3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Size 1.8MB
Sample260708-jtkd2acy6w
SHA256 3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc
MD5 c9f1a6a851b43f6375e06ffb424cbd57
SHA1 434937a313125725b6740121b2d4fce56243f23b
SHA512 bceca081e14f69a6f79203bd4480d470d17ad7dec2fd3e1776d0ddbb7176b72ffcb2e3e0897ef9661e5aa3c1a650afbe29490d4bd2d6aee8d23c4471010fc87e
SSDEEP 12288:nGp+Y6TRTgRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:nGSNT2dCN/j2GLl3iFSE33b9
TLSH
T1C585F1207A80D0F2DD2709354DEB9B759629BDE08B2075CB9B84FEEACA757D19731203
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1960	alg.exe
2372	DiagnosticsHub.StandardCollector.Service.exe
4004	fxssvc.exe
3536	elevation_service.exe
4904	elevation_service.exe
1064	maintenanceservice.exe
3948	msdtc.exe
4352	OSE.EXE
2776	PerceptionSimulationService.exe
892	perfhost.exe
4572	locator.exe
4784	SensorDataService.exe
2448	snmptrap.exe
2492	spectrum.exe
2552	ssh-agent.exe
1176	TieringEngineService.exe
2068	AgentService.exe
4500	vds.exe
2612	vssvc.exe
5096	wbengine.exe
3712	WmiApSrv.exe
1752	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\locator.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\15469cb87c8d181e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027a56281af0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000065cf780af0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d6b6781af0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012ae4e82af0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a1b7881af0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
2372	DiagnosticsHub.StandardCollector.Service.exe
2372	DiagnosticsHub.StandardCollector.Service.exe
2372	DiagnosticsHub.StandardCollector.Service.exe
2372	DiagnosticsHub.StandardCollector.Service.exe
2372	DiagnosticsHub.StandardCollector.Service.exe
2372	DiagnosticsHub.StandardCollector.Service.exe
2372	DiagnosticsHub.StandardCollector.Service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe
3536	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Token: SeAuditPrivilege	4004	fxssvc.exe
Token: SeRestorePrivilege	1176	TieringEngineService.exe
Token: SeManageVolumePrivilege	1176	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2068	AgentService.exe
Token: SeBackupPrivilege	2612	vssvc.exe
Token: SeRestorePrivilege	2612	vssvc.exe
Token: SeAuditPrivilege	2612	vssvc.exe
Token: SeBackupPrivilege	5096	wbengine.exe
Token: SeRestorePrivilege	5096	wbengine.exe
Token: SeSecurityPrivilege	5096	wbengine.exe
Token: 33	1752	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1752	SearchIndexer.exe
Token: SeDebugPrivilege	4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Token: SeDebugPrivilege	4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Token: SeDebugPrivilege	4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Token: SeDebugPrivilege	4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Token: SeDebugPrivilege	4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
Token: SeDebugPrivilege	2372	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3536	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 4264	4224	3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe	85
PID 1752 wrote to memory of 5084	1752	SearchIndexer.exe	112
PID 1752 wrote to memory of 5068	1752	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe
"C:\Users\Admin\AppData\Local\Temp\3df5bb8918a811f941575adf341e81b616a44ace31e75cd295a765910313f2dc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c start encrypted.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4264

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1960

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3088

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4904

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1064

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3948

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2776

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:892

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4572

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4784

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2448

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2492

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4112

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3712

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5084
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 999afef203e3d3c667bdb3cf290eef488d4684ef70596bbe47e94007870c3515
MD5 6621334cd4dc5011ca5083b3912ff170
SHA1 8aff24d29ab8babf9fc51f920078da6372590cc2
SHA512 6a90d21f8cdac272d458177334feb281c81a0a6281c6cc048b63b8c41c917b352d139ab76417f30f2edb5181fee4a9b3c75836cb224826140ed5652d27a33813
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnXN/j2U4FH:/3q6HjBYj2jF
TLSH
T14BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 3a76b906149d3a537b9920c0dd3eeac941fd9646d956d8e07f6524ff3372ddcd
MD5 c235cb694ba1a226c7e7e5e8f6eca325
SHA1 1196d8ad2c233a9af30c67521247d2a6d9f309e9
SHA512 e12c96bac7e50a187c7abd6a2a72e81a3c8fa822091b346dc57254488bf63eb12d3fbe8e82d178b8daea015641b75927056cfb730934db323a16c95e7c25c032
SSDEEP 12288:81XLsswWkxy2lRq2czATJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:KXYfDtczArdCN/j2GLl3iFSE33b9
TLSH
T13D85F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 474dce93889699abd00968f474e5c200cec6cfa9cb70841b7c8703cc769aa33f
MD5 789e664fba28427f7a1d2867cdbc71e4
SHA1 83614d8668dc946cfbd94d3e56a098b455a8ae6c
SHA512 3156d390901af6d468aba1cef246138e884039475580c07ce31cd6ec14423c1738060938f157904a05105784786f7028d096ab0e0555f9eced9302f74aa8e5bd
SSDEEP 24576:r0Le5ji0hmxirMUdCN/j2GLl3iFSE33b9:rPji0AcuN/j2U4FH
TLSH
T19EA5AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ffe6dc4c14fa25483cfcdef5dc44ae1e8da79ed5ad75a01774d82b8092b65db8
MD5 614afcb2c235b7838609c51b841a8afc
SHA1 ea6461e48fbbf915a2f2e94444cf344ac8307e50
SHA512 f12a091438a42bd4a7471471f9cb2a105c0cc72dafd73e07009fd49e70ac5db9391e78dc3b9b43315a1b2a3c4fe15de051e8d6188a50961498bea76a72823df9
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWE6q8wyuedCN/j2GLl3iFSE33b9:O/ezSC6vUzPvxHjyyN/j2U4FH
TLSH
T1B7755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 44e2f7f6331c307800103197d9e330e708206d48ab3e4562919063d9af5aa109
MD5 4f19d4a48a74875b842a914d6990f1b8
SHA1 e128c73b8bd15cc7385eda54fb7fe9b7fd9f5b39
SHA512 93710eb02d756c399d18a8e7ad6bbbce460fd531125ae2e2b61a4ac470f438e10db98745191b3d0907a3aac1fef7bb96637cf7676637c392a504c51cfd74ed56
SSDEEP 24576:gVbqPb88hv/l+6XdCN/j2GLl3iFSE33b9:gVO88hXl+TN/j2U4FH
TLSH
T1A1559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 b484d72d50ccae8cf45ccc4d8e817d7914df6266644b6a5d580a2a808171d760
MD5 b5325e57f396e1c82aac36ff9aa29b45
SHA1 56a165018964b828acf42f809c02bf1362ef9125
SHA512 e043a6d70f6ba87420fb14289508e8d70548d56ba484827723cdd39e4298f7b89c9ba736ff50036c0f133aed03b66c1ad78612b471f8ff63be931a05b9cabfb8
SSDEEP 12288:KRQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:KRgdCN/j2GLl3iFSE33b9
TLSH
T159752364DAA5B565F26F837903ADEE615200FEE8E525884785917BEF127CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 aa50f593dd25c98e2501caf014ad5e7f9b72b364d8506e7be5cefbee1d028fb4
MD5 8c16e6b389598d04273bd43b5b4c1eac
SHA1 991ad6efd21f75a0ec6ef2d9b2e22d1b1f5a2bba
SHA512 0b337537f20966a5a6d9c1266aa485b1a3207ca619e951de55de8ce47b8596153f220d3593ed3392d091f6972834e7994dc2345a26de1940b67bf987d0a6a9ff
SSDEEP 12288:oeBNUbTVO86UvJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:oJIU/dCN/j2GLl3iFSE33b9
TLSH
T1C085CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 89bbd0063ab843e2a44609af9b12335d219cb61374ea4696aa2f48a81e687284
MD5 ea40e6b7115e5ed241af7a7503d846a5
SHA1 102d8871cefc86bfe3609894d687914bd496e959
SHA512 8b308fb1fa5671b2aade5cecea8f0d89f4d0529f0f1d77b6e30b90c015a2f8780283a4f668baec74a075047e7b333ec4158a82d5b6473d0d125b1b6dcefacda0
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THF:+QvGAdlCEL8c/yRNw5Cfj2jF
TLSH
T1F0267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 a6fb4204c0085c9f58699c2515989032dfd6d6ec8054e40a70758b30f8fa6314
MD5 73321f532a738cb4afbda87da46a5060
SHA1 921fefa7223e119b8fa1ea149d63e80989543a5b
SHA512 cbcde4b73db2ebc15ccd0e94ed8418e4ad51fe0544dfab4c4afa5f7f4ecbc0be801a99c96299fa4fe7b0ad5623d0adc3db0215eb9fff69ce3aa79990399a864f
SSDEEP 12288:xAwSfxL/2Dc34DLLmt0LDQewsAj9JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:SdewsAjpdCN/j2GLl3iFSE33b9
TLSH
T10D95E031FE74E436C27F0DB61B36C716142CBA608B6119C3E3E84E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 85121201a87ce93b6ea691a4039dba5005e657481af310027eb14e221aceab6f
MD5 c24be6050e6493c5d85da32ffc2ac5ca
SHA1 b9c71f4488d6c8caf7f259da521a2a092019fa73
SHA512 4fd7fbea82812234dfe23375654c02c26fb92d957fb1d405bfdcf955e24a1207b0d66355d27d5967dcb172d9bc1869462550410747a2918fd242fcfdff31212a
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHu8F:9UEtQevvqc2W1cpV2EI32u
TLSH
T180474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ec6a8374f6db345b7c12a3f08c7b5777d31a0b83b1956cf475e769a29a8b75c4
MD5 726cbd3b21b9240ed4a5585dc1a309c7
SHA1 caab6b1eaae1958aa314d8e40c70a7f4c89a8ca9
SHA512 4f4a18394056f42c06a88efca0c57282dd545912b5ad09f64dd3824fc7c6c60079360ea414df63c379a093994dfe589fe8bbb216479713606420b54712a47314
SSDEEP 49152:pCbRquA/m2yL5zQfFiV+XenmE3/zeN/j2U4FH:moqtVjnmLj2jF
TLSH
T181D58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b602674bc68d27f499b77aadc6de7e3d43b0aaa6bb44c22ffbecc23479cf3571
MD5 f0d5429c55be1348ddaaca82c09f15d9
SHA1 9e86433c34aa2f61e16a79f47204daed391db0a7
SHA512 283037660f10214af02083153101d342f655f7030388b1eaca742627dfd4892e3a77500c7729a6eb7d4fe462a0c3ec9b518cb9edb4f6de0648a680bcdbc76868
SSDEEP 24576:oAhGLJIFoiwtA5l7S53CdCN/j2GLl3iFSE33b9:oAMyFoiq51N/j2U4FH
TLSH
T158359D80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 7a02b79b85206874d90bd7f55431d5e869fa6204f82d8b0e82bc76b021f84015
MD5 501b9dd9d341d3b9279ac54d5935967c
SHA1 c56df87a42e1fce238f3df92e72b420457efb637
SHA512 7d0c68d346c18a94887e7b0c97b61e95cfbf62e89ab74360de8e4005f218629ec1be29c880eb89594fbaba2ff3e2d256c120e36e0435bd440cb4b243d87f0f5b
SSDEEP 12288:Pmw5HEjsChNVBFgl0WDm+CiJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:uwuoOW9dCN/j2GLl3iFSE33b9
TLSH
T1C985F14577E41CF9E96782398697C536F7B2BC512A21CB0F03A0C69B5F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 b94d5c824cca19ba5bf26a0a0be9832175042d4dc994baa66b2549c0495d16b9
MD5 ab9e89fcc3c7994014e5ba5ae0be2539
SHA1 b47f57829c61e17f4fd2ab3aa2aa613575a935ab
SHA512 cfdd7eb0b416eb8b08acf5108708ec271474dbd8b860496b6b93698bea0cb19252f90cc7f7058c3294d366153b54a4ff39c361cbef124ae20396de0765a0561a
SSDEEP 12288:CBZ1IytJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:sZu8dCN/j2GLl3iFSE33b9
TLSH
T10E75125933E471F9E1A7823C8AE59A05D321B8A5A73243CF026147EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cbbbca0bc81e2e4f8b2180957aa8a8f4442bb86db7678cbf0c9a7a892ba780d8
MD5 0c4bff712a6313b74f9cd1917f302d90
SHA1 5268a9d69e8fcf4461de8a8c5f6f90a916154cf3
SHA512 0d9e051e5fc9aac635dd5bc3a577f29d843e0fd1b71f90f8727fa781bc7d73ccc4d84f507770a7b2ad1e9884e05b71abe9b7ba7eb771e9d10666021933ab1efc
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:oQRQyi36YOcPQLvw2gAf+PN3sj2jF
TLSH
T139667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e3304a5d0e3d4e0ff0038ed819a739807d8b140289402ad38a79c1ad3531ed88
MD5 598cb668c134609769fa24c8514abb01
SHA1 bee835be8883a12ca896a89af8bacbe689e05416
SHA512 2f8a2c70ca3ef0a2301e4cfc9b410fbe0f4f27164ca8cf4c01eb31044fd51f7ce580113a16e56b24651fdcf488cb303f5a4e096736b0da42840e839540ea20e7
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:YQRQyi36YOcPQLvw2gAf+PN3sj2jF
TLSH
T12A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c33a509ffba7d250d43b52da595a34ff9510545416623a2a347945baf9c04e06
MD5 3aeb15f1c3fa4ca283d5cf370af91437
SHA1 238801a089ae54077c0c9e8a3558e22f4a2af1b0
SHA512 fb2aa8802595f7e23da8c195186d1e2dc9617bde846b625714b28c31f8e22b67e793e6345dc016d1f2ceeddf380a5ca64c00dc1584ea2178699771e43c2c40ba
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0sdCN/j2GLl3iFS+:368Qg55nhheWu7PNU3/uN/j2U4FH
TLSH
T192B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5174fa9833eee1da0185c5412e4426db73d57d4d2f7ca76fbfc7ffd688afc03b
MD5 6f03b44b753c0243d47d9beeb484186a
SHA1 c0b3fd0d3e2f3983a091d0d7dfdfcb4a2fc9b03d
SHA512 5e38210489b5cd0d56729414880c9599338c5d1e168dca7b8d5c83d32d0af044442ed44b5b053db8b58864ca3f221cf51212b0afb9965fa1eeb4c0a5ae18504a
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99X:ry5112gYy5azzVvL69nLKnhZlj2jF
TLSH
T1D5168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d629e2ba5ee3ad0ad77b46268afe9e4540689bea55f3b8c876f69265ee43a492
MD5 ac0bc348648c543b3952943387a675a2
SHA1 49230540b6e6c7a2ea5fd05a792c66467982c8c3
SHA512 164a950e788ff0e6310232465ef8c66f315328e9714b9696170c30ac65658740ddef9a6a1ff567adff5e5a9ff24c221531dfda75828d2375d74c756e3595ba9e
SSDEEP 49152:DB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl4N/j2U4FH:1u6JmVxd2dkj2jF
TLSH
T154D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b39288bf9aa63331dbaf2700d60061353654649763cc390e0fc369fc931cf711
MD5 2d209baa4b15f5ce1ee9fab91ee4e113
SHA1 31c48cf5a6cb260416642580c77fbe6604415645
SHA512 7cbd68088414565bd7be46aca28b164b8e5d3901ef1ea992e28927755bd9968454115ef3e8cd155aba6ea6ee3b3e3f64896dd0cb249cad924db0137226098d55
SSDEEP 49152:61hpsNoJpF1A6UU44CwH7R4xsN/j2U4FH:6mifPbRLj2jF
TLSH
T119B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2f7c3c6220a33d0432ea73939fe93b4f544832a3bb6680502669ddd69da147f0
MD5 f160476450677231731aea5b2d58e7b8
SHA1 087281744b0f2b632ddca15d38fa84026c2413f7
SHA512 274e0767cf4d66cacb0d9969b52dffbcca24141af58381d3d0f1e8c7743f18cfd0793a30ccc2bd56428cd28de0a79e68c0eb4c3453c17e647326be8630249c74
SSDEEP 49152:9SuZQIY0Be2KRRVtOnks6NMHqnN/j2U4FH:T5dKTi615j2jF
TLSH
T16CC5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 424700b15594ccf7140248e2d246e7fb208ca1f9bd86c8f665c3b555f2e88da6
MD5 bb5314a8dea325052f37bb191d528fa0
SHA1 f96cdf5490de7ab5ec019f1e6b608c620d373e7e
SHA512 ba8e94a212fd3045034f9a1ceab0c0f67c18f1c501f65b1aa2d1f35d061f94f72e5c6fa65c92d27e188dcf7357036be9c65b249b4fcb55571ed0cdc39a306013
SSDEEP 49152:MhtSn8EApI0figngiDn0AP5wIN/j2U4FH:tX2iyphnj2jF
TLSH
T1B795BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 88e690260cb026745daace6150f5dec2c1cd6421a48c492e30d894808b57a498
MD5 a0fbb1e27dcd373625907530937a53ba
SHA1 d19751d69b6a28828f8f71c82f14ee0c103546f7
SHA512 e6c6e3b5689dbb681581f1862e7d126be5c5f3c9f0e8abd8ddd0176186c482f6bd0b0bb6d4a4f9bcaf2fb7ad57455076cd44aab74ab20f94b73775f12989cf23
SSDEEP 12288:cIJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:codCN/j2GLl3iFSE33b9
TLSH
T1A1752364E5F6B669F15BC37943A9DF515200FEE8F6264487828156EB137DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 5b9631b966655c1f851026571e3a6511747c6705a02c06b54e2de6d217d07954
MD5 661659609f5a1f7443f92f27ad5b5b16
SHA1 29fc375fb6b0cf45affe295b2eeb3e5ac93ab8b3
SHA512 f8cd9b3a23c394a5c388d57108a2b108b2cd340958e7b1c9184ef4a4008e3c569b16968138e00e72db547f315f204bf7df6353e757e75b72264ac0a2ea127898
SSDEEP 12288:iBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:i1dCN/j2GLl3iFSE33b9
TLSH
T100752364E9F6B669F11BC37943A9DB515200FEE8F6264487868156EB237DFEC8033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 e2cabcee1af0b75d31d7fec3716208ab44c0a796d8cbf4115c809253f9c41b6d
MD5 314b7a8ea8769b76e1d416c85b4b1a98
SHA1 100823f882e65a48794f9c83956a2a5041ac28ac
SHA512 71e14de628fed9034d0236951fa8d7888cffd48cc9d61bb52167a90b1a842ba3e864d61dca5e7f85b3ae9baaa77afce2f47a3f6c59a3875c33610a85a25f8b4a
SSDEEP 12288:dHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dHdCN/j2GLl3iFSE33b9
TLSH
T1AF752364E9F6B659F15BC37943A9DB515200FEE8F622448786C156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 e095d2521661d18a817746703b43ccdfe3a847d881fa1a6ab17670a10e0f40ee
MD5 5c0298d2cccc94c090b074f8ab5ec6ec
SHA1 6fa03029afa2251636aa929d355b8535a3d5f591
SHA512 364e2f7429acd7a32529dae92f99dcd7f019637fd29adcae8463136ea9f4ae694f531d1a7ece4bacd0d385cdf340f3865ec8fd0db16237f849d460dd93808a3a
SSDEEP 12288:dVOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:KdCN/j2GLl3iFSE33b9
TLSH
T165752360A7F561D5E46BC37C83B5DA11E320FDE8E73245CF86400ADB1B79BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 8c5fdfcc5ab8ce21225b19e6fb8a1d36f43672397b0743963138264df0862a68
MD5 0c5c990a9e8e6e55ad269af79dd7ab27
SHA1 a9286724823c61e6f4ceb53463509309ace34c32
SHA512 f4731c2c1a9d8dfc4ecb65e58cf289ac11070378e957e461e74d1444383ade3cb8c0429fb746ef0bafbc98b124641b72f33032982abdf385abd7dd8392baabd4
SSDEEP 12288:d2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:d6dCN/j2GLl3iFSE33b9
TLSH
T1FD752364E9F6B659F11BC37943A9DB515100FEE8F626448786C156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 fec2ba5b40dc3e116a1872fec9ac91ec362bfea76a5a18160bb5ba77777d9c29
MD5 bd0dadf73b2efe0e4aa4521ad2f2d05f
SHA1 db2d02f481ce251bbc34b30d784f7d74bde50777
SHA512 ca621c4d300308b4a9890835d304eb7bc60193d35375c627fabd530fbede053972567e8f7f371f394a7f72cb8c3f2f462bf5d035fb0976df290f7ee6f8971cd0
SSDEEP 12288:AVJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:AxdCN/j2GLl3iFSE33b9
TLSH
T19E752364E9F6B669F15BC37943A9DB515100FEE8F6264487868156EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 f847d0bd866b647b04469d5408095235546c510568c2a0732c0b4d4e4c229748
MD5 f34f957f843ad2c82843aed354e7d88f
SHA1 d1e609b7e4b9d51995e8baeb0dd2a45fef80cebf
SHA512 5dbdb5d82de07addfbec2c9ef9259378ecf7e3a3b174233a36322bf632dec9337504236bd740aee0fde96faccfd3246af04791efb850287c8065683050c36c0a
SSDEEP 12288:ZpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZtdCN/j2GLl3iFSE33b9
TLSH
T1DA752364E9F6B659F15BC37943A8DF615200FEE8F6264447868156EB237CFEC90320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 3893abed8fa7c9482d7f41715b2d408dd692424622255826caff51be8bb9e6e9
MD5 4659b59285edf75603b2855a1df4ddd7
SHA1 951df3827a666ecfc2f8416c1f54df93b47268a7
SHA512 5224627bea5d1ff57761241a63bddf712e7b6ef1312ad755d9aacbed63431c820657f20b052f629273776f76e1b663a5cded22ab092146ce28fde5f9d31f3209
SSDEEP 12288:7iZwb6zzFEoS2cPvyhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mZMSzFVSOVdCN/j2GLl3iFSE33b9
TLSH
T177850294B3A018F8EC67823EC9658916D2B1BC594770C60F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 90dd22662d91a86fc43a6f93f6030c216d128fa885343252474b6a534dcc9837
MD5 a1b83b935d687afdf895841ba1932776
SHA1 534960c26c4eda044143c8f90761546b48f057ab
SHA512 07c78bc86b9169c1cfe3019f6cdce64e010e06927ab039d00fa89b7652b02abb970461d6c64f60442bec336f1e02e6f2e8c9f8125a1e6a8e096ec080448e0494
SSDEEP 12288:vkJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vMdCN/j2GLl3iFSE33b9
TLSH
T181752364E5F6B669F15BC37D43A9DB515200FEE8F6224487868156EB237DFEC80330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 fc63993c6724b00345346fe824241b85593ba48c351c76e77da4fcd68a0d2bfb
MD5 90eceaa29431b68ceb0b1d5468baf83b
SHA1 e5126b04be8e705c76a7b957b44e5c1198c55a49
SHA512 c4de2646b2217e54bbe9332ae751fb5db50102d9c8e6cc48938d7462737156803b7304e631a4a94b3ed1c3607bf48fdfe980451b725af9c33b356d0416242fef
SSDEEP 12288:GAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GwdCN/j2GLl3iFSE33b9
TLSH
T1CF752364E5F6B669F11BC37943A9DF515200FEE8F6264487868556EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 56bb61afa652af5f05e2dec7694c44b999c46576ec80a7c72b2fbbe25aaf0ac4
MD5 3d1d8f8566a870b123dfd2bd38c0333c
SHA1 d1739f2cd8f0c18503fdee2778c4dbbb6165088a
SHA512 596597582cbf25d6f671f0570a8a7b56b40aa884fc7fdcc7ca71c2b8048ca74f42bf9291f6b88544921c2089f9f3a6ed0172f35136dc5d1a916be7edc3927326
SSDEEP 12288:+yPz5L8tJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jzy5dCN/j2GLl3iFSE33b9
TLSH
T1D7850257B3A131F9E177823889A55A01F331B87597208A9F43A007BB2F377E49D3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 83c056f4448b8227ab51a15491971d9b6f34de7c02329154e48e7343f6ffecbe
MD5 b9cc64bf9f941bf2330367287bbcaad6
SHA1 941915f9f368c063e6b841f8d963da47461c63f8
SHA512 7997537c7dd3d21e996a4b49d457b790a5efe88ef098b096a95efefca27eeca34f8fd1651857ae5797759751ca6d451a03f6caf7ff339f3d6529e2a033b47573
SSDEEP 12288:VkJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VMdCN/j2GLl3iFSE33b9
TLSH
T183752364E5F6B659F15AC37D43A9DF515200FEE8F6264487868156EB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 ce4ebbd12383ea52dfe15e4a5e49ef5fd3580366c5d9d6da62330c97424e0be8
MD5 f155ababf9870315ca3bc24090c8d40d
SHA1 a37660e0aac24d3c6e1d5009363416b1b94b5e1f
SHA512 e845c2ca0b780e86fdd7495c7abe72c005dba59527ccde8656919ee670d54aacfc18debbfc02c066ebead70f176cfb1b593bd5a7d195141bf6dd721b6add55f0
SSDEEP 12288:mkJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mMdCN/j2GLl3iFSE33b9
TLSH
T175752364E5F6B669F15BC37943A9DF515200FEE8F6224487868156EB237DFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 57addd0f03073e9921fef249588c40dc8565b1e053e269211cf24ce4b145d8b0
MD5 5eb561208323f35d2e1dc46694a2baff
SHA1 83fab0badcf10d1061cb99cb6adb45feb9cba355
SHA512 67675de455cd907a9d0250d25699b94a4c19d8b63543499ec5a22a36c1e6bdf264f968a5afaed31ffd4de848122ff04c2dcaf0f429b5cc6a7bc566d7896be1b1
SSDEEP 12288:nyPz5L8tJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Kzy5dCN/j2GLl3iFSE33b9
TLSH
T1DD850257B3A131F9E167823889A55A01F331B87597208A9F43A007BB2F377E49D3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 430c423ce1fcad1da11dcd011d78205d7e687c47f9d573c0b3c90086d70456aa
MD5 525dbe03ad9d6cb6e5f944e7739345c5
SHA1 de9c6206a5c5e2b0934ae77c07857e773c42f227
SHA512 89657ef123dde9b01ac871c2e23aa630d0d589c9d9384dd2e9f5478c3d6cfa3539f8ba23f18a33c648c03007a42a95ae350ae9bba2b85b9df46145ed2f8e7715
SSDEEP 24576:CcP4mcvIjkGOxhKP2l71nNKbrh/8KBEdCN/j2GLl3iFSE33b9:tP4m4IpOO67W8KxN/j2U4FH
TLSH
T14765BE2DABDC0096D0BB817886658A49FAB1742A1F3286CB1160937D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 ea8c033edb42cccac7bb37e859ae9c0450a6414907c55d6fc8a2950b63af6142
MD5 d59c23620d24412b618b3a25c9fc28d5
SHA1 e876aa3d07a23f1511b54298d73295fb1ad0e471
SHA512 8368cfbcafa9f58fb0725155a39ce53c4532bf5ac9b2374e47940c6ba4a09b1a05ff3e909d6ee17a8c26cd4f04c93c814004868df73d2ad9e75687b4aee23e4b
SSDEEP 12288:iNsf0JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:78dCN/j2GLl3iFSE33b9
TLSH
T117850119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 1105607506d08944ce4d4bf531d6cb371ee9626fd5708e6a278d142fb1bbcb37
MD5 ebb397e794706eec236a6dde867fb396
SHA1 9d93e08ffb6a94fa7fd429d60615652cc7b3fc8d
SHA512 241e33bae5c70c207171e885a02fbf6b3599d229204647c60c2288d8c9f5dfbb387904334fd3f611bc0cc67bbe0d1886ed3e387fb2c42042e4808b646f3971a9
SSDEEP 12288:PUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PcdCN/j2GLl3iFSE33b9
TLSH
T19E752364D7E9B656F17F83790369DA316200FEF8EB258487858156EB127CFE8D832123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 17b92d5f3d2f6d815b4754b2b5a1659dba0e4fd2285a507a684accf3d58564d6
MD5 bcd0a2cae42ac89ff683dc9422e85f2d
SHA1 44deb17d87471d9fc8ca8dd293741697e89b8fcc
SHA512 510534c096825ee4e6dbf32ea6200f420052226226db31e68ae2e6c19420f402852781ca9dfb0395a9ab30f607d0921821dd06edb99182ed461284653539fc17
SSDEEP 49152:Ea0h2GEkuAe73q3pp46zwwQdN/j2U4FH:Ea0hNYG4Jwuj2jF
TLSH
T10B85AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 de3fdbce81dc8175a87a3d2b29bd72dbebcf409f495e1ee234bb0b9e8216b86e
MD5 3150d908be43fb87b065be83371dedf9
SHA1 89be72e3acb26ad219df95d8b699c8e6490966ba
SHA512 3504786293bd3d97e6a0c1e2ee7d47cacfcbac6ff74a1aa09716e039200592d0114244e6af3469edb54e28bfcfe788867c3b468166484de9607a8dbe93504454
SSDEEP 12288:/hbHjfXRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/hbHjPldCN/j2GLl3iFSE33b9
TLSH
T16A75027D66AC21D9F176D27D86958A06D330FCA4572183DF42C182BE0F3BEE85C36A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 03af3e03207a0328fa0e199e655886dbb1fe027aeb74da0319b5f2ca6b07d9b0
MD5 de2a71582f00a4dffb87a7e663aeec22
SHA1 c3f832d9bab7553eac79e5ff0dd86bab7b41d1fb
SHA512 a3fc4f63c3bdb306dcdba3b692a6f8ffc3f3230f8bcd33a122b4d20173ee95685fc8eb18d32fd7cff8048a9cca04de505792eeec6d5cf8fa384c3d29be0b9d09
SSDEEP 24576:C3YgnJcRTk4yti+R5dBR/9dCN/j2GLl3iFSE33b9:CIgnaTk46pBR/SN/j2U4FH
TLSH
T1FD45B02DF3B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 6f4d44f8ba6ae78cb2a207385d86421524e99c3fa21fb8cf691667246c6f705f
MD5 25835645464f08d02dd991a5c3e0fcb4
SHA1 415e8abce6937f1407088f0d10cc3661e24b227e
SHA512 42259bf428b0c19b2a51bd3fecbb5f1fa106fee2aa046bc5aca52484e611977dd9a808656423d68b7fa273afc1eb8c4b4fd154a94cc955596f24e341051dae63
SSDEEP 12288:EwJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:EAdCN/j2GLl3iFSE33b9
TLSH
T1DF752364D6A5B659E16BC3BD03A9DF216200FFE8E73245C7858166EB137DFED8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 f2465aabd98ef9eb1e375e3fe0dfaac7cf393efed570f88eb781d26987c3f701
MD5 5db90d84d1532f3424623413e6e9e70f
SHA1 9be054e1520466f60dfce5c0486e4731f79463ec
SHA512 f23295f0f87c136cbf9279dbdc437051d07a22d3fc473abdea7b23798d094d6e497b55cce25a73b46827b3b543014c8cd9231bd8948a545511b8eebaebd0869e
SSDEEP 12288:QOb9A4LWOsvAYFTTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NpL3UTrdCN/j2GLl3iFSE33b9
TLSH
T1B595F154E7A410F9E96BC23CC5A68A16E271B89C0724D7DF03A84BA61F237E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 adb5804b21e642b51fd6b9ffdf548da081eab256624c406b1470bd2db142146a
MD5 69377ece9002694e82dac39ce092ec39
SHA1 a28fed647e60546d1e8b9a892bdda2bae47f8001
SHA512 9dbe6d8f5a7cd7ee77f5c4faa76deaa8b7cddf66c7c95d98c03cbc5ed41c7eb2f38e47cad386b849dc816d7578736e02b06972e5faa4ad9ab1e820ff82e3649a
SSDEEP 12288:OpFtpOPJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kOfdCN/j2GLl3iFSE33b9
TLSH
T10575022936ED20E5E17A923C86968709D330B8A5572247DF42D081FE1F77FF89C36662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 20b47240a9198b754dcad64f1dca38f02b24b864993f993142da45af5c7e3429
MD5 daae7a1bf32bd18ef68bf518b6041ed1
SHA1 3e8d85c2fc7bfa04b955062d111d6f0a44c260b9
SHA512 27d749d6d0d09c2a00ee8225a559800b3f84b4f8ba039ec9bdbf5c2a1866eca19269f5e756c3421d06606ac4c31dc48d1f9b24a63bc7c37a6c5569ec763e63c9
SSDEEP 24576:R7NM9YqZqmWMUkPjZM48Mv6bEhsMdCN/j2GLl3iFSE33b9:R7cBWMpPjN8DbEh6N/j2U4FH
TLSH
T18565AE2E6BEC81E5D477C13DC9E28605F6B1B4611B318ACB5162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2afd8ee1f0d7c21b779233796afe5ae1502315ffe499e8e637fc46401a4116a2
MD5 62cebdddffcfbc8f8ee01bf948aa502f
SHA1 22d916de8cd7cbed9cc203bd13254a39d91b7947
SHA512 029588ce13d7ee58c6a93f21948c017855f4621e536a651ff58ad3235d8e72c56215d475fd0d73014ad99220e7c273dd826e0ee814c934df792aac2a29c3afc5
SSDEEP 24576:ZW6BApg2YuyuNDYTabvcdvNYf8km1WdCN/j2GLl3iFSE33b9:ZF2YuHNETovAvNYf8kmXN/j2U4FH
TLSH
T1C5858E2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f2928ef82c7c183b6d34f93d98d9c1ee67bee6a18289d8bca2976be206c29c75
MD5 4ac43546734f7a6bcbbd5a11a5a9da00
SHA1 2c9953f7a6b91d7778535a62d173b80c76ee8609
SHA512 a91c6b5e2bb34206b04ebc8289080abbd05dc8794e078e4ad4cba44c441a29c35e5934ed13b384267bf5377913b145d00be40e2c610d9ee05f85358c6fd5f846
SSDEEP 24576:0AFs06+Omlf3NXEbToTdCN/j2GLl3iFSE33b9:5Fs060lVXu9N/j2U4FH
TLSH
T12365BF2F62EC00D5D07ED17D8A97C91AF2B1746307255ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 50eb7340da90dd0ec9523076d320c18fcef38df0fec29b29ab54c9776592661b
MD5 a83344eca72c652575d0290c5a06f58a
SHA1 6e426b9f36da04193a521c85a65d17749e08cac7
SHA512 c5713ad32ec4614c69a53b45570d09448713b25ec16b1250272cbb2ddbb860de333fe8127e6b47c9b622416885af16beb3a705e1da93ae2f559e14aaca3196a8
SSDEEP 12288:VCJnJ5D3VkrDzxEJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:MJnJ5D3WXadCN/j2GLl3iFSE33b9
TLSH
T13F95D02CD2A810E8E4B7C2B4829A5B56FE71387D2F2269C718B4D5353F12FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 591f6ed4e6693a04a627ae451600b9f0c54790611d6b49e84848465e81f8b87b
MD5 65bee3f52f6cbc433d31e2f2e73a37ae
SHA1 5cce27ccbaac8efb30826ee03d95f6e09fee5f7d
SHA512 7f03c8faf80741c2575feb6c3f0a5ccc14f3022d8390c4e5ba069b700ba8ce7ff1e9bc9e6ef1641c733b35b969b0310af44c0caa5c0ef4dd6961c6ebc2df852b
SSDEEP 24576:IEPghm6/7IIXdwcXrif7qQncjlP65i3Vu9dCN/j2GLl3iFSE33b9:ng06DIKdwc+eQnSt65aVTN/j2U4FH
TLSH
T194956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 ee30033b01dd18ca5bae8a7e9dc2e7e30ebb31a7beb45890df06d28ae6cf1a9b
MD5 56b19805310d0eb2b33e4c114b875e2a
SHA1 a72ee6e83896ac9e6fc591a8f35491d8cdb29678
SHA512 bc17dda881162884091ff63fa2868a84bee77e5d1db0032c91302aaa453b63855ed6992ff23c2009207fcb56bd5cee21d56cf10dea6154684a729611155835e7
SSDEEP 12288:kEP3RniJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:fn+dCN/j2GLl3iFSE33b9
TLSH
T1C075126D67AD70E9E12AC13D82918605D331F4B4AB2217DF42D1C2BE4F3BEE85D39A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.7MB
SHA256 7d06852bf9f8a057d79ac5f839e1bb4fba22fd5a1cf3bf30bd677ecf3ad48725
MD5 4a0d1357dc846e11aef7b31887be1652
SHA1 1598489c0aa7ee4388642ee3b2a9be0d2b832c9f
SHA512 a2f864f931246eb8924a90e782a0ae3d23469fa11137032195d55ad6c4edcd53819229ad3c6261a693eeb46535d95eea8a1e4006c9f5634c9fc036770baa85a3
SSDEEP 12288:tjkyBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tIy1dCN/j2GLl3iFSE33b9
TLSH
T1CE851214A3E4A195E57A433C86B686619A30FC70EF2146CF41C0E77F6F3ABE49831B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 98a07c8f4810395c2282cef27271837007489d30ab7c9e4cb3cb63243b7dcec4
MD5 b53ece5dbf492f0d3b693c0646ed1972
SHA1 1cdda949b16006f201989a040c1146b6217e097a
SHA512 f51aed111f36c645b53d77b213faacd2045a8a7892bfd67bdb66fb5fe562b2af4392a1bc1f309dee2de2f2258e31481b53b1d1d789450b1ec811b810c617451b
SSDEEP 12288:ay/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:jvdCN/j2GLl3iFSE33b9
TLSH
T1CD752368A6B6B669F52BC37C03A99F115210FAF8E72144CB40C1A6FB577DFE89033452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b569f96917df81a4fb8b58e0020feefdc5f7230b9280898b261eb9fa67daac60
MD5 9c0a1c3f4f63f1bafb448b5b287ed616
SHA1 f7e4bc229abde9612e3d144324c37c38882829c7
SHA512 3ff049b722fd63847843ff57d3bea83ea6b73a690424d9923534be8cb1ade2c4707d31db6619083020f655aae9e0cd65622345addeee2b8102fd0d34fdf11487
SSDEEP 24576:LQ9MxZKdcz9dw30dCN/j2GLl3iFSE33b9:LVKZfN/j2U4FH
TLSH
T193558C2DABE9159AE177D27995A250C3A633B4301B31C6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 0496d6423452e6342ee6ac005bcaa3006d18780f2ccd8e177c94fcfd600c1142
MD5 00ed95fde8ee7ea1c5bcae3ea0ebb21b
SHA1 172851bda188d15f30e5e498601f378819d65e62
SHA512 92060fbaa54b64098798736b2f60f9da7ac21120c9437d2fe78f259659ab6b1e2e5065783aee35223c3344b4bddd1a6bf46431fde781f7c0a914c3a32405b99a
SSDEEP 12288:PyoKo2JRple9p9JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PyocDAppdCN/j2GLl3iFSE33b9
TLSH
T1CB85E01FBBAA40A2E076823C89858745E773B0705B2253CB5591C37E4F27AECBD35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8e1bcb48ec6403d5a3b20c300e738fd103f9284eb9bc5ed5d30cbb98770b8b8d
MD5 9fbea650b810df32c528adfbd5bdc6c1
SHA1 2189f5c66bcaeb9530429ca5f6d33ce8f4111b45
SHA512 f4349778f21645b66da0be3b6ed6b189f19dc4b34b0317928ee5e87ac6a77902f9b47bbf0398abc3e38806f785b0d3a3bde43f65fb89c9ddeb7c642c82f46e53
SSDEEP 49152:kWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK+N/j2U4FH:O0zuNI0j2jF
TLSH
T1CEA57B3DA2F800A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 11d96a9d5eb48c90fb382eccf24027617d633034b284174d454ae1f3f41651d1
MD5 33dc90d9fa65bfdb3c3389c92ec084c0
SHA1 92421a08d39a9a0bce53232e3d0ec5575c2d52d9
SHA512 8f1319a30c29871170732829af5663e7b1b42af97d8bc850e21704dfe0e0a997a0fe6a7b937b81965b1c4d96b70f7c292ec0668d77293b07e2b399d6d727ad5c
SSDEEP 24576:H1QT7EcpfxR+N5AWAz3ooiYtjMqb+dCN/j2GLl3iFSE33b9:6TDxR+N5YzTfjMMN/j2U4FH
TLSH
T1CB55B02EA7F815E9D17EC5798B23C512FA727861033193CB42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 beba96f21fd2299a3133a47749c5dc8b637ed09de29ea3b3993f43f1f11ccd73
MD5 223db7694e1565e613d8701da76cbd2f
SHA1 6f2e1917758cb0fe7d2c254d47f6c72639709926
SHA512 831d34607b25a7111aeab424897e7ae2071e71d2d77530a626aadf651f2d25346bf3757d5dc3cdfdc29d47796d3facb6a879be2b768a0fbd0a2a6e291d40055c
SSDEEP 24576:nTMdOz0FFS+imSLidCN/j2GLl3iFSE33b9:V0K+imSLlN/j2U4FH
TLSH
T12C95F17EA3AD14E5E47BC27C8653C906E6727465032266CB06D0C1BA3F5BFE4793AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 5518504f4e751320a64df48ac9dd9fdec89ac097907ca2e00575a77966c23e06
MD5 6f9ec04108145e04dd9288758ce88e44
SHA1 243039715d9f8ecffa1bcc5f6d3574070f796225
SHA512 822e49e81fe2a4cc940b922c89033b29b0f2c005bf9d6f65424494e9b58d67e5f749b357de7f384d6447c94bd4c9f0cc0bb4b377cba280b44c76cdef44a3f1c5
SSDEEP 12288:M4KTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:qrdCN/j2GLl3iFSE33b9
TLSH
T1A975121CA3E870D4F4768379877A86159220FCB4A72146EF15D0CAFF5B3ABE89435B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/892-189-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/892-105-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/892-100-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/1064-68-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/1064-61-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1064-65-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1064-62-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/1064-55-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1176-194-0x0000000140000000-0x00000001402CB000-memory.dmp

Download

memory/1752-171-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1752-200-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1752-359-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1752-199-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1752-155-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1752-322-0x000000000C330000-0x000000000C338000-memory.dmp

Download

memory/1960-187-0x0000000140000000-0x0000000140293000-memory.dmp

Download

memory/1960-12-0x0000000140000000-0x0000000140293000-memory.dmp

Download

memory/2068-140-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2372-188-0x0000000140000000-0x0000000140292000-memory.dmp

Download

memory/2372-22-0x0000000140000000-0x0000000140292000-memory.dmp

Download

memory/2372-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2372-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2448-191-0x0000000140000000-0x000000014027F000-memory.dmp

Download

memory/2492-192-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2492-116-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2492-122-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2552-193-0x0000000140000000-0x00000001402EB000-memory.dmp

Download

memory/2552-127-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2552-133-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2612-196-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2776-357-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2776-89-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2776-95-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2776-97-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/3536-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3536-40-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3536-33-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3536-269-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3712-358-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/3712-198-0x0000000140000000-0x00000001402AF000-memory.dmp

Download

memory/3948-341-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/3948-70-0x0000000140000000-0x00000001402A2000-memory.dmp

Download

memory/4004-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4004-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4224-79-0x0000000000400000-0x00000000006BF000-memory.dmp

Download

memory/4224-0-0x0000000000400000-0x00000000006BF000-memory.dmp

Download

memory/4224-8-0x00000000006F0000-0x0000000000757000-memory.dmp

Download

memory/4224-1-0x00000000006F0000-0x0000000000757000-memory.dmp

Download

memory/4224-454-0x0000000000400000-0x00000000006BF000-memory.dmp

Download

memory/4352-352-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/4352-74-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4352-83-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/4352-81-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4500-195-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4572-202-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/4784-190-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4784-336-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4904-304-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4904-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4904-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4904-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5068-389-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-397-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-401-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-402-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-395-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-364-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-365-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-366-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-367-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-368-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-369-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-370-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-371-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-372-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-373-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-374-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-375-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-360-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-361-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-362-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-396-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-394-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-398-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-400-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-399-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-363-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-391-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-390-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-388-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-387-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-376-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-386-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-384-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-385-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-383-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-382-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-379-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-380-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-381-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-378-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5068-377-0x000001F518F60000-0x000001F518F70000-memory.dmp

Download

memory/5096-197-0x0000000140000000-0x0000000140216000-memory.dmp

Download