01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Size 4.3MB
Sample260805-l2jhtavcqa
SHA256 01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b
MD5 b439dc2e1105384179cd1e427b411acf
SHA1 02223fcca6029ea9eefcf59fd380027f20f64d95
SHA512 960d85030abc34cc5f567aaf3187eef49129e26dbf9845bf886431d89043b3abc16e84c4a5484077f7bee7f2fa7a923db068c5389868aeb16905217cbaf7eda4
SSDEEP 98304:zyvdHlud3m86VO4zCRSSh9hNhroFk1GXFv8Lm:EFO4CcSjPpvU1kL
TLSH
T1D026D012FB8180B2D8530271966757FA0E3BB910533AE9F3D7942D3ADE212D16A3F395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2732	alg.exe
1980	DiagnosticsHub.StandardCollector.Service.exe
2396	fxssvc.exe
4720	elevation_service.exe
3156	elevation_service.exe
3504	maintenanceservice.exe
3276	msdtc.exe
1780	OSE.EXE
3188	PerceptionSimulationService.exe
1672	perfhost.exe
3468	locator.exe
4624	SensorDataService.exe
3552	snmptrap.exe
2896	spectrum.exe
4876	ssh-agent.exe
3968	TieringEngineService.exe
1064	AgentService.exe
2548	vds.exe
456	vssvc.exe
2476	wbengine.exe
4752	WmiApSrv.exe
648	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\de1e3d4a19fe9b3.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\wbengine.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\locator.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\System32\msdtc.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\spectrum.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\vssvc.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\AgentService.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\System32\vds.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aff38874c124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a666bd74c124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045d2437cc124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000779c8e73c124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024609373c124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072f72b74c124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000304da74c124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb708a75c124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001485d873c124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
1980	DiagnosticsHub.StandardCollector.Service.exe
1980	DiagnosticsHub.StandardCollector.Service.exe
1980	DiagnosticsHub.StandardCollector.Service.exe
1980	DiagnosticsHub.StandardCollector.Service.exe
1980	DiagnosticsHub.StandardCollector.Service.exe
1980	DiagnosticsHub.StandardCollector.Service.exe
1980	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Token: SeAuditPrivilege	2396	fxssvc.exe
Token: SeRestorePrivilege	3968	TieringEngineService.exe
Token: SeManageVolumePrivilege	3968	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1064	AgentService.exe
Token: SeBackupPrivilege	456	vssvc.exe
Token: SeRestorePrivilege	456	vssvc.exe
Token: SeAuditPrivilege	456	vssvc.exe
Token: SeBackupPrivilege	2476	wbengine.exe
Token: SeRestorePrivilege	2476	wbengine.exe
Token: SeSecurityPrivilege	2476	wbengine.exe
Token: 33	648	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	648	SearchIndexer.exe
Token: SeDebugPrivilege	3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Token: SeDebugPrivilege	3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Token: SeDebugPrivilege	3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Token: SeDebugPrivilege	3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Token: SeDebugPrivilege	3796	01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
Token: SeDebugPrivilege	1980	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 1912	648	SearchIndexer.exe	112
PID 648 wrote to memory of 4644	648	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe
"C:\Users\Admin\AppData\Local\Temp\01ffe1eb5673c8edb4ea680e7b6f662871b973ba5240a8e7b22c8951e682413b.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2732

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3440

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3156

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3504

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3276

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1780

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3188

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1672

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3468

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4624

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3552

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2896

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1852

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3968

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:456

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4752

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1912
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 aea7481299a5bd66fda9df1c6b587f8c6307b79d3f962155a9cd6065711e3ac1
MD5 281c98c5afdb6b6d429506e06f29a1a7
SHA1 682b200bcf82cd8f5919c64cecca3d71d645daf7
SHA512 680fc08bd63e3c56dbe9de4ff11b44737d095311910dcf4c80954c5440d6c173109b964e46214deb8d1e56bd76e771e4aeee540da57c5e08add22159a6c979b2
SSDEEP 49152:tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnVQ/lFTjN4:z3q6HjB5Lm
TLSH
T13AD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 fcfdba10d0e03e00e02ab29a7d233d4e98bbc520b94d339cba7d1701ade6b833
MD5 1bcf8551cd44eb95a44b80c643d146b0
SHA1 91b453f2b8b84150d832383034e8c180a590816b
SHA512 3cde02b44fc90421daaac16c56ed75915303d639852a6abb1e8576ea2cf75eaa7f9712f2d680a146dcb0dd80fedc5cd891513bc4d53856dab43b7826c9152097
SSDEEP 12288:K1XLsswWkxy2lRq2czACGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:AXYfDtczACnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T15E65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 cf97392bbc76ffb2954efc801834ca075b43fd8a0461809d6e3fc21679b8dbaa
MD5 3c263d1ca40e87a708dcc7342b0d7a53
SHA1 e2a14b07dc5036c7e0460bff03f8eae6d853385e
SHA512 6d9288dca98e3f11b3be4e0f8e38f84a4a86a6363cdf74755734bca1885f129edce2089af0eecc69b47a76955db69cc4a13ab7143fffef5d1ee185f699ae911d
SSDEEP 24576:f0Le5ji0hmxLrMNnQ/tbw/2Mkjy6Fr7g0oM:fPji0AlcQ/lFTjN4
TLSH
T1E7859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e9619c66f986292fa4e26c4ca97650635bee403848d8e06cbae70ef6e26ebbf5
MD5 0e79584d9a06370c9e17450270647be2
SHA1 81316be5542259b245bd54f9e51f9b6e214b9ab2
SHA512 18cf30a36d91d71419c89a95cb73639109df0534cd0b2635a3995289c58a33bae4831c48640f561c279672c499a284be6e5bffaef8a4b94cbb6fcf4e1ae76a0b
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWE6q8wyurnQ/tbw/2Mkjy6Fr7g0oK:7/ezSC6vUzPvxHjyAQ/lFTjN4
TLSH
T115755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b3a2b3c0ea8900f64607f6bb8abd4d1612db8cf65bcdd0bcfc6b56115927cda5
MD5 98413742990d87043b4e2d8b7d04c0f2
SHA1 bf71c52ba2d8365d9a9d95ca769276855626d05f
SHA512 c19160131a5e9e8de70e9455d4825ebfc9ec00179674caed7fd8b80232e8b2669d18432909e40523155ea94f6f3433a6ca9a45652d082faf271ad8f153700e56
SSDEEP 24576:AVbqPb88hv/l+6unQ/tbw/2Mkjy6Fr7g0oI:AVO88hXl+RQ/lFTjN4
TLSH
T118559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e4d278a6d39aafb8e2c39d05914c489ca04eb2b2211b2f47b47a699636a2fb0a
MD5 180e8314dff56bbeb7fe8dd3309a18f7
SHA1 eeca28a59ee87e06b4604c5ec2db09d4c89a6be1
SHA512 c221b93b44cfee364957a00aec0526f8dceaa6c239b1b96be60125c92dff1a89cc53e8d526dba08ff549f089edbe00778cde7c2c7f456183774a6777f9969d78
SSDEEP 12288:LzpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:Lz5nQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1AA5523796A24F897FF2B06B15CC284826B7B0EC1BFD0A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a475c20e8d6a677da36d18d9136721beec834ad13bc2c966e9517f990a59c7db
MD5 a75bf755ff891bcfc3fcf88fa57526d3
SHA1 ec579c6e2227a3702f54e204b44976f151d4407c
SHA512 c841e0130e2be903ed0946ef9df49624f9432990a37c80ae98f5e15c12ccffc4a8b6a60520eb3eb36afb84535e8f67ef01f48d989e33556bbe759b872d421b30
SSDEEP 12288:peBNUbTVO86UGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:pJIUmnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T15F75CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7fff7a3b18f1cae156e6a35d58585c5988d8394f88335e36bc57c222359cc73a
MD5 41de2524f41d8b29e7ddb620f09b7cdf
SHA1 b90fe7ae86a75bb15c2a9dc280a102b9d91b1f7d
SHA512 2fe0d896116a529fd5d59d6bd473e0b5cfe3104e4b4d488e5367838b887a11f19e18656b2aa84e94d59418a2af390b5604d7679033bf0d4d459e6e9573cf2129
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THM:6QvGAdlCEL8c/yRNw5CwLm
TLSH
T1D0267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 74b217d7ed856fafc245e0d7160f680037ef3b1780b54545f846432830e8d303
MD5 78aa26657c9852d23db86dd118697085
SHA1 f596e3eb468644a72b308f965da4ea6922e20e0d
SHA512 8e89582fc2d01ea25a9b24ac05709a1aa6845cfe44ce43c10f2f228f2fa4da751f6854ab44bb867662ba3876fefe6d90f0ac2bd756d6a5f09412a3317d90f540
SSDEEP 12288:JAwSfxL/2Dc39DLLmt0LDQewsAjsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgY:6QewsAjsnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1C175E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ed110ee2b2c54bd331b3f5beb2e087922f84c26f9ba809e810d9471457734a47
MD5 05b5eacf4b8386c290412cb7a1f14384
SHA1 cc0cb65def28ea1d9087f1e5544f08ab155af64c
SHA512 366cd18fecbe6f83e5c764dcd93249e42aca0a993785f45fbbd478db6331c3ed9daac649738848bc88695476a6dae92aa403e2bd8c056cfbe41690fe1b25fd8c
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHnL:sUEtQevvqc2W1cpV2EI32
TLSH
T173474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 aae8d187e2a77d666e9a4a4cde350640a049340b717b6e5e4b5f54df1c2072e8
MD5 40159d36453a7c0123f23028c60b92fa
SHA1 edfde6cc1f164081a45225c8995180104409901d
SHA512 b7e13420f18925a16f2769cff20f9d602967d1215477628ca1388b69acab0143dd3f5f4fac1ec270746e1b2b2c63b2f6c5b739c6cb496c68e8d52568918df981
SSDEEP 49152:gCbRquA/m2yL5zQfFiV+XenmE3/zMQ/lFTjN4:poqtVjnmULm
TLSH
T135D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3e9d6cc7a89bd6375c1f1e8f926322dc6dcde52138f3b35f5595548dc065ce70
MD5 17d08dc32cf4ebe553101aedd7b93a47
SHA1 143af8d7d83eb82f77cc003491813c959753ddfe
SHA512 1e9c41f798dc2acf56c55bb22c3d1b23b401382665a20caaa01cca6789b516865e3c579fce2941255553120bda2139ddd9703821db75b4adb8df03f0b695e0c3
SSDEEP 24576:iAhGLJIFoiwtA5l7S53/nQ/tbw/2Mkjy6Fr7g0om:iAMyFoiq5vQ/lFTjN4
TLSH
T11935AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 429d8fc5255f3486dd9e32263749c8f0496d670a428f7b4bad07061637ab673c
MD5 6bf661433e36c375483d3aa22b47b692
SHA1 48f1688216462e325e2c253151bc40b9d40cdbef
SHA512 d99ca552aa537d1e1edcd6c5ded8e6fa79e352e8b6ed11397748397b51d43608d4cbb6bb11907cc2729e74ab25a1c2986e3579b935cd32fabc28363a6cf4670b
SSDEEP 12288:9mw5HEjsChN2BFgl0WDm+CbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMz:4wuHOWgnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T19565F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 82ad14433a39ae6505ef5518a4b3c3ee562158ff2cf36384a5a59909c48c25d2
MD5 37820abac109016b2ab898bcadfccfe1
SHA1 83af6ec9cf105485d46b539199bf108a620c761a
SHA512 5fb47d93714580b6ddf9c7707a2d11b92b000639d9b9df4cdb99ab0a1c1f0381ef0b3d4d272ceb63ac11883221b8dbe00946a2ace0bd486d78244e8bfed4a437
SSDEEP 12288:TXZ1Iy8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:rZulnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T14E55126A33A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 27a427b5fade65e20619890b1ab08e44dbcec1063d750598429a0eff7921e38f
MD5 547a8fdbcd965b9f34984c3be4909fe7
SHA1 ddb61bb7c193de1a315be9af577782f406f3d88b
SHA512 4257287b390f51040842fe24f57ed073c85bc364ab79816b83b5001203c87d136fbef9382241282cfe450d492098ea3999f90e586b1ce138a099d1808352fd6b
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:rQRQyi36YOcPQLvw2gAf+PN3VLm
TLSH
T183667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8547bb5e42d6523665e14587d1e728f17a4865b03ed5dadfeb501864b939751b
MD5 6f39477e57177106adec71b42d128aa9
SHA1 cfd5bf7ad1d85fdab3f2d5718bffb727d6bab0ad
SHA512 1155ec5da30cd31ae7ad367be72e07ffe84b9df4a85bd86b5d72b7f64b6595df92385904c48c2551d2dd17112d429ea53c70d051c10b429a3073e842d0362d94
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:YQRQyi36YOcPQLvw2gAf+PN3VLm
TLSH
T176667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 420a4ca1d6fcbc04bfc199ee01b2a7739bd107baad4853ddac3ccf78d764cb5a
MD5 de0372508b4e46cab88bc51d13e87137
SHA1 4036b55c57c3ae2f2595dea97c15032c0610daef
SHA512 1f4159c09469baf7827ba104d9da32d892cd135412d31c6c5e4a58eb196bca96a183b039027386201a16aeeabe19b8bbf67537d881cd6dd4fd9d7438f358913b
SSDEEP 24576:uwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0VnQ/tbw/2Mkjy67:Y68Qg55nhheWu7PNU3/cQ/lFTjN4
TLSH
T1CCB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fe1aea069d4570d1f2ef15e1210ced30e5db1fc3f49d343b6d5656b249121ee4
MD5 a90791b24df0407db952e5919d549a88
SHA1 9ef2cdce40dbbe1e78c3d4e0aace42ec53dab0b0
SHA512 21c371c536d935162c58241ce01cf6decf806f69f69dfca50c2b0b9bcfbffb91c1c089c605089144b9838bd1b168e43241db0f1b62e395bc465d2b18a3ce925b
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99y:zy5112gYy5azzVvL69nLKnhZuLm
TLSH
T179167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6c058199d178d7724f9a2b9fc8024cf479d693b26e5def9a46d07cf478978512
MD5 2f0343338fd9abc7a33bbee4e87bff91
SHA1 13286cbe4e1afd1e195eff7d89aecdd3b1c64e34
SHA512 c8b502cc8f0f1fb555819c719085ca3e3828944c22fc95b88803a5d1a28be12a5b465eea59e12db91ade33cf5458c3a48566c19a09bc1727bb5038e399e44232
SSDEEP 49152:CB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glyQ/lFTjN4:wu6JmVxd2d9Lm
TLSH
T165D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 568c3c6459f83bd56cd90518a9a643341c3023cbc3503b9e3673c8d0f7262f53
MD5 d3a723972bdf03840c2fbb71cd117576
SHA1 8c29af9adb0cfecb8623087a161f974bb45b0b3a
SHA512 c1b508a0ba3f85cc2ea45e6d2dd262addbd5b3f82bdf91d278f45f1de958ae2617b5ffeb4ec7957bcc580a5aaa2241e076a40d4caebaba315d0caa33075f4c5e
SSDEEP 49152:W1hpsNoJpF1A6UU44CwH7R4xGQ/lFTjN4:WmifPbRULm
TLSH
T11DB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bbb2645922f4dcabac9038352ce5e737dc87d0fe12538c763625d0a30b811b4e
MD5 8e4b7f6477a43842fbd84ce6ed71ddd6
SHA1 5a49982a8771b03ae8803fbaf8660abf2dd5a339
SHA512 af0f453e2626a48c7da7cec549b338ee987579b134ef935a277c4a8a89167271eb399e32a56bff51c2c020acac84f2f353b9df455f6342423e8390d4f291316f
SSDEEP 49152:JSuZQIY0Be2KRRVtOnks6NMHqlQ/lFTjN4:H5dKTi61KLm
TLSH
T198C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f8dbee82be71a5d2e4d6d81b22bf74996bb5f1ccf7909915a8d453722212ef1d
MD5 ada720f3a81d94352774c861885cf0a3
SHA1 0250d5350012bda93dae00404c527c7bc0c31730
SHA512 0d599b6db2d92232eaa4a6e91ae29c2e336e3c3ef274f223f5406319092c286e5c1699fb98292396050f4704079ef519605c4b9a82d40f123982234a0ebbf3c0
SSDEEP 49152:bhtSn8EApI0figngiDn0AP5wCQ/lFTjN4:6X2iyphILm
TLSH
T18D95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6cf02bb4b6cd8d6acb772ec7909e366fd9591f055b3c12d622c6a6011210f32c
MD5 4bb86ce0e121648c07d2a4e07d089e25
SHA1 5244eec5cb2bc59d4de1ee5d3b58c9a0f45b2a7b
SHA512 d0df99f91fb96b3aa8a97b882068b09f3798d349cfc372af5af5e1a98f1222f8357b8edd9cc0ba79e1f8508e39e22b39e4bf7996e867758dd8c0112b342f379e
SSDEEP 12288:aBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:aRnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1195523697964F98BFB1706F18C828182A73F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 71bc3b4aa50a23bccc7bae5f3afb0cd7c1dfd9523e585f9c06d8527569480a1e
MD5 a27c19edc8d74d45741e3c7425f7239d
SHA1 58a825121f2d55eacae392143296276f173bda94
SHA512 fa7e7b9bcce402b93594485944894d6edc5a51de60236b194f759af229f2294882f6eb41898c6e327d2df6d5b6be55f7bab482906e84af5ef45d8daa03538f87
SSDEEP 12288:2IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:2InQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1685523797965F98BFB1706F14C828182AB3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 47ccc5079763104fb1af7ed6d4a492803bd2f6f07f88b57b8cf2c3650cd01543
MD5 dbb16f0d42ddf30ed44b44ad9b4328d1
SHA1 9274ac89714e18a5894d956a6f64fba8eb3f50f7
SHA512 e0bb5485e0f002a375f2eaae353a16f0c8c008b6334d794c8917febe6970b0c639540b4717541ce4533223cc779f7398ccf91dc2997cc953dbd2d53ad41463ff
SSDEEP 12288:YeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:YenQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1045523697925F98BFB1706F14C838182AB7B0DC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2b5f848fe3cfbd89ff2c3bca66ba6f16e7c479d7024fee3d268a603b35552d6d
MD5 adec989205195f4faeed054adf7cfecd
SHA1 ac197e14b68f145541856e2255fd4716d9f7a029
SHA512 15706a8b1cc9f9e2a943c5e9c0be18ed24cce89410017987a668c6359f3f7d826652fa2fd6f141b8b07d428a091c409d3fcde436a20ed4e05449cbe668cbe170
SSDEEP 12288:tV/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:HnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1555523693B69F4C7F92742B4CC928142E77B3DC6BBA1A3CF6B04111D4E793D41AA5B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9bf3ea7f10ede6d2174b98d5980e353a52a35b72f70752692bc0109864f38d05
MD5 173ededbb900397bb27bee27e984a20a
SHA1 5176f61c601241b7deb6db266ef1dd848c3a1eee
SHA512 ff6fa8fb9610a02fd07091ec7c19f0cd52457fb6ae88721b3fad6efdf1e9111aea38bee8475c9309d8971ec7e3d2e33cae63125c96b28de0afb93dad060e0ce0
SSDEEP 12288:6HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:6nnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1E35523697965F98BFB1706F14C838182AB7B0EC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d34eb9d6e02ff9b021fc977f3562b0f7bdd0b48156bb9a7ef3a3766b4c0f740c
MD5 a0d869db1aad2d289766f2dfe9d346fe
SHA1 eb4ef6138d23e1ce1af84580ecdb2c5ed87e64fc
SHA512 dfe338ac69caf6992c6179d8c8057dc84039e0356f21d4f19ec6d3807589062a30c6dd97fbdfce182a251c0c13b52d9b8c1aa492718ec818741c043df500dc17
SSDEEP 12288:kkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:kEnQ/tbw/2Mkjy6Fr7g0og
TLSH
T10D5523697964F98BFB1706F14C828186A73F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 823d0104d018dd712cf1dc3a1d3861650401a3084ab8e5e87b8408ca966514b3
MD5 d156600be5a68b60371c678b7ced852b
SHA1 a9fbee866174466772f2aac7852f99393fbfc129
SHA512 4ba705a69ed1c3853eafdfaaf28ddabe6b1a2540f944b60f32378eab2272b4395daf18574f7797e4aa417bde2e323aafb3381e32389ac9979c8a3d2908fb5c1b
SSDEEP 12288:8wGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:8QnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1B65523697925F98BFB2706F14C828182973F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 aa8029e4bde500a9edbe5345d10e2f28b7e5204b7249113d0e8cfbb5eb4d3c15
MD5 befc544a26c2fd406a8e307eca7342d5
SHA1 b66653d99976dd2ea293ed9b16a62a749b718edd
SHA512 cdfc116b7eb733e8006b33b9d552a790ad5df70942e8daa54e53dcbc3ff5ec937e90df61dc2d0199c533d8f77960b13b16ce8d99f028c8172ef7fac7e0df4204
SSDEEP 12288:diZwbDzzFEoS2cPvyoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:gZM3zFVSOonQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1A17501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ae5cbd5a700fc636a0942e32638ff4a2b95ffe6a5a2b8e6e2d0e3a9988090778
MD5 b9bab081690a196df9f2ac0f031b1d92
SHA1 d0cbef9936a4786a594e51f18b28e5a7ca2d75e3
SHA512 2186e6e741528b9a72d6368a44bd72104dae9ed2174c733fb349e0d0a806e4be8226b6dd2a495a0a08e7293658888073cc37b1732dbc31a5f25f189051474574
SSDEEP 12288:4VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:41nQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T11B5523697924F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 08ffe238483c99cc8b8e762fca63314682094e59872b49677b73a66b155ddc22
MD5 8d26fffdbf249471b8b2730a5f671762
SHA1 4e31718ca9a54fbb175d3582978b0964b8ead56b
SHA512 34031fa949a7f162708cfa21bf3baccde0207f7a31e57425183ed13a976e7197f7cc572b4e383a60a19517fc067bb48e215b6e6a10b7681d407bee8122bdab54
SSDEEP 12288:R5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:RJnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1D35523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c31d7b96699b14c34e580c9748fb438f555d387400384347737fd637209d24c9
MD5 3bf46dcd431bb920a1bdfb8a5385c20f
SHA1 fa088f55d95611d3e62dd69a3bdbfab984bcc33a
SHA512 cc3f34f0a13a703613a846d0623975ff189a62989e7bd533e372a1577e01de9b03aa71cb1bdc1b0380760c77f2bd261b53445f426b8039885853f323eaf9c605
SSDEEP 12288:iyPz5L88GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:/zy8nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T16165021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2a60a16bf99002921be040f95c06ee7f2bc30d37c0b94924b6257a630f00f2b1
MD5 de331a2029a2888c3d2df8ac38441a47
SHA1 a4e54107b97a5a02c723b614134d5b836897fa81
SHA512 27fbc15bed07d5eb0bbc291d6df2020d388e81a01f76ea5ad839529356c270adfed9c6d3e80c20145b68ffffef8bea1dfe3f0f609cf90f60694e7809e5c00ebe
SSDEEP 12288:YVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:Y1nQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1D75523697924F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5c57fd9dd330fade49ebe7f89b42a3d04d577c9e742a10709221d0f490d620e5
MD5 a7e01e35110b3109281740717f61391a
SHA1 ee043c7337732d238b32afa7483ca96fdd6170ba
SHA512 960af43d86f4651784b6f642b98ad5fae6c12d24e85f0925089228fc7d37ba4e387d0f09178484c7e7d1a20947d9e7f4bd164c586e71ea4b4da16cfd72fef438
SSDEEP 12288:6VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:61nQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1CA5523697924F98BFB1706F54C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d1f50777b9faf9249001971ee135f4d2939d5435d4439430dab677b87121bada
MD5 d0030083b351051bb57a8bff1b72c739
SHA1 5f70bfdecac51ed54ec0adefd27760203f21d412
SHA512 6c2d79fe2cf47f691ab29f4e584e23204b23413ce419d113f091797ac67589083beb93bb2dc3ba7a314f285e42c3b9dee614c226c1a35d6cae3af2bda46f62bf
SSDEEP 12288:AyPz5L88GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:xzy8nQ/tbw/2Mkjy6Fr7g0o1
TLSH
T17365021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 6fde3d03824ff41cf77dcc0d823f41b1e404d79b83e00354c952f5d38b5b1965
MD5 e68526403fc0c603230393b5d7db3306
SHA1 b277d7b9fa9f7851789e0e148e89414e1b51b8ab
SHA512 44483ff25eb7fb347c01f576ecf253bddbd1ef19f02c8a7bd3fc1d6d57aa89cf3a6cb299489b22c27a77dfd1a14c5a4957591d5ffbd1dac35613d48d8e32d511
SSDEEP 24576:WcP4mcvIjkGOxhKP2l71nNKbrh/8KB9nQ/tbw/2Mkjy6Fr7g0oF:xP4m4IpOO67W8K7Q/lFTjN4
TLSH
T19165AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 8681fd8ae0a3a77d6c42e70128826086e1b2cc9843fd2410e6b7b56e9d735606
MD5 978b37f104713109db3656904cfd1f94
SHA1 cd3e1699c9c187485bb99e25ebeef641d8ca78f3
SHA512 7904789d5ee4f283c254edf4e8b02776636bbc6111a881873d9672049e933d28436dc98e369ec943b466f1ad8cf53ccb3d7ae39b266f3b0a512c5372c8485896
SSDEEP 12288:kssfFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:KlnQ/tbw/2Mkjy6Fr7g0of
TLSH
T14965F119E29852E9D12E1275CB828A41B3373C9597E1D3CB67C0F53E1F3A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 65a1524f8a95c276de0fdc83b82d8cc5214c2a4bf062ae32cad4f649469b22bd
MD5 f7106b16e054b5bbf5ad0dfc79d08c31
SHA1 7d57bfb879dd8ac36d43ce4d017555bd7324ccbe
SHA512 27a42d11a35e78082425463ade3dbdd3ac4ce42452b20ce4a20c1cb3e309bf0aef1874b619e1e15104221106bcbb93857fd7cc282aa4ed87fe23544a4b84c205
SSDEEP 12288:klGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:kFnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1A75523296768F94BFA3B06B05892C151673F0EC5BF91D38FBB08222D967C3D40EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 dda1bed67fb3476f9e7a30d5bbb71dab17b2e4826800ed1204ff51790912ca30
MD5 ad722b1c20edeaa350ae2735006d65bf
SHA1 0dc10e4ffdfd172001bc3340aaf7fabd3cc63313
SHA512 fab211a1bfcb774183429e950cad257d66ffceeb2d7e5046b81228d9a6a051506fc8142123adad9192426c2c067da71f40379fab495fa30a5caef4408575d148
SSDEEP 49152:la0h2GEkuAe73q3pp46zwwQnQ/lFTjN4:la0hNYG4JwnLm
TLSH
T1F4859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 7eb46229e685946702b4b0021202def4eb2f2e1a7fbdf84b2bc5db1871207012
MD5 4093590a580697442618edd761057336
SHA1 23aee4462043df1e409759b71e980ebdf91f1211
SHA512 2d23326f72bdce59142455485cc22a611b2831166f16ac017a313d4754ba99f5dc4b31545d3dad88516f0c4d05cc79d165a52af5495a008e8dafd396d3bb976f
SSDEEP 12288:/hbHjfX4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:/hbHjP4nQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T17955027E26AC20DAF63692BD88928546D7327C552B11A3DF2381427D4F3BBE40D79F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f163ce6b1ba6b13c858727cdeca3a0b91d0bbef7f52a3aa660d61b57d0165f8d
MD5 2dc1b7e723545d6527499f6e38aace84
SHA1 4ebfbb3f5ecee87fca3866ffa240ddbe8867674b
SHA512 06dc35e8470aac9a75428e228739fd1b0edb539c6bc3f6cc6e6799943716e77df722ba08888e900bbe5ec2aa9cdf89c4bf91203ed0f9681f29f568e210af6197
SSDEEP 24576:03YgnJcRTk4yti+R5dBR/gnQ/tbw/2Mkjy6Fr7g0of:0IgnaTk46pBR/gQ/lFTjN4
TLSH
T11D45BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 33027c9dc80eaa82c23c7675419c1fc63f034e96ea46a9f2d4362faf586a5c07
MD5 3921fd3f1212f3e56ab07c74f0c2661c
SHA1 b07bae57b780c3f1e40909c75171517c1c6046ae
SHA512 397d3f7bf73e05274dcc0f20a7a13adb1842b19b8674affcceaf9c84e71442778a603c475efc678fd8d8949efde6abd3813e17bc13ce332a3a7c0fbd96b1f097
SSDEEP 12288:KJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:KZnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T19F5523687614F98BFA2706F54C838546673B0EC17F91A3CF7B482229967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 34571a34592ffe6628d7006e20607c2300519874b3db0f068ea5c158f660da23
MD5 cc029bb51c971507fa1cdd25714080d8
SHA1 8fe7f30d71082b49743a609f10979c70c8d59bd7
SHA512 19185dc53cb922557e1866760f6a3fe69a7e20ce78d5f6414f0b2b135f9aaeb93c5e834a52848eaf1710878cf75ddeb62e20012957335a7ccc9246c9f538cfee
SSDEEP 12288:lOb4A4LWOsvAYFTCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:iwL3UTCnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1BF75F155F7A450F9E92B817CC8A28A16E372789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 4e1e4acfc7b33ceb042cacdc3abcfee5139b1a042f596cf2af88d5b3caa516ab
MD5 5cb2f4ddc72a43c1da9a770275bcbd42
SHA1 88a70b9d2ac673bc2b93ecb19fe148ce89d39224
SHA512 96881b16d0a14942b018440c594f90ed39e648919cfa694136e2767426c3b28d3fa672a9c60a2aeff6132d8c8ffb08257eb00697ccf8f2bb40f47de859a3ab1c
SSDEEP 12288:JpFtCOmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:iOGnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T14755022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF81C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7b68137c52ef3dc6a03d02860ff709fdf1cce544b147e06bf9130bdec5c21cb6
MD5 7a8d8d90816e13c2936433cf73af80fd
SHA1 3777cf09b97c548d3e3aea1d2bdcfb9161ef1fa4
SHA512 741d873a8a920af5be7b991d43c8054bb06a3c0341344165c7690c9654267bc452f091e49cfc00431a813982b51f9cc0825ae07e2b48a5dc08410aacde16db62
SSDEEP 24576:b7NM9YqZqmWMUkPjZM48Mv6bEhs1nQ/tbw/2Mkjy6Fr7g0oN:b7cBWMpPjN8DbEhYQ/lFTjN4
TLSH
T1D8659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 3029689d49bfb779ebb38f4443f93d10dcb636d93b9ef6eab25944a6eeaf74f6
MD5 fe8d5e8d1fd0abaf968ef86829faede9
SHA1 071c4f80cf8265209aa507b70329becd440353ff
SHA512 33ef49ac54c7cd22477e015590cfa7541f7cd23f07bdc61e106fcd368b04fa571cfb141143e0ff821ccff1f39a13836b3350c7d5945f4b8788840fe7995f694f
SSDEEP 24576:KW6BApg2YuyuNDYTabvcdvNYf8km1TnQ/tbw/2Mkjy6Fr7g0oA:KF2YuHNETovAvNYf8kmVQ/lFTjN4
TLSH
T19D857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e7ae99f4a064fcf9af91ed8d46928a24fb61ef88d09d644176666ae2d938e0c3
MD5 a5d9f8beb700490925cd2fd16a2afc03
SHA1 d9d1824516d6798c182e41f9ba917ed43c597855
SHA512 4c7468c0c926adb69a66c491b966cf41fde49c28716231a390bc9d58d1855594e229461c5f54c210179ba16b8bf9545db3bdb6c7377b00a2754b60d2b23f4687
SSDEEP 24576:CAFs06+Omlf3NXEbTo6nQ/tbw/2Mkjy6Fr7g0oR:7Fs060lVXuHQ/lFTjN4
TLSH
T15665AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 f2fb718358b8f8cb1763b38662fe46067332a73ef6a3ef5ba40c30375a7e0e7d
MD5 8c4ce7370e783a748e6f4cb10194abcd
SHA1 f91be79fbb470dfb88b659f53cd29ae914727145
SHA512 529846a2f50d072ed9c27a116abf6930c54ae2febf02d4c432a1b142e32c95ce215b5a0b6068a67a930b77a04397b808933b2467403f079e6606372375194959
SSDEEP 12288:gCJnJ5D3Vkrqzx1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:1JnJ5D3WaHnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1CC75D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8c538d2a3219200e6c560214c4561920d1fe3ac247a5810a48e3d72392e53c67
MD5 1ba7ba8ca619bf1ef6abcc548701dfc2
SHA1 89947e5d880eaea9633c9a5459943d7f75e949e0
SHA512 7e99889b04c62cba7e5526baba79f678a00d2009d05ad2d611bf1a7b519f996a24115e5b21b92e8153da3f01ac7841c6424f9e1a528d15c64e61237937255e6b
SSDEEP 24576:YEPghm6/7IIXdwcXrif7qQncjlP65i3VugnQ/tbw/2Mkjy6Fr7g0od:Xg06DIKdwc+eQnSt65aVRQ/lFTjN4
TLSH
T1F9955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 9f6799a510b4374ed912588611fc28307a3faee1ca46f4a8672907f858e972d9
MD5 6ee5863e2677b84b6025915c91b57762
SHA1 3a33ccedacc3decffaeb3ea017e48ea1c3236592
SHA512 985161b7eae0e99c2d48018eed3d0aa0c7998c3aedd508bcb17099440377bca7b9b43cd743e190089c8bfcf78234daa04821f6bd5d4e1cee4ff8490c895dafb4
SSDEEP 12288:REP3RSbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:CSLnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T11D55126D37ACB0DAE52A517D88918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 e52d67ab1546734a2ffae3ac3de61c12234fb45d8666e191ab0ef5d8ec8b34d4
MD5 69a3f86054472792dcdf80a46687d454
SHA1 2b5e9bb2166e6f2597a3df7ba5ccf7218d28b7b1
SHA512 ee798bc69394136a3355b3d65fa636217305a0e25d9a91efa5575138d71fa61d81085a84738a186260efd69b312e9965a612998d6ff1d959413217d2e08aa1af
SSDEEP 12288:4jkyIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:4IyInQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1C36512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23EAF3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 f9af462199c3ad0881291fc24a7afc63957f7de2ed4fbaed88b398fcdbc6cb7f
MD5 d4a901080d2cbcb0bae3a98c26f7c495
SHA1 9932c67cee80c580126562f4dc32eb64cd3bdddb
SHA512 9204b2eed89e8d2b8380b2a3a9a10316297108d3c492ad8f8793dbbedba489c84234d02ea8476373a34c85ff497df1f34c3cc5aa8d8b69a1b241b4c1ed5c6ad2
SSDEEP 12288:802GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:3WnQ/tbw/2Mkjy6Fr7g0og
TLSH
T10455236C2625F89BFE2706F448928582973B09C17F9167EF36846239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 dd356044bd85848754ac56c2fbcc983698f6d99947312031049062f5abf02ef1
MD5 9b66524fdbe5ab244bb013da2b05d46c
SHA1 483b6cac8a48074c99ceed2b42dffcf940956011
SHA512 b06c6f975edbec0a317d6d48179beb9d854756bf9103b24c14502d7cdbda0350182b381f6a636b8c6073d47ce9170d2c97ffcca3c292120c25e30206d8c51f79
SSDEEP 24576:YQ9MxZKdcz9dw3tnQ/tbw/2Mkjy6Fr7g0oG:YVKZtQ/lFTjN4
TLSH
T109558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 cdd4592955e6b9aa46a057236daa87cdea7a62b829ea6e461d6c2c18da6254b7
MD5 2985eb33607b3274410bb21c07847ab9
SHA1 bce66a855d229995bd9acf16f5f9f771d3f82e82
SHA512 aab21ae0bd09bef8e13a99e20403644b9ec8defd657e99fe436842f8f44e67267f3807b32c9a161e8ea73596cbf582e52f18fcb9a24d91ec6769d562201802d9
SSDEEP 12288:KyoKo20Rple9psGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:KyocSApsnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T10765E01FBB6990A2E136813C88818745E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 48bb4ceb1259544ad78e7287f28b6491e1e490048f6cfef03501543f2aff81df
MD5 5ff7be727b22ccf7905a62fdd742d48c
SHA1 f226b2e88460b9f84529e45edb38c31748666911
SHA512 aa4226aa60ceedf669555e7f88b7527927a2d1f2008c37d862cc8cf47add6caea04fb5f22c923461a7c0350a8cea69acf7c23beb5aa542f5f97418619abe0571
SSDEEP 49152:RWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKsQ/lFTjN4:J0zuNINLm
TLSH
T1C9A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a9d5f6b71eb5024955923bd16abafbb265a6e725cbc4b7e84a3c4784847c91e1
MD5 dd942fbc64338d725b770f493ec7cc82
SHA1 22340dc328d8513d10a1d77a57517f775f079a41
SHA512 516fec90c5ec387c8610d5516767db162275f7717f56d3cbac8c5e3750909074848c3e1593c47b51d9cfb82de54557e9700020200182e9cb3cbdaac2d356fb57
SSDEEP 24576:g1QT7EcpfxR+N5AWAz3ooiYtjMqbLnQ/tbw/2Mkjy6Fr7g0oE:dTDxR+N5YzTfjMmQ/lFTjN4
TLSH
T1E355BF2EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 2ec7757faf31f2ee36566fcf58b9de2fd50f73d276fce40ab63821868177535b
MD5 72b93705776bcd7ea34a7b0c424906bb
SHA1 aafd76ca7f8e7539bf6a0971928b8da3d4e05c6c
SHA512 c04f20285882b3523418ea26eb5f71b6edbaf5edf33b7b982dd6105fad2961a71b5fa3969dfbe53ffca63ab3760ac9a50abbc786d3732327839375b0c39ae4f7
SSDEEP 24576:fTMdOz0FFS+1mSLfnQ/tbw/2Mkjy6Fr7g0oE:90K+1mSLfQ/lFTjN4
TLSH
T18975E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 77a2bd95c9966a4f33c9cab2465092b0b3504579c08548cdcaec492fdd9e1714
MD5 e01ad8b940cb48df73698bf7ba812993
SHA1 ccbddc5f237d3a37113e4b0e2ab948948f0aad47
SHA512 2c384885a7d9784d1da673381ff24134c4e1abd90a77bde630dc5673dc207ca1ea2096d956bbd5bfd52e61b47d8f76a913a9bf4d9d93d5b83052f461d4989736
SSDEEP 12288:24TCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:VCnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T10B55122D23E874DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-365-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/456-160-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/648-214-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/648-173-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/648-195-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/648-179-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/648-416-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1064-152-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1064-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1672-164-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1672-102-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/1672-108-0x00000000005D0000-0x0000000000636000-memory.dmp

Download

memory/1672-110-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1780-84-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1780-155-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1780-78-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1780-86-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1980-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1980-101-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1980-22-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1980-24-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1980-23-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2396-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2396-71-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2476-398-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2476-165-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2548-364-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2548-157-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2732-12-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2732-95-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2896-143-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2896-240-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2896-124-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2896-130-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3156-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3156-42-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3156-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3156-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3188-89-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/3188-97-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/3188-96-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/3188-159-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/3276-70-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3276-147-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3468-167-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3468-112-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3504-62-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/3504-54-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/3504-66-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/3504-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3504-61-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3552-238-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3552-122-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3796-0-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/3796-60-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/3796-8-0x00000000025E0000-0x0000000002646000-memory.dmp

Download

memory/3796-1-0x00000000025E0000-0x0000000002646000-memory.dmp

Download

memory/3968-362-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/3968-148-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4624-363-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4624-172-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4624-118-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4644-383-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-370-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-392-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-390-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-389-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-393-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-399-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-400-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-401-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-404-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-403-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-402-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-406-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-407-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-405-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-394-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-391-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-388-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-387-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-386-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-384-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-385-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-397-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-382-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-395-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-396-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-373-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-376-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-378-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-377-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-381-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-380-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-379-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-372-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-369-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-375-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-371-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-368-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-366-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-367-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4644-374-0x00000283186D0000-0x00000283186E0000-memory.dmp

Download

memory/4720-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4720-32-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4720-51-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4720-38-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4752-415-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4752-168-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4876-347-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4876-145-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4876-141-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4876-135-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download