP 12288:GjkyGqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:GIyGqspzB7B3xiHrPq
TLSH
T127F41208239854C6C67B4A75CAA781D46A34BC64AF1583CF2490F63ECF36BD5AD38F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 491b94a72357586389f7bfbc1f8fbc2685cd4cebbb4732bc612666950b266368
MD5 b883f180c75d007c507057157ae168c4
SHA1 e265c7383da5ec8626d1dd2151b16318d6e1e3ca
SHA512 4db3f384fea784401f46dc030a83bc79c0c5f6966178b7cd9a9f2e903a25b25db1689ec527878d6785643bc1ec2243feb0a6bf2985079054f41506d7b725ceb3
SSDEEP 12288:uFcqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:ccqspzB7B3xiHrPq
TLSH
T164D4231D136958CBC6374EB2856941C862243EADAF4996CF3CA1F035CA35FC6A53CF89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 97418e4df9a19430966ea37c12b1ed8efeb08ef827926b8633c3c042f0172f4c
MD5 11af9bd3dde88f4bc96ecdef5e873a5d
SHA1 c623041e96400f5ec6897caa1a21ff9b1c39ff3f
SHA512 b2f34fc081197a4ca8017560e425e94ada59e2871aa78cdec303f75a0723f21c779bac13d4660b3102f96354fc6c38fe0ff84f336e689c55f770e15a1a1598cc
SSDEEP 12288:5LQZb3C97GYnZMv5zBcKY97MD3XqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:RQ9MxZKdcz97w3XqspzB7B3xiHrPq
TLSH
T164558C2DABE905CAE177D27595A240C3A633B4311B35D6CF2448D03D4D7AEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 c379038283da398e530d28bf634cc1bfb3f32e3389e5c50cc6ccb8a5f76dacf7
MD5 c6cfa506eccb67d509a969a88a77b2aa
SHA1 2dae0bcc76ae482d15af3307abb4b8f82b1cfdc2
SHA512 9a6ddce98a5ce28715ffe8b04dc48dce18aecbdbafc7924c43ef43d35b06dcf753a0a8f775df0bcd78ed6eef873ea5f88cb1575c5158f8bda0be18fb728e5142
SSDEEP 12288:XyoKo2HRple9pyqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:XyocxApyqspzB7B3xiHrPq
TLSH
T1D5F4E01F7B6E40D2D176823C89858284E773B4745B6253CB6691C33E8F27AE9BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b8a12976ccec82cea40bc1f418396c93a54501fd25605a226e800c9b7f955044
MD5 8e82ae4dcae85379c6db29a131d14385
SHA1 cc856025293f33d71cbf7a0fbe19c5c80a2e7986
SHA512 a2f46ddb4cc3b4ec664c88ed4d860b3c9888e8370f15ced14929c9276e7ba7504a0bdb8a3ec3c909c967d7a38f67bea018756ded77cc6cb2b2d84bd4de56356e
SSDEEP 49152:5WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKSxpBG7q:h0zuNI+pBCq
TLSH
T14FA57B3DA2BC00A9D8AAC375C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 50722852fa70ad035598453575ead3df3813bc5b00e0837fa606d83383f0bb96
MD5 9626824914c3039a1ad02d2752172978
SHA1 09c66b71cf68692d304eadf61973adf63c474ce9
SHA512 0a6f6b7cba5dcf16fdd0c9a603a9c6d7a3ef7b41ed2171652b2ef6d8ac9bf2f24a5a3cbb4c4b456f4c87d7f78ede0860fe8c6233ae3cb9a5d3eeb9234faec29f
SSDEEP 24576:a1QT7EcpfxR+N5AWAz3ooiYtjMqb1qspzB7B3xiHrPq:nTDxR+N5YzTfjMIxpBG7q
TLSH
T19755B02EA7F815E9D17EC5798A23C502FB727861073193CB42A0C17E4E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 6dcfe3a31ca8fe45a87245af91368202ffbb2cead33bf659c7e52f8e37f9a289
MD5 6ce6ad1438c322ab0fe44341322357c2
SHA1 726da09e21d794332b9dbcbc34c085a16cca8e83
SHA512 aca664914b71e81a8f1916928b38996f0e8f56d50733dd0e62ce8e85d5ceca7045f215470813adf2fdafd5d1b41481c7f586667000838d8efcfd3caf4bc9606b
SSDEEP 12288:d/5T+RdOzMbFFTG+eEYNmSL+GqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:HTMdOz0FFS+imSLBqspzB7B3xiHrPq
TLSH
T15315E13E63AD14E5E53BC27DD6538906E67238660322A6CB06A0C0796F5BFE4793DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 e4559dc237bd3d5579ee80413a09dac99f0986095b05f814a0376b5f47f4db12
MD5 ef8d1fb97b47c6de417a796c78b4b96b
SHA1 121cf42ac79a766ee09722cd983b8c389c178a11
SHA512 b3473a1bf197d144441d6d16e849c9101ed389630fee9217dd8a3ad1883a97811e086d91d5c0f3bb3a8967af3c12a388c980b312446c7e4aaadab1c883beb052
SSDEEP 12288:047QqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:TQqspzB7B3xiHrPq
TLSH
T157D4120D23E824C6D5338A71CA66418892307CB9671997EF39E0E53ACF36BD5993CF06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-105-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/396-114-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/396-217-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/396-111-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/844-227-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/844-213-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/844-207-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/844-219-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/844-206-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1084-191-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1084-189-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1084-438-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1084-182-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1152-512-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1152-153-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1152-514-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1152-146-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1152-147-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1152-269-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1700-386-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1700-177-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1700-170-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1864-250-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/1864-253-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1864-519-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1864-244-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/2524-78-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2524-79-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2524-92-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2524-88-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2524-85-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2564-523-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2564-299-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/2564-274-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2564-283-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/2564-277-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2564-520-0x000000000D170000-0x000000000D178000-memory.dmp

Download

memory/2564-318-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/2696-240-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2696-233-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2696-516-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2696-234-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2780-232-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2780-128-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2780-118-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2780-124-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2904-117-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2904-36-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2904-35-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2904-34-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2904-28-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2952-132-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2952-252-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3064-40-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3064-42-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3064-47-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3064-63-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3064-62-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3148-221-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3148-515-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3148-218-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3148-228-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3248-539-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-528-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-529-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-530-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-533-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-532-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-541-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-531-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-527-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-526-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-534-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-535-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-536-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-537-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-540-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3248-538-0x000001C3CEC80000-0x000001C3CEC90000-memory.dmp

Download

memory/3428-59-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3428-57-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3428-51-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3428-169-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3504-136-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3504-256-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3504-135-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3504-142-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3788-165-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3788-164-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3788-324-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3788-158-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3852-77-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/3852-1-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/3852-0-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/3852-455-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/3852-450-0x0000000000940000-0x0000000000BC1000-memory.dmp

Download

memory/3852-10-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/3980-72-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3980-74-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3980-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3980-188-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4288-195-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4288-201-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4288-467-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4288-194-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/5016-522-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/5016-264-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/5016-258-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/5016-257-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/5028-100-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5028-94-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5028-93-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5028-205-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/5068-14-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5068-113-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5068-15-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5068-23-0x0000000000710000-0x0000000000770000-memory.dmp

Download