06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
Size 1.4MB
Sample260804-nwl3vsae46
SHA256 06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9
MD5 b81b6c3bd0c5dd4ebf8f601055e93fb0
SHA1 051d5aac2d19657899384bc8fa166b75d54a959e
SHA512 08d2d5fe03c04de56cc1723594521b3882d35f11438ff065cd058a0aa84fc7cf4cc4cf50635b6ac94d89bf70525c41481c63e7768e9122da9c91d884952fd727
SSDEEP 24576:6JnW4MXognw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6JnW4FgnwLNiXicJFFRGNzj3
TLSH
T17765C052DEEF8E1FD8AF3131152D5D6708CDA8A4063185AEEE47AC18F7E45834921AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4076	alg.exe
4712	DiagnosticsHub.StandardCollector.Service.exe
4820	fxssvc.exe
2448	elevation_service.exe
3484	elevation_service.exe
2688	maintenanceservice.exe
4464	msdtc.exe
3428	OSE.EXE
3480	PerceptionSimulationService.exe
1156	perfhost.exe
5012	locator.exe
4636	SensorDataService.exe
3228	snmptrap.exe
4628	spectrum.exe
2980	ssh-agent.exe
3492	TieringEngineService.exe
1420	AgentService.exe
4864	vds.exe
2276	vssvc.exe
2420	wbengine.exe
60	WmiApSrv.exe
1676	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ed24aca3f77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\vssvc.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\spectrum.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\AgentService.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\wbengine.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b76e34c10624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072f6f4c70624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c953bc10624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045aa10c10624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008fbe04c10624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4712	DiagnosticsHub.StandardCollector.Service.exe
4712	DiagnosticsHub.StandardCollector.Service.exe
4712	DiagnosticsHub.StandardCollector.Service.exe
4712	DiagnosticsHub.StandardCollector.Service.exe
4712	DiagnosticsHub.StandardCollector.Service.exe
4712	DiagnosticsHub.StandardCollector.Service.exe
4712	DiagnosticsHub.StandardCollector.Service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe
2448	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3908	06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
Token: SeAuditPrivilege	4820	fxssvc.exe
Token: SeRestorePrivilege	3492	TieringEngineService.exe
Token: SeManageVolumePrivilege	3492	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1420	AgentService.exe
Token: SeBackupPrivilege	2276	vssvc.exe
Token: SeRestorePrivilege	2276	vssvc.exe
Token: SeAuditPrivilege	2276	vssvc.exe
Token: SeBackupPrivilege	2420	wbengine.exe
Token: SeRestorePrivilege	2420	wbengine.exe
Token: SeSecurityPrivilege	2420	wbengine.exe
Token: 33	1676	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1676	SearchIndexer.exe
Token: SeDebugPrivilege	4712	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	2448	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2228	1676	SearchIndexer.exe	109
PID 1676 wrote to memory of 2224	1676	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe
"C:\Users\Admin\AppData\Local\Temp\06a967827d336236347e88d2ce3a86bf3d9d2c9b325a616a9fdf2b71ccc2fae9.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3908

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4076

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4040

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3484

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2688

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3428

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3480

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1156

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5012

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4636

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3228

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4628

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2980

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2612

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4864

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:60

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2228
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b0e8c463bf8e02890e4d2bd7b984b8da6565676c8a4a6e440083ea05af59bcff
MD5 da385c5bdd4646706ade606ca8faf1f3
SHA1 3a46fa482ffea2cb76c11d2fd3239443941178c9
SHA512 16aa9abca1846f00fb158dc637f62869c8422d26b133b58bc2392125ddceab7a98e425496a7f5d8efacaf0b71506bf7db71cb8cc0109e2649676964b1e9cf0f8
SSDEEP 49152:Eb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnOLNiXicJFFRGNzj3:+3q6mjBp7wRGpj3
TLSH
T1CED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 39680d30caea57e3ea39fdff901686c8b1165e553c12c32698ae47e0a076e67d
MD5 375772bb733398a6b4e749f05a284f98
SHA1 1a3021d2b8b71dc06769ead629de9b1744129c9b
SHA512 b0807c37f92a26edacefcf36d9cf690d66b9c0e0e3538aac1d88458cf2c06738620765736217a48dcf18d7a3c2fc42479da9d6b7dd9fa90d9f3340ec9d560b5f
SSDEEP 24576:iXYfDtczAV/TwSfVcYG3K/cJHlnFR+IGNe8j3Izv:ptcgLNiXicJFFRGNzj3C
TLSH
T1C275012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 44495e44d669c22ad3569f03837f69eab328419e8a56894233761981e0fd8d0c
MD5 22447ddcf5194ac0fdc363c0ab8dbdbd
SHA1 e0ead9a20e3613c6970a3603a401324cb548c690
SHA512 e2061619d4540301091859c72cc5ee9a8b2332e48b8b5215655654ed50fe680b828a9d807dba037e661350996997bc02acd412afe7b59394288b88c3fbbe1167
SSDEEP 24576:90Le5ji0hmxhrMW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9Pji0AzbLNiXicJFFRGNzj3
TLSH
T147859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 332ed316a94f68e3f0116975169ef5ae1944742a4da767127f245046278211eb
MD5 97b5e7e790261a8fee2c23fcf60d8c76
SHA1 664430aa3155fc9e3043f9f0c5051a443c9328dc
SHA512 5ab4d6bc23306352f97ff21b11ab037080707b2e349b3699d0b63b45d6e9f49d7f1b65c7321a1d2af04736e4515e3f485f284c082023de827fc222aafbf858d2
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWj6q8wyuw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Y/ezSC6vUzPv+HjynLNiXicJFFRGNzj3
TLSH
T15E756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7f4beffdd404664f53018df8f6af7cb763fb9da86c9473cb10d5705c6ad04549
MD5 ddf469a2b9bf6fffba3c9edb3cb7cbdb
SHA1 7315ba1439a6c3f13d144d1d4b985102936e9be6
SHA512 627715bc1d3b593506d263c7b0891dcb66f973a874096b1d38b8225cb354bac5eac80f2ac2103fdccafc7cc5dbda4d348b9bdb126e7ef76d41a7776112c822d4
SSDEEP 24576:3VbqPb88hv/l+B5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3VO88hXl+7LNiXicJFFRGNzj3
TLSH
T154559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e19c75ed9b0737df5ffc1d88739bf33b2311afaa938b8409d290216f33e21e8d
MD5 37602886a98daa375c330741ebbc9e46
SHA1 548d1404ba5fc5f990e8ad8c822ae0f6a85929a2
SHA512 aac5f80c11ae229867f7b0c2ccd907e0815805de53def79d02c2b5b5678973c601617c6f8a6639766f16300fca78b61ddc396a7232b3863169a6505baac5ab40
SSDEEP 24576:lG6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BLNiXicJFFRGNzj3
TLSH
T1905523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 237a2fc695f6f2bd51e939a4fc320c568e23fb1bf416d006cbceacc106780587
MD5 f07d2263bd3d6a9017ccec74fe65f228
SHA1 387eddfdfb5f7d7a27ca45a59ea98b14bea06cc6
SHA512 cf892967c06c263bbaba2c47af01e17798a1974e80b145f06781d2392868bf230da604492b24145bd8880f88ceea1d515b1ca3cf2647ce94952f200642124e41
SSDEEP 24576:PJIUB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PJIUBLNiXicJFFRGNzj3
TLSH
T18175CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c7fdb4b8820e3bb1f302512c7ae880777ed9cdbb0f0159ea6520859247ffdfdc
MD5 4f9a9807b455da261f47140a7e86b1bb
SHA1 c2c13b862b1979f592db9c18fc7b2ab7315cd6d4
SHA512 c8daad20bbef116efdc2f8f8dabbdf74fa3f6d250494235d019304c8dcf51decf88819a323812a05c1a28177fa1999dc51bed04451230fc140c11a7c53af8f14
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THB:qQvGAdlCEL8c/WRNw5CA7wRGpj3
TLSH
T1C0266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 3dc77fc17c39ea63ea6e7c779447e7d52a773989dbd036c8a22e498a74189c38
MD5 55d79b6b342b2f7b3b6bb2fe68ef3416
SHA1 3e1dee43f0a4ddd6c4b0916868882723f50e66d9
SHA512 3cc2f22ecd14373b199da2376563d744d37bf7d20c4ecb55e0c66ff12a9c86b8dbcb8544bc5652d84974eb9852f6a1eb35824439e004bcecb0ad45c3f0912b7d
SSDEEP 24576:ZfewsAjr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FljrLNiXicJFFRGNzj3
TLSH
T1C175E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 07df71f41150dcd094fb6e1271e48258576a7153994146d50d602215de9fea67
MD5 fbf9d1f0b04587c0bbca9717a41207c3
SHA1 f3c15eb10b9972b8bc65ff06860540112cc52ddb
SHA512 8a6ede80d5bb416385f7bf4003ad59387e94296bf92f53ee0a8bef42db174e0f8e699d193cbecf4d71a7f64e7592e302f7d2b000c524f5af9500fc7826a12f2f
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHXF9:uUEtQevvqc2W1cpV20I32V9
TLSH
T1B1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ab4ba69d326d8fb1e29552ee9ae3e1ac14d4fb009d8ddea49a89d2a04495408d
MD5 e6bcfc59a8f0e9a89f071420115cdd46
SHA1 e2a53855ef7c3056f7a08cd55f2c9b9d838d2c63
SHA512 ee11d0dd060b4c090b403a5181b96d28c5856fb60125f94c48b9b39dd46546c66384111100a51d6632e11866c5bf903d227fde0d48207c51711daa8391efb44f
SSDEEP 49152:6CbRquA/m2yL5zLfFiV+XenmE3/zLLNiXicJFFRGNzj3:Poq2Vjnms7wRGpj3
TLSH
T115D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b838c1eaec552b5cc8b703a52979f4f425f8cfe1d74dc46f939f5d26c47a7967
MD5 163a4fec7ba4c7d89dda9dadccbdc8c5
SHA1 998260f61150996c420e908da88e36acbda02d8e
SHA512 38d2076ad1206f59a6b6e2ca65911a473dd14c72db61f3a736c40af075ea5a507aebe7f9b6813659263a6a6ec2075fe4d4e10bfdf1e94ccc63ae8e9fe709c4e7
SSDEEP 24576:GAhGL6IFoiwtA5l7S53M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GAM5Foiq58LNiXicJFFRGNzj3
TLSH
T1ED359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d9cbabbc6e9b961e7f7be564d8d7ba83b470683e7fe01d231717d866c5d39579
MD5 82f296d94ca66d3c907b2b2c25f4206f
SHA1 3affb86b311b8a44a9ebbd9f0e34137fcf7194e1
SHA512 9fc89e2a5bb626906e0ddb47aa7c207c55293eaf92331a9e560545b53144a9a9096bf7635398f6fef3b45b2feae8c82d88c561512e2696a7d234a1d808d4cb2f
SSDEEP 24576:nwuROWH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz4:nwSOYLNiXicJFFRGNzj33
TLSH
T15665F18672980CF9E9B641398657C036F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1521e8330458352305d2f0170e6c57cbfe7ed9904dacac83caf43adfd7c76976
MD5 08196a545fcb7acccbaee6254e1ca3a1
SHA1 b8db8088e43d3066114cb7cdb22d8c1a58d33d56
SHA512 02526ab814b8dcdd509cf2592abac066093ae6bf93c927a370802b20522c2ac08012afd1fbc3a55eea57d9ea27b8324292b5f77266cadf298351e6aa737627e6
SSDEEP 24576:7Zue/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HLNiXicJFFRGNzj3
TLSH
T15E55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fc7218590e5fa3a53594a69f71df18912cd640078f7290748d30d5e1e7bcb8da
MD5 0ea04eadb0fec68a122381c82c4aebbd
SHA1 f753c41271a1b6eb6586b0f50238136dfd1e8415
SHA512 4b7d3a778dd80c0fa0a828002d4f0bef4114896a150556cbb83559d14e89cc62af30fa1bbdc5816c63c119c70ce56b06d9014b93034171749e546cfcf47b51ed
SSDEEP 98304:QQRQyi36YOcPDLvw2gAf+PN3d7wRGpj3:HQyiKanX+PNxF9
TLSH
T1B5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 42c111cc4a1345473246770e7b514135afa21f7bfcc6f028324e4cf34ee5e6ef
MD5 2968df199b18172ca587b45c0e2f8a63
SHA1 6e19ea946538d460f2b0d88f053cd501d64e1f4f
SHA512 6a623e42c2497382156e0a93e3cf45778d1af45108fefb2d3e7d51f29e28170c9255e00ed2a5c519f12b52faaa615d88b98cd077e78e8103686f62ce1c656228
SSDEEP 98304:SQRQyi36YOcPDLvw2gAf+PN3d7wRGpj3:JQyiKanX+PNxF9
TLSH
T19F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0645accceb0d01bfe696bed84c0f20b069d3214ff8be22dcba0c3dbec641bbf1
MD5 70fdc52af16db71ccf7d607310c40f3e
SHA1 a16d32fe721aefaf530a48b5f8a123670ff01469
SHA512 82a2ea2890e703021437e503a9cfc9c70de41e9ece6ad8cbfabbc601309e02946523c72cb9bc818bd58b79b487dc6e62256b29621569a125e7c77ab0530aee40
SSDEEP 49152:O68Qg55nhkeWu7PNU3/bLNiXicJFFRGNzj3:cthTRc/b7wRGpj3
TLSH
T15FB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e7728e4372c106abc8fe8439b32586a73af55d9e5e32618c716a79f3d23b23e3
MD5 9f487fd84b4a1719171f20c61b54a636
SHA1 dcfd04bd0d646f1dee62eaa059581fc25cb094bf
SHA512 de7b024a5d5cfdf602f0e606dbf4fe90d417247788d285d1d8150cc75ad2ac8d521ebffe473a622703d5fddff5cf06cae62e2595257e853c36647cf440a97e1f
SSDEEP 98304:oy5112gYy5azzVvU69nLKnhZ67wRGpj3:BLIHRWhwF9
TLSH
T154167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9af8f41a096499b6031b4c9d852fe14dea02ae5bb014153e5c0050267c94e6df
MD5 88b3146501b9d85d164077679c48c273
SHA1 73152d19be38f21decbb9331052bdb2f18f2485a
SHA512 7896d14f5cffe1433d9de27c42a770a828595bd4880df6480d71bcb661769694bc8aa243a1cf7dfa491a0c1d5396fe03fdb632a20f72f593ac0c59ea052305ff
SSDEEP 49152:HB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glFLNiXicJFFRGNzj3:Ju6JmIxd2dF7wRGpj3
TLSH
T19DD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d78a42e1f217a8919d557324a5164466f4077e1176bf9aee574edb3fc35c5be9
MD5 17a0a8fa3fc50154517b12ea23742754
SHA1 71b7208c1be2c3e651c29e4a9c653eea4f17ecdd
SHA512 5ed305bb1ef56eb40a599ecbc67b8133d6edd225e8a995fff3cdd579c32812d0dce85de139ae3510bbef74881dade59863d4ca74f2bfc5d209893bc8704f0485
SSDEEP 49152:r1hpsNoJpF1A67U44CwH7R4xhLNiXicJFFRGNzj3:rmifPqRs7wRGpj3
TLSH
T15FB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 79b74df6f43e0db4ee4910561e275533d0da03a2f395d469b0fa15cbfa8728f4
MD5 515dcaec6ace695c3997637bdb88a590
SHA1 ada86f5d5c8c1da115c9a9f5a11cb43fc777a730
SHA512 8461460da98abcb14bcdf7e4913e273ae9e44bff9a7314da57871f9e55463158f713517bb601ed2d5899a7fa400c5ace69bdbcd217509e8b0d676d249a943826
SSDEEP 49152:8SuZQIY0Be2KkRVtOnks6NMHqeLNiXicJFFRGNzj3:+5dKqi61e7wRGpj3
TLSH
T1B7C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9b77ca3c96bab1616cea11435151e02b9522762fea11f093f2152f593947515e
MD5 5becab4754a0d25140bd386d5790e80c
SHA1 3283eb68324a2f34ef1a11ab052c00003d75e7ea
SHA512 d11c19791c4619e68390b58ab0610e7fed9d1d260e633aa92f742fbe31151998526b65e79e5f5f404bba66c1e5e128c712e5eaa82ff7a3112a496d906c142c59
SSDEEP 49152:hhtSn8EApI0figjgiDn0AP5wVLNiXicJFFRGNzj3:wX2iWph47wRGpj3
TLSH
T1AD95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 72d87434d4dfe4dc227bc025fedb8e87c5fe760e2143d7319f4fe1133488d058
MD5 70d7862347a02bc0075f69957ea3f3fa
SHA1 be7918405e9d7c75542b878529d9415883d5b081
SHA512 4aaeb5a27bd5b31ad28bea50616208d647057a652ee440cfcfdeaf3418dfbe10357d37a31289dcc3028b7bab0c6d5ed340e2a8f4ed50793ce64ab6da1f79f6e8
SSDEEP 12288:9wiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1555523D3558955B1FAFC0039C6764428F5882E2DDB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 61b26311dbfaa03f3b263188326772b2f250894dbe92d967a81493c814fd7f38
MD5 7e5bb872f8f8dff98b68e5dd658f7359
SHA1 c09654fb216d9d57e17ad1fc15d4ce5a8e874792
SHA512 a574873583fa8ff132dae1da7cd9973c590f5e702dc729cf3b96dbe9a6db307c4ca8ca0e74d3edf64d1a3b66f0b8dc3d8c13fec4351d4067517869864349d5cc
SSDEEP 12288:ILiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:If/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A05523D3558955B1FABC0039C6764428F5882E2DDB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d4ee280107915ff5f0c2b18c7dbc33d414e10387a3a159973105fa167a6cd2c4
MD5 3798e1b2f34e04842a533b46ebd47389
SHA1 47104efe0bac60a77537de1966d1f29aa3e16b4d
SHA512 170808dd1b13108645dfbcefbdb38a94fb8da4328f472a82459bd171535c1a528bfba1a12b74ff9593c522ab09521b25c485b564b03ddb31c1ba31f222829bff
SSDEEP 12288:yliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DC5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4a70b2e3417dab777a19d8a0608bd9dda2a6c5f8b4095cf8b8406a515269cf60
MD5 1fa1bc7429a0a2116def52fe7506cf4e
SHA1 1d278864eca91b3089d20e3626a4445e5d939816
SHA512 795931c6516083e7fcd75abf1479bb7b77b02dd0b370481b3ca7fd9800c3e1028dbe19096058d5dc01e989a48a223996a187f29d5b51a23e4ca4613fc2cc43c0
SSDEEP 12288:eVqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:b/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T112552393168901F1E9BD8039CA764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3941addfeac6d4b438fd3a614244ba08d87f534d0a73d377e7e3f4567a597e81
MD5 2c832c29527228f237d68c5a670639f0
SHA1 a1eac338d99eabb74adfaf5fcb57fa76e0a03286
SHA512 534385166a054459d7532ac03d3a902aab260ffc2767d4d9ae782deb7ef7a4484dd9ac7e3e03285f7f4497950eca8b8d61ce4c82ad691d3a00705f3038dda211
SSDEEP 12288:+CiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DD5523D3558955B1FAFC0039C6764428F5882E2DDB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d80809788b48e392863ed975b7e03dd51a0234c8d90cd5c024e4fa1904daf50a
MD5 d00226d1a96899162fcd133e05fe5cc4
SHA1 134655cc2bdc53cad790aee66b73cac0472b3935
SHA512 87a2c431c7710b15fc568b5eb903ee5e325f84eb6756de31eda648e746753ebb6de646694c55ed4ecaf04535aea382ee33be307d90ef553fb17736c406e2f8a6
SSDEEP 12288:DHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Dz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EA5523D3558955B1FABC0039C6764428F5882E2DDB5619E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7ce3f59af490cad6294bbcb5f4521a1fa6baab24fadef94ba1a6c531e1dcbc8f
MD5 94886a5372ff50ac0fca6904474aa86b
SHA1 eccfdce92a43d91fb9ab1d2ffe1eba76742365f1
SHA512 e6501288295c1e303e248e3a293d0d218475ce4bf03791ab18e3a4ef98e5281504f0629413b9044a85e100673576d7a6afe28d88f9856df3cfcd961fa7bafbf6
SSDEEP 12288:ODiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:O3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E35523D3558955B1FABC0039C6354428F5882E2DEB5619E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6ca4eb6689ec6413263fcc10701b6092477ae4a0c774d547fcbea70ad915456e
MD5 89ab25d37f86504b451b64d6d3633d89
SHA1 351c4ff9e75c82369b5d9e155d77e266879f0bf1
SHA512 e7025620692cf5e0238138c642f952280bca2b06e476581f2a4f928034229019a0e07e51cfde75f2a4382391241562a71132f91925f9f66bdc05a1d8133fa9a5
SSDEEP 24576:0ZM3zFVSO//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0ZM3zfDLNiXicJFFRGNzj3
TLSH
T1BB750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0778ee8c53f657f0283d8c9cc6445e56658aba56f0147669906e033082a459a1
MD5 93644513f48ead51cb5dca0c6bbaca5f
SHA1 bcf92ce8eb447ea066dbb21c1ed0a5038c68d271
SHA512 c46926472c227aaca7d6d1e6381f882173da98c3c477c2882e0b03b1b005d96ed6cac9720ef5fd3e93bc843688545fb3b83342ebd4a7aaf5dff32e26d8c8fee7
SSDEEP 12288:fkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18C5523D3558955B1FAFC003DC6764428F5881E2DEB5619E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 44e3df30861185abae3c2441556c17f787eddb31adf4ac70d3c73d0f3bd4f436
MD5 3c46bfa78074d30b9b1e89eee51832b2
SHA1 eed223f39179fc88f7d0d0514f6953f116cd1a03
SHA512 d760d2b03a67059174c05ff95deee75216b6d7c724a21e83c6d30304717791242c608fe1e1b098dae3587a8d5a2c7f595ce2d8a0d414789613f797fbf6e2303b
SSDEEP 12288:u4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AD5523D3548955B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 739631a32fc6527e29be77dc0ff38b5bfad20083eeb45d356b085332a177c328
MD5 68bf5739835b5b1074b3f8ec743f986c
SHA1 44af62fd06659b56f5cecb4d06fb104fa6118935
SHA512 76a5a64360bef8e7757b9f9a52ee902e874a898bc8d0909edfe1bbb9a066f3dfe075157752cd4f6fd1992eb184b4855f837065ea1604397bf2c7bd17d1786730
SSDEEP 24576:Xzy7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:X4LNiXicJFFRGNzj3
TLSH
T170650247729530F9E17A8139C9620915F3717C3647208AEF53642A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2c9da0206c3cdaff0ea9eef7a96e160d149f4381b2462f99662526c5c001613b
MD5 a4b5913300b1ba771dc2bdeb696f53d7
SHA1 d398b96c1e095bf0dcf7427d343493bc59e1b3df
SHA512 963f9a8c1cc6bc3f928634944d2f48622a920ac4ae148b718ff4f535eb7cd9da7f79a1e56523157cf7785b914fb31206e2ae97bbbfe735a125c450bfc1c8eb7f
SSDEEP 12288:4kiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11F5523D3548955B1FAFC0039C6764428F5882E2DDB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2c38ab87e166ce67a1834ba753f7647a92bd56c4001e4b755e456a7c47808e17
MD5 5cc0fdbfeb88010838590d4b39592edb
SHA1 607decdae85e5272d34d1165f3ed1b3e361532e0
SHA512 2481b523d0f0ccaa51d72dcf45b9dd3dcc8b974c8956164c4bbde47535cf313e654f30e8954d80546dfd7edfaf88dbcec96d58360ad2408614526588df77feaa
SSDEEP 12288:vkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1125523D3558955B1FAFC003DC6754428F5882E2DDB5619E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 fc17c6660cd31c634a9ca76cbc1331c0082d33e7de46946dd0e7a2cf19c10d3e
MD5 8432602a0a6e7afc3ee40a8547549583
SHA1 ca33ff9ac43e39f20a3d91380b78ed877aff1cfc
SHA512 0a9631242bd3ab988b440f1a220c9252cac3d053bd5997d8d6ea03eed06e323914bf6ba7d79e6665a5d5c93f445aafeeb60a5a87457c53c292c909730807f1b6
SSDEEP 24576:nzy7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n4LNiXicJFFRGNzj3
TLSH
T143650247729530F9E17A8139C9620911F3717C3647208AEF53642A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 111e0c73b5ae10766f243739e75cba9bb2d4599a9c5bf9647750ce63b2ca039e
MD5 831cd2b904a54deee4339298355d4a2c
SHA1 9f7d50f604a422806d05060d704bebdb1839c96e
SHA512 35ef1b0c4309d31559b0633340a8c182e0b6d2728f619b91cc3ea01a1a3a02b4ae0386509285ef5a5ce0635440e5beb4a3ed9d7cf5b2fa5f97c69cfce2453d81
SSDEEP 24576:+cP4mcvIjkGOxhKP2l71nNKbrh/8KBG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5P4m4IpOO67W8KALNiXicJFFRGNzj3
TLSH
T13065AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 056ba20ccbe04ae4871a4c28f2ddf232e4754c4f526bf599842c044cb9cb2fa2
MD5 c568db8f1bbd5bd5d41a21e1e6beb168
SHA1 c7f68e6305c4846ab97c19ff9bb40a9df0105401
SHA512 9573dbfced880e2c15694ddaaabc3acbf064d4ccf9937c9ad0a2bef626dea6ad457378dab6bdbf1dd4d713a4abdb6e235e2d94b591f35d2096dab72ab7ed18b5
SSDEEP 12288:spsf0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:te/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A265F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d7050a7d5e41673570683ac9a38edce25ea92c995df2ca8c3cb79e9a0c9f1564
MD5 13cfb91788043ed8d5a608ecaee97ea1
SHA1 c9d50e35cf8182365d8f23101d96e275b560ea51
SHA512 0959e1a8fe0a170d8cdcc3c281d24042b275200c3241289272beb5094178462a7bde229b2b076b76b6002c5238ee2db31b3b798883ddeff2e368eaeaf8889167
SSDEEP 12288:+UiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:++/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BA552393528C5572FAFD1039853A8438B5497E2C9F5598D3E2043A1EA238FE7DF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c5d8037f241e6386f5a7636aca5b1af0ba0d61b1dbf2e6a8d313091a42ad5ce0
MD5 230fe31fb4dbce7db03e9d677ba015a3
SHA1 d91a08f80128f0aecbeba2dbb895c30c7e621085
SHA512 e53c34c0d995f99cbb015e6b991791760978af9ba93282b47f4b370639137282b265fe32d388c6762160c38a8cb7909164d5589042611e8c06d40ddec27057c0
SSDEEP 49152:la0h2GEkuAe73q3pp46zwwQELNiXicJFFRGNzj3:la0hNYG4Jwj7wRGpj3
TLSH
T1EA85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 9faee53033c540cef2d328a14c56043ef98c3faf764b9e0d8e409b850aefddf8
MD5 30e5cdc34580e4ff2a7225b249a36dc5
SHA1 a5a993cfc91291e8a178e2514224cb6c73e5dd21
SHA512 1cf90f170d3f712db3970483b9db8de5e1714d09d38d0672189849d0310ba6cc61f056d690073a967b65c5bd1dcf04d8d78f943bfd19ce889c71194e3019ea22
SSDEEP 24576:hhbHjPP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hhbHj3LNiXicJFFRGNzj3
TLSH
T1D75512BE169C20E5F6B5903D86668409D370BC29172193EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a4cb0e89c5a494ef586d3f162078f6b5e8e9c2efa974185c55315bf533610907
MD5 4c4f69f2a5caf00373e0f895df2d140b
SHA1 11bb77606774fab39d5933a5b3a223288f93958d
SHA512 033c95acc25119bcb558e8135ca14dd264372ab7262b0b18edc3ef6b4a26741232553e461f85e2d8eff85f31fb00edf6c3eba9b9bb277ad7ace2817e2028ebb7
SSDEEP 24576:p3YgnJcRTk4yti+R5dBR/H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pIgnaTk46pBR/HLNiXicJFFRGNzj3
TLSH
T1C245B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 39ddbffc720a5b70b276fb0797be808e30fec1ab750664653710875b56a39873
MD5 677c31a46ef286f118aba5f105e8bccb
SHA1 8f84a769f31a15c9e55ac0043e27e5ac2a832b17
SHA512 8708eecfa1bd33fcb73bc4c075fdd84ecdc3de723a7aa8f1074352538469b5f67e4e7bfd56c97faba146eab2c9b32d255c4afbc074c54c9cc2d45d13423061c2
SSDEEP 12288:HoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ha/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1935523D2518959B1EAFD003D867A4428F5442F2C9B2619E3E1543E1EA27CFEFCF38562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 9dbf2481d679db0646c1173004f62db558e75e1055fa415e29d3e99a06607e3d
MD5 ff2bda85c4942e85cb3c26f904a4c536
SHA1 316144695addb3ba4bb4ec23213f73f1252677af
SHA512 fa3df9d2fe739fc5a715b45a71f646ddb6d01ec866dc4abf64e202de4c742cbb284f12a473d5745cfecfbff9de482043d4269fd1b3dc4c11299fcafa38d4c6c8
SSDEEP 24576:pAL3UTV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pAL3UBLNiXicJFFRGNzj3
TLSH
T1AC750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 224eee5f392e233efca94f334fabce4608ee807b3c67896a5e8cc6b26345305a
MD5 67346cdd030f78b1ad1c68bc5279ae16
SHA1 f60d1e80406ce7cbe1fccc92d576bffb3ff3df93
SHA512 c6400dafbd05f13a09aa5ac07fc760757f965fac323851827250be6d73c1365748b845127dee3b36a02d05439a70f2fc97d007942df65af77f8febfddf2fcb29
SSDEEP 24576:uOh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uOhLNiXicJFFRGNzj3
TLSH
T1E555126A32DC10F4E579903D8AA2820CE371BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ccc9436b3d2ab5739e563663b2ef3664847a369915aa8a2342bd4c0a30824524
MD5 1e81cb3e444712954fc2f4ee7e969934
SHA1 f5105c274b84def72204363642b77fc4be46efbb
SHA512 34b6a1df3176a094dc2cb280930ac74c9facba0a6bdf9b7a3e9a7efb24bcf83399e69ef9fe13d28d4f153e405d6acaa0400f2be658f8291bfa6b054952a35914
SSDEEP 24576:R7NM9YqZqmWMUkPjZM48Mv6bEhsu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:R7cBWMpPjN8DbEhvLNiXicJFFRGNzj3
TLSH
T12065AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 59e6afb67150ee864ae7364a1a4f67b3b3f1371e17ca90d83e7dc48401745ea0
MD5 36dfbdf0150b7b2aa86ed953b8ddfc5a
SHA1 4ca5f104216ab8bb297ed1fcf1b381fb9ce78e12
SHA512 aa5cc7d7791bc67eae34144e1fbe6126b36ca7f63c623ca56546241879775f17401f861726da96ec6609da6c0dd87cbeacf7576f1d772d914e63f405bc4bb05e
SSDEEP 49152:xF2YuHNETovAvNYf8kmOLNiXicJFFRGNzj3:06BCf8kh7wRGpj3
TLSH
T155858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 8d30f8f0d58f8b4868b6fbbe52ac0325ed6192adacacd90edfb451cc37c1f416
MD5 70abd59b3652864076286188ea76908d
SHA1 13becc8c1141c88482ab7c83b2e48d48e97a4f4b
SHA512 ddee9e6fe7dd13ce4d86540ee2804d1f534492c7ba9c3398fdc0c8acda9668ad40908d6fb0ad8566c1507f2df83beb56d461720227919bd537a11dff3766879d
SSDEEP 24576:pAFs06+Omlf8NXEbTo9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uFs060loXukLNiXicJFFRGNzj3
TLSH
T14D65BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 da5e6aaa8907fcbc43140d9e3152a88561c447406ab0bbe109cc7b5ded8f83dc
MD5 2bb15cb1f4d3774764482a16b6aa8678
SHA1 51cddf1d762c9a5c885c35894afdd462937e3a26
SHA512 cc3aff65b9c77299c700f4ee60060dc969de34a84577354baa49cfec75640cce0489984d7434d784cebf6e211c7ac162ee74c66c1fbda6d6d90c009c423831fe
SSDEEP 24576:sJnJ5D3WXk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sJnJ5DGXkLNiXicJFFRGNzj3
TLSH
T18775D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 313112f3461e07ab2ab281f8f40229e919c3657a625997878cf522e751106c90
MD5 7858d9ce716a5beaff45174a988a5def
SHA1 2e411ea6c9eda56c7c5c0ae1c22376054f20999b
SHA512 a2b4db58a469abe42ba25ed8fa341dfc8bae3907671c11b1754181948438b3e9ddf1ff171b5f27e216b2df2ecb6d3e79e98a349dc025ce04f5634cb8613ff02a
SSDEEP 49152:kg06DIKdwc+eQnSt65aViLNiXicJFFRGNzj3:VI7wRGpj3
TLSH
T1B1956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 cfe57f7624f79fd63a3de08167cada0b739c3c88ba875fa6aee6b240a240bb6f
MD5 6eb1ffe386e5545d673394243bf9ddd4
SHA1 c06bd49b067563694a661d682cb49e61feec16b9
SHA512 428893351802cb4d5e1e33e792b3e77c22fd6fd7a295dbdef4fe2217b849316aa3d22e5dfad18dddefbb3cd02b132e24583385e6aec28aaaaef2f57c338b7bcf
SSDEEP 24576:8nQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8nQLNiXicJFFRGNzj3
TLSH
T1FE5512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 b11bc428b61e8cb3b37401a60a2d97c192ad6be666852243236fed2ec005a221
MD5 c25a5a8887837e8ec3876cba52603500
SHA1 4374bee21e824f57b7eed40021a9dbb237aa074c
SHA512 a219c281fa7f9225eec23e7957389d5c1a5aea9fa2cd4d65bdd1677ac4c64ea8ea074ce60a2577c597aee64c2996ea764131985c9e9b500a060c18c2f04d626a
SSDEEP 24576:dIyf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dIULNiXicJFFRGNzj3
TLSH
T17E651245538850E5EAB9013CCA778064EA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 d9c2af5218e6fd95adaebd5cb0cd74e471e217e8dcac2b02de9ec3ebb2918a0c
MD5 7fa7ee5fad0e4304e67491d25b3931c1
SHA1 6d557ded159e89c6730c6f9a315b216318e7100f
SHA512 8e7a4d54cac6e5b7807480fe184087aab19b487bbc545354618606cd59dedaba0904118d300a40ac5921135c3acb22620c8fec32b64db8939557df66a6fe3565
SSDEEP 12288:6ytiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Dx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18055239A118964B1FABD003D86364824F1543E3C9B1628F7A1947A3ED379FDBDF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e562398b6ae8fd5ea63b58b183cd83a1329386156810de147b02360fa685c152
MD5 d7853e9213473cf9a1a6e50b6deda310
SHA1 f932ce24c3450b25ae6a43ed94b57c8141c22482
SHA512 e1e1b6ff2bf7223f174a1926fe50aafd97e8bb25ec5156ba71c93fff1430a1637cba77405348b5657a416cc2c3a74e9b17675038300497f4e773579f00857e44
SSDEEP 24576:eQ9MxZKdcz9dw32/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eVKZ2LNiXicJFFRGNzj3
TLSH
T181558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 db5819054e45587826e295027f0c96756551118ec1341eb45b27aa541483a7d9
MD5 c4b9525f2793aaa050e8f455065219bd
SHA1 86c4cbb4d0b3843510a89f00c14c08b0da2d49d5
SHA512 c2d7f98e50047706c9fac7ce7569ea7d83f7f943dc8404e6bae820dcd9b4c0a1c96be34545798a76dc859904dccc1e95bfb2b1b546823dafbfa65be7f03d7840
SSDEEP 24576:4yocDApr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VocDAprLNiXicJFFRGNzj3
TLSH
T10F65E05FB76D40A2E176813C89858204E773B4345B6257DB6281C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f84ca483422fc0c8ab2686d68e9cd253b73a772a18dc7268ea4bca42da8e3558
MD5 87987855ffc2c7de6f0865df15bcf360
SHA1 09ef8e1cb2a379ab221c3cdf05a683ab9a0dce13
SHA512 3d5072ba393889528318e14aee556dd47a75137e22c5dc50e3ad00bc263c4a8b6b34e38fdd79a982f918d4041e6c8a460b338fca3c3809314a1bb076af6d04f1
SSDEEP 49152:DWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKrLNiXicJFFRGNzj3:D0zuNIV7wRGpj3
TLSH
T139A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ad8f2db3e800661263cf9e95e79a2b059bd76665395e75077e03a881a8eba2d3
MD5 290f122a72b4d5fccc87ea9620c4719f
SHA1 5cb2b92b1c27ef450fd9d4a22c8dd5ea2641cb7b
SHA512 8d8557c76c1ad685cf526028560d7b8fecf07765271b90304b4e72503c50a0c64131c762eb32f82e8a21b83218f8f0fe3baa73989adeba0499b2e8b8ed0296c4
SSDEEP 24576:81QT7EcpfxR+N5AWAz3ooiYzjMqbQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hTDxR+N5YzTBjMBLNiXicJFFRGNzj3
TLSH
T16355B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 9686934d014920f281c4f9788d41eab9397c8436e1a491bf39b80a26f50381a4
MD5 f2f47b1f2c24124402a1eb7f7aaf3c6c
SHA1 a4a6de520351d629590ab02cb12161dd79305b6a
SHA512 330345a93fe9f011294c878bd2b3bb79f5bd1f5a5572b7aeb454b52af2b0623f6e0f13549a53d0a7a8dfac128cc128775f351dc6675239c5285e04e2e4086494
SSDEEP 24576:FTMdOz0FFS+UmSLs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:f0K+UmSLsLNiXicJFFRGNzj3
TLSH
T1D475E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 47db1e718c591315d0bd8055bc6b6b94d7cdb441d9bb9ad14735f3896a1c3a7f
MD5 09fa8463837257701cf07883dcace4aa
SHA1 99b48507ce23d5f5ffd441c257478139ccd7238e
SHA512 07b4fa65d8f7e91ba48d8358c540db55d72757b97431073098b304db650b516a951fedb447b193399a0cb858ec476d0e4df4453c9c94ce84c7d546dacdf2804d
SSDEEP 12288:M4KJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA55125A13D830E0F5BA5139CA364014E660BC3957251AFF71D0A97E9B36FDACE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/60-427-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/60-256-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/1156-98-0x00000000008C0000-0x0000000000926000-memory.dmp

Download

memory/1156-246-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1156-93-0x00000000008C0000-0x0000000000926000-memory.dmp

Download

memory/1420-133-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1676-428-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1676-175-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1676-159-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1676-260-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1676-257-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2224-397-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-373-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-430-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-431-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-380-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-432-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-433-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-434-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-435-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-379-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-378-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-377-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-436-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-376-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-437-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-375-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-374-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-371-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-372-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-387-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-401-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-400-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-399-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-398-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-429-0x0000018855510000-0x0000018855B80000-memory.dmp

Download

memory/2224-396-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-395-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-394-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-393-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-392-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-391-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-390-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-389-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-388-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-386-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-385-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-384-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-383-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-382-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-381-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2224-370-0x00000188553D0000-0x00000188553E0000-memory.dmp

Download

memory/2276-254-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2420-255-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2448-350-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2448-31-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2448-37-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2448-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2688-58-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2688-63-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2688-198-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2688-52-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2980-120-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2980-126-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2980-251-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3228-249-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/3428-76-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3428-70-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3428-259-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3480-86-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/3480-80-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/3480-245-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3484-60-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3484-407-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3484-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3484-41-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3492-252-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/3908-1-0x0000000002200000-0x0000000002266000-memory.dmp

Download

memory/3908-8-0x0000000002200000-0x0000000002266000-memory.dmp

Download

memory/3908-353-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/3908-299-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/3908-0-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/4076-12-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4076-345-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4464-258-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4628-115-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4628-250-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4628-109-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4636-248-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4636-349-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4712-24-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4712-346-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4712-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4712-22-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4820-65-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4820-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4864-253-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5012-247-0x0000000140000000-0x00000001401EC000-memory.dmp

Download