c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed

Analysis

max time kernel
149s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/05/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
Size 791KB
Sample260510-menppadw2v
SHA256 c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed
MD5 0502ddc718a6ecdd6721f42baa4594f5
SHA1 3978953fd06e1d985dae94050ec640202eda0abc
SHA512 1adbac470d2b01c0f4ee076e5a5fb6706d46804097da7587a56a5a99a0939e64e8e440fd794f0b8441e2fa70c6429c89b9b8c6e79a4c2153fbdb14ff36a15ca5
SSDEEP 12288:JrrlVnbiDZ3NJWDl+caqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:JrrlC33WDl+caqspzB7B3xiHrPq
TLSH
T1C105F120330684B6E79607B15DA8FAF95068AE784B9581CFF3B87E3999314D3193361F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
440	alg.exe
4136	DiagnosticsHub.StandardCollector.Service.exe
2560	fxssvc.exe
3936	elevation_service.exe
3628	elevation_service.exe
1064	maintenanceservice.exe
3888	msdtc.exe
3044	OSE.EXE
1084	PerceptionSimulationService.exe
5216	perfhost.exe
780	locator.exe
4344	SensorDataService.exe
2164	snmptrap.exe
5276	spectrum.exe
4524	ssh-agent.exe
5484	TieringEngineService.exe
2476	AgentService.exe
3816	vds.exe
5764	vssvc.exe
1904	wbengine.exe
1756	WmiApSrv.exe
2044	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\vds.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\vssvc.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\wbengine.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\AgentService.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\dllhost.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\msiexec.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\locator.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7f6ccd57b955e89e.bin	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_165671\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fed52f0867e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6ff9e0967e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a2ac20767e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2601a0867e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089fd360867e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2fe170867e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b66cc80867e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4136	DiagnosticsHub.StandardCollector.Service.exe
4136	DiagnosticsHub.StandardCollector.Service.exe
4136	DiagnosticsHub.StandardCollector.Service.exe
4136	DiagnosticsHub.StandardCollector.Service.exe
4136	DiagnosticsHub.StandardCollector.Service.exe
4136	DiagnosticsHub.StandardCollector.Service.exe
4136	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5300	c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
Token: SeAuditPrivilege	2560	fxssvc.exe
Token: SeRestorePrivilege	5484	TieringEngineService.exe
Token: SeManageVolumePrivilege	5484	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2476	AgentService.exe
Token: SeBackupPrivilege	5764	vssvc.exe
Token: SeRestorePrivilege	5764	vssvc.exe
Token: SeAuditPrivilege	5764	vssvc.exe
Token: SeBackupPrivilege	1904	wbengine.exe
Token: SeRestorePrivilege	1904	wbengine.exe
Token: SeSecurityPrivilege	1904	wbengine.exe
Token: 33	2044	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeDebugPrivilege	440	alg.exe
Token: SeDebugPrivilege	440	alg.exe
Token: SeDebugPrivilege	440	alg.exe
Token: SeDebugPrivilege	4136	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 5316	2044	SearchIndexer.exe	104
PID 2044 wrote to memory of 5992	2044	SearchIndexer.exe	105
PID 2044 wrote to memory of 3920	2044	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe
"C:\Users\Admin\AppData\Local\Temp\c3052e92b0eab77579170055d996c3b9af37ab8446dae44582b80c6deb9239ed.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5300

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:440

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5688

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3628

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1064

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3888

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3044

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1084

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5216

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:780

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4344

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2164

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5276

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4524

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5460

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3816

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5764

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1756

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5316
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2904 2916 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5992
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2908 2912 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5fed48e1ae9de171c275f77f243a304a53592dc7c01a0262e16c7a3ef46ab8d9
MD5 7c4054b4bffd3354d75b7f45e43b18fa
SHA1 0cf5efb9286eb4ec48097a66911d473e453c25c7
SHA512 c0abe49a8dd762ccf255a9c24c09a9f3dca6615c74ac22864e34062f68674d81788e6ceb0d4fe978b33f74b746f519a7e0a33fab8c1d9858fda1ad52806bcc0f
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxntxpBG7q:P3q6HjBgpBCq
TLSH
T109D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 635b3438c0d154cc82116bd1737881865d9ad3dc2d898287b59b99b85c619f9d
MD5 4b373edf7ae30693a379a8bf68028b5e
SHA1 721ce67ddf1ac9d2428826c6baab74a23c9aa940
SHA512 60716115ba84fef9783814d90affa47cbf2d87d654278bb5cb87c74e5ee10a120b06c459e170a7486c587dfe409978689b4f96641a99871becab7c2887f58349
SSDEEP 12288:O1XLsswWkxy2lRq2czAIqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:8XYfDtczAIqspzB7B3xiHrPq
TLSH
T12905012873E408FADD678279CCA28505E6327C9587A4E7CB03E4E9264F237D85E3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5adee7c76abc726dc61573ffd9b28f23ba2e50a81a5f5f815db69b1c8cf1e33a
MD5 74e5589b0fd2fed53c7c4b96103ee9a1
SHA1 f3e0837f4486d0a63dab9c2da16db25f194a3482
SHA512 837f31faa194cbb58182521d9e85fac6cd214e48a08beff391f5d56b1ca33d6c89180c3518b6c08c318a4219b4480807e98ed27b329f93e76f804ed35eba3fa6
SSDEEP 12288:wXZNYVLeyUji0h90ZD0wxpGZIVuFrHsbqyDpCstpdhOWjUse8PBUAxxue6HqAhp:Q0Le5ji0hmxirMbqspzB7B3xiHrPq
TLSH
T18635AE16F6748371D073C0B9C5D2A68EE97130865B308ACB4286D77C6F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1342c04307f93c87b5a819e09b4387395d372124112c874134dd1278aac8b3e2
MD5 026204cb63d7b24293960ba55693bff3
SHA1 41c4d67aedf5bf9300e7647a293fd6d0634bcbe8
SHA512 f93e90aa129b3be5c5a3d5992a3445753335e8fe5869981589967a15c7ff44fad94cd75ed9054ddf85f1534a683ba9b45e48288923b8dfa72814340fd135d86c
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyu9qspzB7B3xiHrPq:D/ezSC6vUzPvxHjySxpBG7q
TLSH
T1F1755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bc66c22e43d5a7b55a1ffa10b9686a14b7f6ef03d74342c3680c2cf4011f63f0
MD5 830d97bccac1bf5fac0f7e7f5859e643
SHA1 eab2f285ad911c249cbdeaba2cad1cdea0f62f25
SHA512 655c2bce3e1ff77682f0ce35a48028911f3772942f6f8c5e37af0ab41ddd21876ab66864905ce9ebb51120c7f9b3fdecfdb6d8f6cbe43b047a21e1ea8036d4cb
SSDEEP 12288:+VJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im988qyDpCstpdhOWjUse8PBUAxxueT:+VbqPb88hv/l+68qspzB7B3xiHrPq
TLSH
T16155AE66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 df520f548c728f3be0ddeb7a61a5d01ba516eaf8265b21137ed64f1147146264
MD5 93508fcbc1adcb73fefa9db19301d935
SHA1 5834a05571ea6c40aa5fe0d3e55128a1cd79f761
SHA512 ec60dd8660d2f0331ee901036dd74bcbbac259be84bfcda24d06bb291d80654b63c02f506ec986f0f987e862d9e8c1f5232baef26e016b3555f4492068817a2e
SSDEEP 12288:lRfqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:lRfqspzB7B3xiHrPq
TLSH
T1FFC4231A176858C7C73B4EB285EA40C836140EDCDC8DCB872D72F55AC838B56E95CB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 5fab205b31bc79f0efa1e74cbbeccb6dc6696f5c094fe64d78c1bb765d32fc23
MD5 fce8c5181ffc7b3ff64682c85b7dc872
SHA1 1296fc3b8a96f70d2d3176991ecb4c7cdf3653b1
SHA512 ca4402ec9cf1dc35e13bee2c9d3a4342b00458a0fefa8f57891d68b9b474238c6447f8ac6ea98ffa900a91bf9de9e1e0c5ecdf6330007c301fad6393700ce4e3
SSDEEP 12288:PeBNUbTVO86UUqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:PJIUUqspzB7B3xiHrPq
TLSH
T1A505CF3BAE28FCD2C27E8DB95A918240A77278708F5293CBD175C20ECE235E15E79D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 89feb870f7d10c19836f798dbd42cc6a2aaf26452dc007da9337fa8a484607de
MD5 d8333a3d2971908396b5164bbf40d53a
SHA1 3aeda895c48d769f68937023db48e64898d6902d
SHA512 3a3de23b8e6a7ebe0f77c56fcd15b17c8dc7d220022304a0f2e4508202db5d2f4fa7d7726285f3991e3a222fc7ba5d7ee566e6c38939c2e4f5c2c84c7bde1fb4
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THy:yQvGAdlCEL8c/yRNw5C9pBCq
TLSH
T1F4266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 7b11d698ee113edbe6bfe269782820b45b5859cb08d48fdde3e1bb19030f22ad
MD5 c1c26556acc6d70bbc2638283362189b
SHA1 87c04811df2ba3d0b3d52ce1e3e913cace1eb446
SHA512 e9f414a9a92ab7d3c3121a70d43cd2d53e1549f56bf269f4cd62bce93ed23145b357a3d2e791d8cd7f58f498abfdd32c174690fae7dd87972cd985604cbdd1c9
SSDEEP 12288:nAwSfxL/2Dc34DLLmt0LDQewsAj2qyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:AdewsAj2qspzB7B3xiHrPq
TLSH
T1AE15E031FA74E436C37B0DB21B26C716142C7A604F551AC3E3A89D9E89306D2677AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cacd92b0531d1d17ec6bc09cf4ced499e915aae7a14cbf5cea9d50e1cdc45092
MD5 9e2609df3eee12434d5113874047d77e
SHA1 cbf5edac61833fa955af0131f9f998ed918f5865
SHA512 12a3c74d8b2af8852de80de72ac896fc05124e2bd5e9115341a9c6f07e83487a1479a2a3616a41142c1fc18fc55f5ce72e89d28017ddd9a9bfae4e7299cff4a6
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHu:sUEtQevvqc2W1cpV2EI32u
TLSH
T182474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 89f98d9652e79ee2e8c083a55203c12778ebebcd995b97c67929b8c17ae7745d
MD5 d14befbc042e16a940e582a3ba5bcee5
SHA1 b8eac8facbc80b96f4ccbcfef39c4ba1c3cc168f
SHA512 027c5c32e8c50176a9bb041b628bf1c750e426a0ea602a3113b22e77cddcba59a08963412b208dc9b0307cddfee82fd55326912769e1a23698bcebf4235aef4c
SSDEEP 49152:QCbRquA/m2yL5zTfFiV+XenmE3/zWxpBG7q:5oquVjnmRpBCq
TLSH
T1B1D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 67327fe2f54d43c57effc7723a32e9fd5ab8e32caf3198f15b77ca7c2b332a1d
MD5 cb16f7893905ac93f30caf9ed811daf2
SHA1 e86b0c0000c52e54ad9f64780136f85f4ae4c399
SHA512 3961d090af58bb63e91d9e4784b6be546a0e9f46a07ecbcf9da9d86e8fb9e36664fca278e75c0c12c11c89f57eac714712c3ab38842a321705f24c7ebb54b85f
SSDEEP 24576:eAhGLJIFoiwtA5l7S535qspzB7B3xiHrPq:eAMyFoiq53xpBG7q
TLSH
T1EC359E81E7F955D4F5B3AAB899B68170EA76BCA95E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e2c077d924139ab7350a4c0b046292c513da506faa1b8bfdc727aac9c9de2b01
MD5 c8822cd65af973762239170b173e0f8f
SHA1 2d67cb1bb15602dc7a276590e738f8daee76bd74
SHA512 aba6af479bc27d7144b88512101656a3cf826b4423f7f7adba02fd9aecc937d2ee3cdc0bd35facc76f565891144d6c118e5295d54efb66e849a5523544683438
SSDEEP 12288:nmw5HEjsChNVBFgl0WDm+CdqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:mwuoOWSqspzB7B3xiHrPq
TLSH
T16A05F14A37A40CEAE9678639C597C135F7B2BC452A25CB0F1760C65B9F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 90e35ad59c33720c54416c6cd6f825e5760699671b6520474461291e331b29b2
MD5 6b16bfd10971944f24a0d524ec8b195f
SHA1 6f0d6ccb50fd6c651434dcdb22f132f9f610c35e
SHA512 622ae1f9a3019a55f6e32aeeba5dbb297df1adf650f93207678ea0e66d6c755ba32b314afab54be6e3ac0b3c7cf5373f057924daf414975f00302de3218f0390
SSDEEP 12288:+BZ1IyGqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:4ZuTqspzB7B3xiHrPq
TLSH
T153E4125923E420F7C2774679C9E54188E3703C9AA77683CF1A65A15A8F32FC25E3C726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d5c157189b6e83dbb967a015e29b626d972d48f7328f67335d55e0481c0fc6a7
MD5 aca25558f9a7f2767b425e866fe82649
SHA1 c5ae677ef78c7a6f20410f10fe176c366b4cbf63
SHA512 d410bc9d95633a9966e999c41e7c84c049d818eb69db9dacf63ef488ac9d6e8ef11d66a2972851b75220a8033c07721bb903a1af96961d57e9b636f4f97d5f23
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ue:YQRQyi36YOcPQLvw2gAf+PN3spBCq
TLSH
T136667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b2eb42f9f7e1f8737020f951b50153d33e9d1095a5867e705f217eab07bac270
MD5 b0cd192389269df55521510f528439d7
SHA1 ac2e719d5aa3b29251dac631547c4615a574341f
SHA512 96ccc4fd105b6df28dca238d2de16319aceafcfbe590ae7acb293f2090d1921bf5aa176fb5d3c37ac896ffd7610cb791ded301cf91926dc93fe0375edcf1195e
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ue:DQRQyi36YOcPQLvw2gAf+PN3spBCq
TLSH
T1CF666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 552e5a531b0857542faefbf0b6c79a3a9ae57e6112b103835479846e5a862978
MD5 86282f94bae6a52d049efde1e7d83dbd
SHA1 669b6e0b445b99b7d63ae788b3501a75869e6789
SHA512 55d582ebde6fc820e9ff54586f9ffb696cdf0083d537b71a451732b05bbc7c78b2faa021dc3356e0150deff0bb7d40b4f5d121a47bcf55cac5dc672a92a89f50
SSDEEP 24576:bwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0DqspzB7B3xiHrPq:T68Qg55nhheWu7PNU3/GxpBG7q
TLSH
T1CEB55933B2F600A9C44DE1769F4A872196D17C75CFE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bd847875eee5fbd0dc552d55970644760c1bef84c48f7936efc6587cc888aeb0
MD5 5bc971269bc51b6f169edbe5ef180daa
SHA1 90784518b2225a9af8403d8f00e290fe417fce12
SHA512 8cf2809e29b140b573ba9b632bbeff3ad9ff5d17edc88060d13ae93b48c041ba42edb7e084f68cbd62185e5b3c92d6f37b13d95cc7602a7e3d184d1485fa8d79
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk994:xy5112gYy5azzVvL69nLKnhZrpBCq
TLSH
T132167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f7659895ac8cabbadf53053bf4ed82ca544ac1b41678a05d7f641afc2fc149af
MD5 f0e80e45d90ebd07e90995407bf059c9
SHA1 324f0a5ab7e77e88f6a4652621fb06a65539facb
SHA512 8d56eab551a62e72af1dbc86008ec006cbfaf9d1f4f04380a8d92a0ac74a83c0cbdf96e11f0ac77a073d7ebe7d1ad15d16f2cd93badd34664bc57579e4f68a91
SSDEEP 49152:9B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl0xpBG7q:ju6JmVxd2dkpBCq
TLSH
T14AD59D13F1DA01E8D06ED478974A9232FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0b15ddff3451916433ab2dca4231573bdff8b6295564c2e8f3539b92ed64be02
MD5 b7e061180041ee16945aef7dfd07f43a
SHA1 99cc4ed5494f962c156e04b05c83a6c63960cf48
SHA512 adc5c5b7a5a3f07c4efdaa859d2d64588d5d6a640edae480cf12597ec9311f2cfd2f53a52811addd46da0adc010b8b1389fc44a1a53a48b67aee53c2ed5f7c54
SSDEEP 24576:9hv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3EqspzB7B3xiHrPq:31hpsNoJpF1A6UU44CwH7R4xgxpBG7q
TLSH
T108B5AE13F29900E8D06ED17887569232EA61BC460B35B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 991179acc2cb292f87bb015c2604233f3612fda81e08c393ea2a137535a23cef
MD5 da38491d3f1f46fd65861e6224a97d40
SHA1 cb39e854bffb3cb43d719cb261e97919f9dc1aed
SHA512 7718587fc8a2e937a5e17e16a7acda7d23640892f7ecb8eb2ad419b1279d8da1f272d90c3c145bb1a0fcdbc90c11d50606fcf3f73d94182c6c504db86a2973e2
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHqdxpBG7q:L5dKTi613pBCq
TLSH
T1C9C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ec73559f70366e08ad9f8de9fdd1456f52621def0f455900fb4a39079a6a8e44
MD5 be6a147e58c1adf86c64be7e0adee134
SHA1 dbb9beb03395f1c8a7eef154a451bf63f84db2ca
SHA512 1118281ea36729b38d15c06fd4e14a8e4519f51d2952e384d964230344f6d8d99080b7af1ba7edd5386f5413e4dc140e1076caa5e65cd4ba75a95aa01675e30e
SSDEEP 24576:ehiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLEqspzB7B3xiHrPq:ehtSn8EApI0figngiDn0AP5wkxpBG7q
TLSH
T1F895BE13F2D900E8D06ED174C7468632EA62BC160B39AADF0A90B7561F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 5cf0946be3136471443190a306cdac6a840a070abe3a9ad6a44fbafebe9ab115
MD5 386a2c21445ee998af04cf3f940b95f9
SHA1 0794933e4dc3badf8514e0abc196d6faf3405a8b
SHA512 265c6c5c512d99b10adef524a7ce7fb155de803310388aad4086d0865d6a61d24f1954e882222216a5b511a45dd3b0f4323976971b2265b4dc414dbd5f92f960
SSDEEP 12288:JXqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:JXqspzB7B3xiHrPq
TLSH
T103C42309176948C7C2374EF2C5AA41CC76181EDEED8E82873E66F016CA35F56A61CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 d013b8eb8c95de4f86082ee50d1244836ab96e43e0748a3f6a15c51e1c46436f
MD5 17dc6165424b31eb56212a5edb3f2875
SHA1 74995ab75a71dcb952a7b652aa51ecdcf8a84dbf
SHA512 f195746d3ff2bd6d1e9637899658ddbccb24cc589b4eda1922c586c86f40345fbd45ecb67e0e9769b73d922d1bde9b0fef6d4d9d697df000185541c57c59f28c
SSDEEP 12288:26qyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:26qspzB7B3xiHrPq
TLSH
T1CDC42319166948C7C2374EF2C69A41CC76181EDEFD8E83873E66F016C924F56AA1CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 1dc88905731c7528620d748e811fdd9313581f1535df5f05326fe99e5bca70e4
MD5 18a569186e8c22a19c7e377faa004450
SHA1 8399c848c97d070753118985803868e3d00ef0b7
SHA512 4844f22d12f4db0e68a7b836b1c7dde8f36cd67d23424887dbb7a6791e009315c442a5de8d4dd43f51abb577d7133eca90def69f425b41aff05049a1bea1f3fa
SSDEEP 12288:6sqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:6sqspzB7B3xiHrPq
TLSH
T1C1C42319166948C7C2374EF2C69A41CC76181EDEFD8E83873E66F016C924F56AA1CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 0d75268c91ed73050e2c3dbc1bc1c23090dd4c2fb46ce61f6555e2e14d7d5577
MD5 c8d1651c8e7975c508d1355e9ac1efe3
SHA1 65354e1579d7a617c62137824583aa837d3d37ae
SHA512 86d6e0e478d89e63c165178f7c6c08b34bba2b8f63569371a140e4e1179a95b7d4383a2ad0cb0b43b6e7cd1654b3397861fd8f4c9e6c35ac31e4d6585d699bc1
SSDEEP 12288:sVZqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:4qspzB7B3xiHrPq
TLSH
T12CD42309176904C7C537CAB2C9A641C8B3747DDDEA6AC3CF2E11B416CE31B95A92CF89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 8267b45d3b569f7e78d3bf11c1ea2a70e8c588a52f9b87bcd48f3c5c0e637262
MD5 afd32edebaf36200468ed54fc348d347
SHA1 69020559c50946c50d137384173802c4f802d970
SHA512 2c2b6c1d9c79cf73b2dc6575360a2af164476448a59ccaec78de4f6838a5d4429b4bc36193af1d5663a5e2ddf1455074f9f8198062283321085fd184c8465c7b
SSDEEP 12288:JhqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:JhqspzB7B3xiHrPq
TLSH
T1B8C42309166948C7C2374EF2C59A41CC76181EDEFD8E83873E66F015C925F56A61CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 739860831d393d18428ceb31a29941d175d822737ba2cf6febc3ff094de8cba4
MD5 1be3c2b2c7ca940710a93a10e726cbb4
SHA1 523900f7d9c61ca1204cc4def0cb74c87ed7694e
SHA512 7af4bd40bef7f4051822d70a64d4c97a0123f014c3983afa933fa92f0523d3d1a693382f6620b58379319fe871fd8034bac5dede96bda874ac9c93dafeb46e73
SSDEEP 12288:FuqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:FuqspzB7B3xiHrPq
TLSH
T144C42319166948C7C23B4EF2C69A41CC76181EDEED8E83873E66F016C934F56A61CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 eaa270e3cafd5895c3aaa87fcab5779622abc2c2ac849bc4a958074742952d87
MD5 042a64e98263bb446b45b310f0b80858
SHA1 57db01999d4b9fd62ee6f10e4ff4307cf1ae358f
SHA512 b69a3241f05db7e5d97c13d3f5a09b7c7b181103d68a529976aafc5e2fa3ee53456acc62d811ccfcfaa51c7dbe91ff5bcb288fd82e11fcbe1a0eab578c936e9f
SSDEEP 12288:+CqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:+CqspzB7B3xiHrPq
TLSH
T15EC42319176948C7C2374EF2C69941CC66181EDEED8E83873E66F016CA34F56AA1CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 00ad4ae945fd684332e687a6b1634bde009a9ed655bb21311265d70b979559da
MD5 0677350748f3acf4f9fb70b8a725ac2f
SHA1 c5d9e36bd590bca930fb85122ca39abd5aa65688
SHA512 016af01e092ae89563dbee76079b8cbcb1540f9dc531749d039160ef8870f69c690f2e6519fc1f4f9e8a47ccac3b662cb8402b6eee97b6c3ae40aff5dce068b0
SSDEEP 12288:NiZwb6zzFEoS2cPvyaqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:QZMSzFVSOaqspzB7B3xiHrPq
TLSH
T18305019973A00CF9DC67863AC9658945E2B17C5A4B60C60F17B4362B8F333A11D3DF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 60e976676b8f1be25817669a41c94cb59ad161d26fde2432d2ba0b89e8a0b4c4
MD5 8c9af86857acf9ab79a0bbb7e5e35e77
SHA1 e140c522dc63bfaf26b3619ad6668f44019c26e9
SHA512 198e7acb6c50611416b1e9f75d0ae996c0deb5af261e4f9506edee39695604c202695d49c011c54ddb3b5cec849af8b9e8152630b608a7016f95ef967ff2c033
SSDEEP 12288:mjqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:mjqspzB7B3xiHrPq
TLSH
T1A6C4230D166948C7C2374EF2C69A41CC66181EDEFD8E87873E66F016C924F56AA1CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 f2a91bac1d3b6d073ac78a746fa39f05aa0297f1c0dcb25a675f063378ca55cd
MD5 b27492c8ef5defe2ea574e8f279399b2
SHA1 f677d926845ab4edd9dc1ce639d73821bbc8993a
SHA512 2ad735295a9b5ff1d57e630a916e1e65ef68620de12cd0876ec29cd091a740aebce3f36e0ba037e5fc46d05bf935c54af73b9e4d3ca57c53ba148b855a04789b
SSDEEP 12288:UvqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:UvqspzB7B3xiHrPq
TLSH
T1DDC42319166948C7C2374EF2C69941CC66181EDEFD8E83873E66F416CA34F56AA0CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 91c5b801e1f6b8121bee7e5e34aefdc4b06b8485e791e5128ad206fea36976c6
MD5 495735e26846523cbadb8f040bf64bf7
SHA1 b818b6cf097084242c1673a5c5116931b5d6ee66
SHA512 4498f974003913e7bd9ba8380aa13be6d565f41679d53d2a350b0cd9c7e4b6b05b995ed37b0c81df96b45eda4de5038afe94b96f530417e4eb5d2cd61fdf4e08
SSDEEP 12288:TyPz5L8GqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:ezyGqspzB7B3xiHrPq
TLSH
T1B8F4120B33A530FAC1378275C8A20645F3747C7A5B248B9F2BA466765F237919E3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4b89ad31c3c2ff307ef3981cf513fa92f5ddca211564270f497135d11710e61d
MD5 b9a323b1238a75ec1b7a485a7d5fed9a
SHA1 d0c66590eb929a61efde0f8a67d5a93dc8676eb9
SHA512 45805976f6fb9c4400079f2c968d789a899266e06015af841438532207f69b55d762e769bf4e3b439bc79a739de85f8361e42fa042918560edfa80daea3775bf
SSDEEP 12288:LjqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:LjqspzB7B3xiHrPq
TLSH
T1CCC4230D166948C7C2374EF2C69A41CC66181EDEFD8E83873E66F016C924F56A61CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 046be8f933ef2285649e2e806d6f6a9a2d6d89c0e7ac66c499df5a077a3c57fd
MD5 17e631eb9c22dc7d288758d718e17dce
SHA1 2c7b078ccf29855caee969bc0eae85b348f3c0ff
SHA512 dfa8c4b0354da47578cc244b298d6159330339e22253f3cb40f34f13c20d5e87ce5e0cb7c09257059f01f09c1ed92e1e1a4e923043ba0857493c731b38f03ba5
SSDEEP 12288:RjqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:RjqspzB7B3xiHrPq
TLSH
T175C4231D166948C7C23B4EF2C69A41CC66181EDEFD8E83873E66F016C924F56A61CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 e01ea86aa78347919d65661db4edde425df63e50da5a133cceb16d7ad4a8eb18
MD5 f9be47a00abd70878d4f09787d8995cd
SHA1 e6e4ef10adfd7a2f260bc0404b5a20ec76d7c923
SHA512 cd49ec684903776d259151b5cae5b70e086eabe2df780adbf757cc7332d25cb97c20d39396173d12ffa27570fe4e81f4ec08d026661b919e05556e3b8bbb0bc4
SSDEEP 12288:DyPz5L8GqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:uzyGqspzB7B3xiHrPq
TLSH
T145F4120B33A530FAC1378275C8A20645F3747C7A5B248B9F2BA466765F237919E3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 4f5f14fc705e5928f0d6bb2e4a97b62c437b9a5cfcb9e2193beb8139c5d84001
MD5 e60f46added77af2dea87512ae3a2fbc
SHA1 39666b7e7cb174f44d8b654d478f566ff542428f
SHA512 539fceff21f84e808b85a4528e76a87542bc0e046d5d19409ddbe8cfb014da435411813cc83319a2dc72ba1e337263f1cbe492050254f9587b8a3c0569457f4f
SSDEEP 24576:KCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAwqspzB7B3xiHrPq:KCUxPTY+8Wg2lIL8lrIUJLWwfxpBG7q
TLSH
T1E265AE1DA3DC0896D4BB81758A518A06EB727C2E1B22D6CF2160C33D6F27ED55E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 7766b03876388af28c7229ab5e64c9fbe6c2d9b4e7de49116bb9a826db710b3e
MD5 1561bd239f95f5d02076246d47068ac0
SHA1 46ea506d945cb4e33634e216839412ffd65d5adc
SHA512 200261118b9406a7d0e3ef11e1070e59119cdfb5c77919896ceec24dcdc2e956a2a97bc459a99ec6b2b319dec7bd5b2536da1f3727f015f33eddf0d39cff6891
SSDEEP 12288:MNsfTqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:9TqspzB7B3xiHrPq
TLSH
T167E4F109D29801D9C12F5676C7964684B3333C6997E1D3CB2AD0F43E4F36A91AEE9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 cccb7e02f79a14e2f2c273d99134525482559d9f0a04bbb35b3192bb6117d875
MD5 88060c595c2e56719075b7e19b90499a
SHA1 dede3283f18490421984a23c2190752a28da0906
SHA512 9b78f1c6c864bea3965e1106ad40e3e49cf9e048bf869d901ae6236c5f4c85e3e2c51e25c099986127fdc5dc321f08135b279d1e60926aadd58899f1fcdd427b
SSDEEP 12288:aMqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:aMqspzB7B3xiHrPq
TLSH
T120D42219136858C7C63B4EB285AA8198321C2EACEF49C6C77D15F155C934FC6AE3CB4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6d44aaad05e0947ba130833df76797fa8750008b7e3ce8044373492413f43627
MD5 bf73da086b013d03ea9eb402a6529668
SHA1 a1baf4cc016e3243e10e899585ee0f141fec2660
SHA512 48c57808ba8a144f756494ff75574d07d07fb25c3fca75e625d4241a34e2b92a5e8ec23164b79f8a1b44bb7f75e2a7331380c21a9384b6835d5f156fed481aae
SSDEEP 24576:s8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCWqspzB7B3xiHrPq:FRZwQCyiHiQEaiPnM1xpBG7q
TLSH
T1DE85BF1E63DC46A5E0BAD2B8CDA74407E6B23816573197CF1190C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 b2235030bcda2392cf15236ed1fdc8cc0106a3cb6db7a2fc8f00b9be137d50b0
MD5 db0c146025384ed6761c5c0fa2002b08
SHA1 50e43308032eb6ed4acd7469d339cb41ae728554
SHA512 287bba7448aa5e5ae0af713bd1a019d1f556e8067e7d29d99fb63bb6454fc73f8fd0830d1a672d4c1235847c35f1aa80c7e70397f04a339a709dca8e48fa4396
SSDEEP 12288:pbxA1U7KcqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:pbxA1UGcqspzB7B3xiHrPq
TLSH
T158E4122E16AC18D6D137997989D68148E3307C5A672583CF2491E23E8F37FE59D38F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 16de807d159c5dc6a910e6754732250e90d2daf8da078ec76578e617131d90bc
MD5 bcfeca816f54c7bf3999e555110bb03a
SHA1 be239d37ec0fe54dc25f94be9e1101c47b99ca94
SHA512 9ee1c9f69ff1ff0f59d4a865fc743279d9d7a6798db1276f8ff0ef22c1cbf5628ff5e72d16076f7009896b917fb62f44d701cfb4f2b3e8b7b37994ab5c2f0949
SSDEEP 24576:5jsmP0yHaqrVqHra44KDzMsrnpqspzB7B3xiHrPq:5jRP0yHfVqzlAsrn3xpBG7q
TLSH
T13D45AF2EF2B910E9D4AAC176454107B5BB71782D1F209AC70170C635AF0AEE89F39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 60327d9ed59cd965fe604f1efa9b31eee49494497605530aef46089728a9bed3
MD5 ea6502e387ee927de019d7a0c09d36c8
SHA1 e6f9cb5e282afe5c592653b39e1440fc3e4b465d
SHA512 609a7114c70f5a21ee05b2bc11b9b1cfabb8f1097afba7ffecd00e959e8a6c733ed2d25e508c8db4d49274ce6fbcb375983c89ebc772704c7642336ab83c750a
SSDEEP 12288:SOqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:SOqspzB7B3xiHrPq
TLSH
T175D4231D175948C7C63B4EF2859941C832181E9DEF5A83C73D66F016CA24FDBAA3CB89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 f6b3307fe3b0d68b44f9e6b6c4ee2a820491fb8d581b630f5f72ecfe48c368a9
MD5 35f3ec230100b8162e8092db9b3f6a12
SHA1 ad6c8e36cc7b87fd856397acec8d2ccc2dde7def
SHA512 641c3b59443eb370f8453615a76bc8721179510204e38ead959cf0b6fb3777fc1716b154c14503724bf11ce624b4178bedb8b9f147d6434c0f5eb1401a84f53e
SSDEEP 12288:ZOb9A4LWO+vAYFTIqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:OpLBUTIqspzB7B3xiHrPq
TLSH
T1C0250219F7A400FAD97BC13CC9A68516E271789D0764E7CF07A88A654F237E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 8cc83cff62732851db4f765f5340f268b9d90a20a4940886bf0fa69e6cff157a
MD5 09eaea57acedf12db5f517c987ab84b3
SHA1 df1549f43b341a62c00ffd77c720588f7dff5c0f
SHA512 bf4d6b26a4ae140ce4116a2e6cea300aca2334983f5e4a45371b66a08a3bef01a2fb830b460724fdefcfd73017d8f4ada0da546d1bd4ac79ccc166d5c81f7e05
SSDEEP 12288:G70VmvIYNvUyBpHqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:XrYNHlqspzB7B3xiHrPq
TLSH
T12505F12E62AD0CD5D53B917ACAC28248F2727CA6571193CF05B0C27A4E17EE9BD3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 67dc902c7607b9366c3a8a4ee6de58ed67eafa4d6cc33bb053e33db2a50d892e
MD5 99fd77178c545afb77effefc63e163a8
SHA1 d95b8a5baef0bc7c3a95596df07ebc2d49f0063a
SHA512 3208eed71ca42beb163f5fb8e9394ca4265017f94b6f189f41517f76d1010b44aec22f5b8741f7b277a30eb6d01294cf73c5f741bc18735c93f02e999c069769
SSDEEP 24576:WnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK8:WnXoJJYH84VVS6AmEcJas+cHBjSSKHPs
TLSH
T1F865BE6EA2BC04D9D5BBC17DC5C24506F5B178661331C6CF022182BA7F27AF5AE39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9484e5ecaabc44731569943137fea9536411bbcfbd2cbfbf558ded6a2eaf6ae9
MD5 be231942a7b3e042758853899ed53d80
SHA1 22a45ba0100c60276b23615765e55e0ebc67568c
SHA512 5b0e723172d5cf6124870b2cdaacfa342061e79f801d84e97ca147116fb5926245d8068044dba6bcd75c3beadef547124aa9bdf2ed79bbbd357f98e7e285f213
SSDEEP 24576:Vv7Xbxd9Tuycf8M/TYlSuxrr2PC/qspzB7B3xiHrPq:VDLL9TuJ0M/TYj2PexpBG7q
TLSH
T145858C5EA3EC42D8E07BDABD85B79046FAB2B855273081CF1251856E1F23BF0593DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 099857d591167d51f2940eeed76865be6eb27f52871e3f0dac0f6e5e55e82af6
MD5 bf0abc66cc3266043adff1d8a98e4239
SHA1 710bdac1fff1c8144a9a6d8aac358caabd22b9e2
SHA512 280c3d2b16fb6946cafd48f65987d77f75582653f58438ac404c27824480ed4ad6082d4bdf06e49c1882ee0f550e80c56cf0bb215479baca2ccff7422cbc9b0f
SSDEEP 24576:QegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wIqspzB7B3xiHrPq:QngOJOmPOHhkxpBG7q
TLSH
T1A955BF3FA7BC15D5D03EC17E8A968906F6B0782613259ACF0560827E5F1BEE46E3DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 b6ef70571d3cf4cdaa9c136276987a7fa6832806c409dfaaa999f37749b127d9
MD5 6303f294ee0d79b767d5797df4599435
SHA1 4c98a0b6d14ce20547915f57db69b786b7d5b5a6
SHA512 a87f0dc55f6e9184500f52020fe6c1b6263f23e3b27adaac1db5c5a59eef1489021d746b9e04d883f13097e42053a711ea30c01b9ec8b33de6903c994853a921
SSDEEP 24576:aLJnJiTk3R3waE4JrOuqspzB7B3xiHrPq:aLJnJK8R304lHxpBG7q
TLSH
T1ED15D02DD2A810E9D477C2B4815A1696FF31387C2F2569CB29B4D4317F12FE0AA79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5585b16676dcbdab046899b31a6065a9b3f8b2bd0e8fca0fd6444f8a09cc3909
MD5 3b35028109e94db793f22d033967d046
SHA1 98aad251ec11f62af130bda1f71091d60f79e357
SHA512 608800b37a2626e9311e0109bf5b47182f0ab1d24c338c9f75acf0ed2dbafdb62ee0f83914c21fe92a2d37c69e496ef601a1b713d11218b822b99fda947e7076
SSDEEP 24576:FA9mqCceDQncA/BmlvLto8cFVr9og9P/Z6pAqspzB7B3xiHrPq:q9mqCzDScAZmlvTcFg8Ph6CxpBG7q
TLSH
T14C955D05F7EB5298E8B3CAF1C96694159B327C509B34F7DF0A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 0fe9fc5db6934bff7780f48ec3a8cc99ac46f18bc3900ebe8b60ebf7992a2622
MD5 2c15270c1efb102893d29d2999566ee8
SHA1 5818b9c030bc9dd6811d8bcb3250fe4c8c77d6a6
SHA512 bce8e36b62f0b20e4b43ae3fe3ed60319bc3bc8f63ebc94ebc99ff7aa52647e446582e317973441248c18cf69d9387ef5bd27c6bfe56ad72df9ee44b025256e9
SSDEEP 12288:mlYJeXm5nkEUuEYqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:mlYJeXm5jUuEYqspzB7B3xiHrPq
TLSH
T15CE4125D26AC30D6C23F8576C5924188E370B8B9674653DF15E0E17ACE26EE66E3CF80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 04ff167d18d7bcb2cdde5ce455e8bc1cce25d6c2fa591854979919bf8a4e0a6d
MD5 c42a50df6de4616da13626dddff5f82f
SHA1 64408133de1d67a220bbcc90d6c2053d18a6a735
SHA512 a8c220d57ea54173c249368f4336011148094d6c9f149415bd2e9fcdd9d9ad3dd8bd638c225efc0974e3343eb078819138c07cfcb710aa1613b96931141a345e
SSDEEP 12288:Tmu6kyJqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:T7tyJqspzB7B3xiHrPq
TLSH
T190F41208239454CAD67B4A75CAA341C4AB347C689F1583CF29E0F63F8E35BD5A938F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 0f111d3eccc395ab44a685040a499ae33ab122f1d0571ea519689b2d12cbeb12
MD5 d3f1bc7fe740143d13b790f8be709293
SHA1 cff12bb1da05827643bf8c284a08569077196cc2
SHA512 86f547368b3be56011aae65020f87d8d0285cfd1f6f9ac0af4df174a6d2b1bb3b7fae69ea2109e61b7df846c9d46f0e3dc3f81f0fb609f7bc1adb9021d7c3ed0
SSDEEP 12288:KPIqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:mIqspzB7B3xiHrPq
TLSH
T125D4231D136954C7C6374EB2856A41C872183EBCEF4996CB3DA5F035CA25B82A93CF8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ff13e0b36c6f8dc59a67f92f5b037c27012bca1f56bf3f536473ab1491485414
MD5 447d060d8c7e30966956bb6f14a75ba6
SHA1 aa3249aba82debe3a034a52f0ae3e15c32927c90
SHA512 f5655bc90b9e6018631f559bd5b4820f12ed0cdbe9cf9d7c758906df870454464055bda8cf05649f72a2ec14ac9c49a56cfe3d7461b178e4d27bd32f3aed1e73
SSDEEP 24576:kC+TyQIu93VAumZr7jmzqspzB7B3xiHrPq:k/TfIq+Y9xpBG7q
TLSH
T11C558C1DA7E91DCAE276C675C8A34493E633B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 69b3188a733b740f00cd4e8f9440804c74a9cbcb3a092f52db83767a5237cbd6
MD5 bf77e97425ffe05dbb3580d7ed2d92fc
SHA1 890a732eb68ff05d850d2a2723e521a60580c802
SHA512 bfe7a71a2f53297f9e882517a7685f78849deec833c4b5de5dceae5bdb81e46a9791917e1d38a17931f53cb13d0973e569ee2273127484bfa4e4b70559839dc9
SSDEEP 12288:BcyrWOstaa3kcsEqyDpCstpdhOWjUse8PBUAxxue6HqAhpZqE:0LQikZEqspzB7B3xiHrPqE
TLSH
T113F4F10FB3AA00D6D167C278C8854145F67378759712A3CF16A0C77A8F676EABD38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 78f9e0d4a6679dee8eabb160525fd571a482976a2ef22ab06a8ecb6796b10888
MD5 49fafafd72c70b8ebf87bc77577d570d
SHA1 45ddffda2e0584d3564b46085cf61abe073eba13
SHA512 a2f787f80ad02db4f9ea6b9b3a2a2b4168a5db1292072f8e5db8798d764b5d7ca5879c5598a791026dc75fce7f5384f2479b87222a89934f72570a9dc4ef45c2
SSDEEP 49152:OpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPXxpBG7q:7pC7b4+80GTkipBCq
TLSH
T100A57C3DE2B810ADD9AAC775C5461665EE71382E3F2015DB00B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5ec5b5ddbb038f4adc607eba74f647fc4ec7675a4a80f9039d54dc7c40e3ba13
MD5 2996018ac475fe93d87906fbd11f1fae
SHA1 7650139f915ef40ce0ec8030d0b496328d091ee1
SHA512 314d0d8023dc48f86525c1d8b60323911fc9459477d2a0f7c6971221fe52753cbae3857456249fe33349ca6d44ae1e4a1ea206755a63c77c37970010c143e280
SSDEEP 24576:XSAwJPE1IDAo+4Kt+l44135UQBqspzB7B3xiHrPq:XqPCIo4Kol4/Q/xpBG7q
TLSH
T10355B02AA7F946E5E17ACBB4D663C501FB727822133163CF5290D13E0E16AE85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 2a24f19ebc5c30bce20ddc97889898a8805f19b7bb65d0d15cc40618c7ba07f9
MD5 1695910e546e6a78d9d9700fbd1b9c30
SHA1 5e0139e54a0dab65f1504bf2523680a0ce58e5e6
SHA512 05fc2441adf1de1562fb8ec9aead2e23f3a8140645310bf463113d07d4290074bbc966f082313a5eb9958178e86ee125b8b15be24d8c0975093fa662fcb4377b
SSDEEP 12288:kSsyLCFBoPLCRyf6NQ4tRqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:syLXPLcM94tRqspzB7B3xiHrPq
TLSH
T13125D03ED66D08E5D57AC27CC6A38506F6713CAD036166CB19A0907A1F6BFE4A93DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 6e65904160bed0ce8e32f34990e3905dd735ee3f2196e1fb32b7a9c87e0fc8ef
MD5 cf562c2137df6a319c40910dbfb32cc4
SHA1 86d235ead02666ab24fde0c95901f35698566dee
SHA512 43b211deb6551d8dc5655c23845e1e4e2c765779402d559db29fe0cca54942d0a6518d07709d5ef78182b108285e7d8094a2aded24831a4b350e88d2ec28352b
SSDEEP 12288:C9lyvj3IkxjbBz0qyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:CWv8qjp0qspzB7B3xiHrPq
TLSH
T123F4120E13A428CAD13B8A70C566819891707DBA67699ADF38D4F47BCB34BC1E93DF05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-14-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/440-15-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/440-21-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/440-108-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/780-135-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/780-267-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/780-143-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/780-141-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1064-85-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1064-79-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1064-89-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1064-91-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1064-78-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1084-121-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1084-242-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1084-120-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1084-127-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1756-519-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1756-268-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1756-263-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1904-266-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1904-246-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1904-252-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2044-277-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2044-271-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2044-287-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2044-305-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/2044-520-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2044-289-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/2044-321-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/2164-166-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2164-164-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2164-332-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2164-158-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2476-218-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2476-207-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2476-213-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2476-220-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2476-216-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2560-39-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2560-63-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2560-48-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2560-62-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2560-40-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/3044-228-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3044-115-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3044-116-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3044-109-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3628-191-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3628-72-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3628-75-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3628-66-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3816-229-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3816-470-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3816-231-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3816-222-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3888-93-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/3888-100-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3888-94-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3888-215-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/3936-59-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3936-177-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3936-57-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3936-51-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4136-28-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4136-131-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4136-27-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4136-36-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4344-286-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4344-518-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4344-516-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4344-154-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4344-152-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4344-146-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4524-192-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4524-189-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4524-183-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4524-440-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/5216-133-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5216-254-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5276-178-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5276-169-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5276-175-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5276-333-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5300-2-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/5300-77-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/5300-0-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/5300-10-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/5300-476-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/5484-465-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/5484-195-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/5484-203-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5764-240-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5764-234-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5764-243-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5764-473-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5992-528-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-532-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-525-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-524-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-527-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-526-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-529-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-530-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-531-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-523-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-534-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-536-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-537-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-538-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-535-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-533-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-540-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-539-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download

memory/5992-541-0x000001F6F9250000-0x000001F6F9260000-memory.dmp

Download