4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
Size 1.2MB
Sample260827-q2t2rshr21
SHA256 4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5
MD5 443cfd94deb8e72d4970d1484908b523
SHA1 9bb0c9d81ba9b556c520ea680aedfae35443a2b1
SHA512 ac03a8b6293feeab3c326ce6568d920bd57610fe2a44264d306460e6afdc5405fe4efa49fc7f0d667c0224855f79acf309f7b2cd128c537a9f6ab96827476f9a
SSDEEP 12288:x9pKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:xfKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T15E45121BBD074447E20449B145BA02C8787E6C7734E15D2FF788BB4D1A7A89AA4F8E37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2148	alg.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
3364	fxssvc.exe
1144	elevation_service.exe
968	elevation_service.exe
680	maintenanceservice.exe
3432	msdtc.exe
2964	OSE.EXE
952	PerceptionSimulationService.exe
3232	perfhost.exe
3684	locator.exe
3484	SensorDataService.exe
4984	snmptrap.exe
5112	spectrum.exe
3144	ssh-agent.exe
624	TieringEngineService.exe
3968	AgentService.exe
528	vds.exe
4320	vssvc.exe
3332	wbengine.exe
3204	WmiApSrv.exe
620	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\dllhost.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\System32\vds.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\vssvc.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\System32\msdtc.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\msiexec.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\spectrum.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\System32\alg.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\AgentService.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6111d511a19fe9b3.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaws.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d8dd8702a36dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054bfe76f2a36dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff0d3f692a36dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000554ad26f2a36dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000412996f2a36dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082abf36f2a36dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041ff856f2a36dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042749b6f2a36dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f3ee9702a36dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2868	DiagnosticsHub.StandardCollector.Service.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
1144	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe
1144	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1316	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
Token: SeAuditPrivilege	3364	fxssvc.exe
Token: SeRestorePrivilege	624	TieringEngineService.exe
Token: SeManageVolumePrivilege	624	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3968	AgentService.exe
Token: SeBackupPrivilege	4320	vssvc.exe
Token: SeRestorePrivilege	4320	vssvc.exe
Token: SeAuditPrivilege	4320	vssvc.exe
Token: SeBackupPrivilege	3332	wbengine.exe
Token: SeRestorePrivilege	3332	wbengine.exe
Token: SeSecurityPrivilege	3332	wbengine.exe
Token: 33	620	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	620	SearchIndexer.exe
Token: SeDebugPrivilege	2868	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1144	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1316	4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 2212	620	SearchIndexer.exe	110
PID 620 wrote to memory of 2412	620	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe
"C:\Users\Admin\AppData\Local\Temp\4c05376b3cbbabf0b2af73e91aeab155e628e9fbcd4b2710a1622735abe190f5.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1316

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2148

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3480

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:968

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:680

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3432

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2964

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:952

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3232

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3684

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3484

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4984

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5112

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3144

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1820

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3968

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:528

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3204

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2212
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ab6771bb5f4e906208eeff71e988231e8f8c127e2b6c3abb2ae94e8f5426935a
MD5 b546a448baf7c773cba066a8bc31d283
SHA1 f865c8d87362ceca980991b3d992965ecec50515
SHA512 2aa9fa12a922d1de1e28790c4ba36b30bf8cf56f235564554ade1844a444825d2b9783c8bf223535d5bd9885c861414af676bf7d2eaa31fbc352d885daa54883
SSDEEP 49152:Gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnSKy9Lk5Fp9w:43q6sjBBKyeS
TLSH
T12CD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d7e05140cc95c6613a1a844af0d7d897512dfee879d2917facc4a4937efcbdb9
MD5 4075cf36730c230bfb7142e6d76fc07c
SHA1 7296fd5d4528dd2cb79986cf9984468cc5489daa
SHA512 3ae6a7cb827cdc52923222526f78263e2bdeefc72b80d45f2e74fd1dca27816e313f15f76dcb07b6a5ba85b58ca477e4f252b1283d4928a53a7d9fc05bb394d5
SSDEEP 24576:FXYfDtczAdKy9c4bAT00FBGwOXKFVsDQ2:QtcEKy9Lk5Fp9w
TLSH
T13765012977D108F9DD678138C8A28501E633BC9547A0EBDB03E4E9291F376D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 db49483a1666752cb8ae95b0b6c7f9b33900f1f708cd6d13aa22e0477bb53e67
MD5 baf75c297653026b521e613cb1b04495
SHA1 f4367de999b5592dbb3c1b60b8fa7533f81cff59
SHA512 765ebfabdf2b5a01a357a83a5514bef03d41abb926190f8b584ec7a836d8d092ce7de451035b39c5bcb702b715819d20a73c31da20fb20925ab8d64dc25f1778
SSDEEP 24576:I0Le5ji0hmxxrMaKy9c4bAT00FBGwOXKFVsDQ2:IPji0AjzKy9Lk5Fp9w
TLSH
T1CF85AE16F6748331D073C0B9C5D2A68EE972348657308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e1dbce2b11797aeee692ff25ed12861a58dc66169166fd6a25f2ca9264b60857
MD5 91df7a558fb8570b18d9acec4c0bb703
SHA1 1b76d0d1773583725dc253cb504d579271b05e78
SHA512 0199a7e23bca1bc7afe8952ee4ffe33755c919100899a6a9bda58bd8ca185199c189cea2843ab83933ca08b1ee2e8a4858aee64edba1acb5759c73eb87b755c1
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWn6q8wyu0Ky9c4bAT00FBGwOXKFVsDQ2:s/ezSC6vUzPveHjyvKy9Lk5Fp9w
TLSH
T19C756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d6fc491eb58b48b386e59a6f91bb0e7721537a1935199e666647dce652b8ac60
MD5 8233ab2848486566d8bfd7070bbadc81
SHA1 88418a4207e0646e6c96186bbb5737c6fe0b2147
SHA512 e1964c4276292816c0ef7c87ececc8510828ec76368f24714a79eaaa09a4022181dc8becf14356b20dd14ae36d8827a8f2aed14da18a901851589804c1e06294
SSDEEP 24576:hVbqPb88hv/l+YxKy9c4bAT00FBGwOXKFVsDQ2:hVO88hXl+sKy9Lk5Fp9w
TLSH
T11F559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E776D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1bb664b5485bcf19761d7a8aaaab68d6586d5990d3fffc3e23011230b4c44678
MD5 abf813173dc41c7bc092c7388281220f
SHA1 d95869a8d81a460cb013c57197a308a3a5e2b987
SHA512 d32c79cfdcae25b5be97af624d38781d929091ff4bdc0b88c9475527a85273f18c97f4a35545467d296728bf0c53529727068795944fd5ffe1de45ecad4ab1be
SSDEEP 12288:iLUpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:iL+Ky9c4bAT00FBGwOXKFVsDQ2
TLSH
T17645230F7E4789D5D786257150AF02C9A462ACE979F08D67E088F78E5E3E89CC17D807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 28ffca6be1878d6ede3f3fca94455d2512e649452a56cc63c9bf9f22f6ba8448
MD5 4c72249923f2d804a02e256a7977e3b6
SHA1 040e8b5e6a82104a1a39285c4afa92fff08c1728
SHA512 3b9c926f2b5f044b7ff61f99f18b62b7b1fdbc010686a5e07c225ae71f97447a7fc6cb6f8657799fd01c7f4a87b09c43c9aefd66f71b4356026fd8acfef2ec07
SSDEEP 12288:keBNUbTVO86UXpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:kJIU5Ky9c4bAT00FBGwOXKFVsDQ2
TLSH
T1F665CF3BAE28FCD2C27A5DB856918340E77278704B6293CBE164C30EDE275E45E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 076c7032438e253d58afd1cafeb4732661df994fb4ebe5894fa6fd7d6e60ba25
MD5 9aacaca58e5bd93570eae9f714f1f617
SHA1 48aa5f1a5188ad21511fe08f6271050ec288400c
SHA512 a37d26d504978bffb438889dea8adac4359bbf0fc8407e62d56faeec3ef3d2f092a2dd63333f77bba2f0d9c6bf120fab52f43a82f3646780f6228ac6152c5406
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THB:LQvGAdlCEL8c/DRNw5CkKyeS
TLSH
T193267C656BF880F5E0A7E134897AC6B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 089e1a47fa4c380ee772d0a766d6baefcf998ba634479d4fd34c2ce4fe395abb
MD5 3ae3a3f97bf11a8a9b166620afa8c532
SHA1 a98bf8eee5e51bf08fe33f83bd6e5d8faa253a21
SHA512 45708581a208e1406897c70159d2bc429b14a3dc9c54a1aa21513d30c5800a46143d3c23896c7e3a9fe342ec2db87965283c22af10580513ef782a0a1edabb56
SSDEEP 12288:2AwSfxL/2Dc3RDLLmt0LDQewsAjJpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjU:L0ewsAjjKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T1F665E031FE75D432C3BB0DB21B36C706542DBD604BA11AC3E3A89A9E59341D2637AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 98c8904c0be1e5bc64bf9cc41475aed6c07a29d5fa9974075c88bc8fa4120fc8
MD5 c718d2f9d9989898ab53c9a851dbea9a
SHA1 d184cd427e17e63b7748c1e725892938720c0e69
SHA512 4950b73ac60bb01f707c0bc4c7e0c263d3c0b72bddb1e588f9a6859e40c14f2999c1f00a958398685ce23eecc3b9fccb9697e217d56113642c45566c4e639e36
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHbHe:cUEtQevvqc2W1cpV2tI32j
TLSH
T1B9474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1d1f321b138b614b1aa1b152d211041df8156ec8a88a50ffa581e8d2d70d1c86
MD5 195940fc638ed4771fd1aed783112d98
SHA1 62e1d810e792ed7867dd9c175cc007b79a6a4918
SHA512 a834a654572487ddb0863b6e811ab90d6b0c1fa9cf3cd78f8e3bd190ace44b9652c78c896a3ef706df66d1b013f4ec6d3afb0970defbe7baf25951e722867e1d
SSDEEP 49152:OCbRquA/m2yL5zQfFiV+XenmE3/zDKy9Lk5Fp9w:joqtVjnmgKyeS
TLSH
T1BDD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1c72b82003473e1e3b76c23491d4edf7c59cfc5dfa1deb2881e10fb2a0205f37
MD5 7a3a2c03c7c469b2fdbce31c195805ab
SHA1 f7e60bcec417977e41b3037f9d0fed6fd50cc4dd
SHA512 d6705605d58ea371a428057530ee9cd60855b49d23135a646c7cf79c32b9c26292599629a7da4aec448442a98d68accf0045921f606323077c768e0b0fb84388
SSDEEP 24576:4AhGL3IFoiwtA5l7S53AKy9c4bAT00FBGwOXKFVsDQ2:4AMUFoiq5QKy9Lk5Fp9w
TLSH
T13135AD81EBF945D4F5B3AA7899B68171EA76BCAA5E31C20F2150D11F0E37E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 53358dcd06ab62fcc0fa55973e5f49bf7013febcfd54f0a7967bd218fe254a56
MD5 a5f659d8c74f06fe3417c087d73f1201
SHA1 d96336f3f42dc9abad0d757458ed630b8ecf9114
SHA512 4c759d0c9d57b57e208f0c88628bf1ec714e0509998b67fc92ac2b0032c9a5d91553093f8ccd7b24a392ca4d6e8bd8a9a1f65b78fecd76265387bd96e646db82
SSDEEP 12288:Cmw5HEjsChNVBFgl0WDm+CypKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2c:bwu4OWPKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T1C065F14A36A50CF9EAA75134859B8136F7F3BC122A71CB1F1360C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 abfa59f8a17ce9084e8ca28f5c0ac4f0b0c98eb15cd445c5c5103fe160e38851
MD5 59a28b864730c08888a79b42de42da21
SHA1 091058b05b7eb3edbab08409dcee746220d06b8b
SHA512 d22c8971e340e61fb1a3c0adbf13ded400b1a6a76e8c61f55e75e60951bac627ff29d589f9c984b4bf82aa1141bfb919860d2cdb70e6c691f3efedcf429b3919
SSDEEP 12288:z+eZ1IyZpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:HZuCKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T15E55124E36D520F9D2935234C4FA0289E3727CA627B147CF2154A29E1F3B9D59E3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 befd123a4b1330144d6cffb6bfbd93f0ef5a7901231cf85d2bc1e681353dbe34
MD5 c5fafe8055e0411dc30a8d39814729c1
SHA1 44055ff9201cd76b131e46174f9ffd7f396ddf4f
SHA512 7fcaa15ceeb7d848ee69e92dae7351cafacfdba3aa46611d17f953909cab47b9e636f8174638bc152fde1edc6f16a0df497d27a831a4abeeb579e4b4d2580370
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:NQRQyi36YOcPbLvw2gAf+PN3FKyeS
TLSH
T17E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ed9885b606e0a9d6a13295999f4208de599f153d976ccf0c008df57e1b772767
MD5 2236f4cf063d0360a98b48311fd9cbe3
SHA1 d2053a9d5db70009c752033ca957d00e69b796be
SHA512 795cf9ade4c48fae09f0d16c352d4b9dee581fac260a49236ce9eb0ffa63434e1997bcd5c7cbc2cf17a829a2b2fc9dd3d58fe5a52d95e612ebe0ffdce8d08641
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:7QRQyi36YOcPbLvw2gAf+PN3FKyeS
TLSH
T133667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 34442e9541ed0b3c6abef7c6660602e33ea41a58e40fcf1029139392e61f7e38
MD5 931a204c71cf8641453236f5dbe031bf
SHA1 16e6158e12ed54e02a73a928f2df3c2a47b97d70
SHA512 77c3aee996f69d475ad1cc6a2094c122c29c4282d89bc3013c2f4c6b0f8b9f8e36c6ea30dfc696665dc5f5edc7f82341f33d9457f0490cbce224e1a8fbca47e3
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0SKy9c4bAT00FBGl:968Qg55nhceWu7PNU3/zKy9Lk5Fp9w
TLSH
T17FB55A33B2F60099C44DE1769F4A872196D27C758FE0E7DB8115720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e491c9d92179b306fe56677885861ff9d763bedf81d4fa9967a861217fc2af0e
MD5 78b3d30b76c609c66b197feaa6f70436
SHA1 4a6da974136cbb4d0d3461fd4a840c2acf920765
SHA512 1f1f7707d69cdf9484e958de2adeb96c30b65c978f92d3b6ede8551a214dd50ee0c42ccef626542e4efdd5188815e91c5bdfbc3f14577efb40fe6a740825fb4d
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99T:ay5112gYy5azzVvt69nLKnhZ+KyeS
TLSH
T1D7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f1780cb80937ec4b653d581fabfdb6de8d5f54d15db28c9e9622cc0a9c04558a
MD5 d7bd77d4b7b741c4bf0749087c0cb09f
SHA1 0b8739ee5f6eff6371a8562acd265b93bd4d8f29
SHA512 7a8cfdcf5de841888d50b4a3602205ee44740cda78702e635f5112b11ea157ae386aaddbe7c1e6ff0cdcc7b0c6ed85fa332c85e4940c6259affa0e02c7ea2889
SSDEEP 49152:SB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gltKy9Lk5Fp9w:gu6Jmdxd2dtKyeS
TLSH
T1E3D59D13F1DA01E8D05ED478974A9233E962BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d177f4b271a63698fc053807a999d958e3ae95504508fea83e5de1bcef36ade8
MD5 9d9daf061444270fd918c3aa45a14bdb
SHA1 0c0d8e7f59730799db8dc23bde4217b8f4fe4eb2
SHA512 f991ec8e4aa174ff4e8e8fefb68e07f2699dfc70c3435418b181aa6b035369be0d91c8da13e7685369f29a29da4a6fbc39ab50e0d45e630e0ce95742f22027d6
SSDEEP 49152:W1hpsNoJpF1A63U44CwH7R4xZKy9Lk5Fp9w:WmifPWRgKyeS
TLSH
T1BBB5BE13F2D901E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 385914396dbb9d28410c9706dd9d4ff70919407a47aeaddc3f9c78500902a74e
MD5 e1dc425f65461d2e77bcb0b562944a9b
SHA1 8e537069294b2dc0e1f185bcb98bd595ac6b0868
SHA512 4a5c3c3097ef02376e11e21ddbc915418d44f604f3531d3ab91f3c55dcaf44c39d112cb2e86e17a4f2aecd0beccfb9724f57a01d72c45002ff89efd87da6bd9a
SSDEEP 49152:ISuZQIY0Be2KcRVtOnks6NMHqCKy9Lk5Fp9w:S5dKii61CKyeS
TLSH
T1C2C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6b93dc21536c414eb7a27f622070680b3ca7088574a60e13cb7f754ac728286e
MD5 3f6e696723e0e329edfb68a880465b6e
SHA1 c63c4d33ccc6028eadc51a401afaf7694a9c8c9d
SHA512 0ac4fe7d5a62c63c8c829020d6720ba6c1a8979b8d4a1876232a32ad0275aabbd6a2227cb267628c8c98fa2df84c4c3ec607eb1d1bb7388956100c7cf96c2890
SSDEEP 49152:phtSn8EApI0fig3giDn0AP5wdKy9Lk5Fp9w:YX2imphcKyeS
TLSH
T1CD95BE13F2D900E8D05ED174C7568632EA62BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 db3d4cbfd2f56668635d9bdff31c4766a983ef38e59a20336b072c0e27566127
MD5 f543ef334b6d5a1b7bee46d8a7425c04
SHA1 6a9e6c61e408eb9c0ec57bfed3b0c95fafebe30e
SHA512 835a5772d4a90f80f3ae679bc78ea259ce8b3c28532c4fb00f051050edc9943eaf59eb277a709a738f32eb3abab04ac158edc48a39ab032ef5ff4c9e4bcac0fe
SSDEEP 12288:B8pKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:BGKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T14C45230F7D8789D5D645217180AF03C9E462ADEABAF14D67B088F24A5F7F89C812CC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 85a2158dcbf95ab4bff05e0a93093a85203bb59330291f41f248c6c0ffa61242
MD5 a1faf63a2528ab8f932d6b1fe7bb69c6
SHA1 4c22bd4d2d5cdca2e404f5bf2ff838db3c2f9358
SHA512 d6d42ebf1d7750b52e40ceace3d37013f06274ce9163b174482e91a7caca11f4331e740744a39ce689246bc73abf74e526ab2e7b0a2c318a3e13f7f34d09452e
SSDEEP 12288:xlpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:xHKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T1D845230F7D5749D5D645217180AF02C9E462ADABBAF14DA7B088F24E5F7F8AC812CC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d41b6f7ad961a52206f302722efcddfded25da0937fd23ff2cc588ea9b5e629f
MD5 c63f5058b5990d6113ab5e3196c1ef6e
SHA1 8b49f84b120e2be495304fb8bbe3764ef7624c65
SHA512 54363cb9c1837cee297743f5f11a3528cf836c114d49f00f201ad0b80952e992035e1d5a16b560138f2439d852304a931e7fe4a2a8a2fcf9f57df199942a904d
SSDEEP 12288:A/pKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:ABKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T15D45230F7D5789D5D645217180AF03C9E462ADEABAF14DA7B088F24E5F3F89C816CC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 fcd2aca0a2a06af46c2ddd97e6e4916c28762fefac976a1278c46c704f5779b0
MD5 69598eedb0cd5e385effe77bbca896b6
SHA1 3cd6d77951a3a40246dd576c6923a07704b45126
SHA512 d94d9a35607b01203d2c5bc05e1bf8e4f5b1ba069e3bf3fc8b492e4961e2e296e202c7dfa15f3ad11927aa2228164f16f1b7af5914b6fbba3b96063ba0218b48
SSDEEP 12288:RVmpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:UKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T1E045230B3E9745D1D546A171C0BB0289E0B2BCEAB7B14EAFA144B64E0F3F9D8953CE15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e4cc0d658cf38908ec01dd00e9a4c4d4b7ba8a78ef0475b67fae07ea2a22166e
MD5 be025def792835f1d019d0758fe4e84b
SHA1 9330a0b5576e64f61d6b5435bcb399c3ade49626
SHA512 ece5234c20971663a44579b672bce92f33cca685c27ff2733b6e13570242e4b76ca910ad2e311be582e37191bba4e163f7c2fbae9c878a8ac6afaa73fd20c32f
SSDEEP 12288:9epKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:94Ky9c4bAT00FBGwOXKFVsDQ2
TLSH
T18E45230F7D5789D5D645217180AF03C9E462ADEABAF14DA7B08CF24A5F7F89C812CC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5c932f5c76ad5c873d6d9c7bddefbd5a4c95f855d099360b009b38419d52b213
MD5 5f662e0972ffbe1a6c7ab57fdbb5c30d
SHA1 58ec03a757c2d86cc21f3f14ea42458ba3223325
SHA512 3a7c9cbb207c4a48402c3eca7d37d5ea4addedb74740e26cb8fe44c7d77dca0c642756d0e657f6c70cab4025c519fa6032aaf1b8643ca51e7cf94f51ceaa0af2
SSDEEP 12288:rRpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:rLKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T15145230F7D9749D5D645217180AF03C9E462ADEBBAF14D67B088F24A5F7F8AC812CC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ce5cf152032e936c911b2e1ac92abd774000afce4a4dfefa476a4a41872054df
MD5 029ebc1f85e212616532958d66540041
SHA1 08c8d7a6502712781d6dea35032a4415ac94234d
SHA512 95aa2181bfc7cef5a7ccee2b070df750eeca555cdc353c11006e04c71a117e48c35b7567f0ef3937f3eb907d6b18b7f6f3f8b3d19218c1062e4d4b99eaeb6cce
SSDEEP 12288:B9pKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:BfKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T19445230F7D5789D5D645217180AF03C8E462ADEABAF14D67B08CF24A5F7F8AC912CC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 fb981e57bf85a9f043a94b1f6059213d435d7f25043e831906e3e15d1e453f95
MD5 cd403213131faf6e6fbb326318f3923a
SHA1 c1e4dc1b3f03cc21194ee31bbc79c8bc534f60ef
SHA512 6b1d2f647f258b3d10c7cd8e544dbc2a7d6c0dfe39495c920bbfff750e8724288c5666b075a00f481df19c7aa24f67e5bbdfb6a322eefcf0e7c220a52f1184cc
SSDEEP 24576:uZMRzFVSOnKy9c4bAT00FBGwOXKFVsDQ2:uZMRzf7Ky9Lk5Fp9w
TLSH
T18965019973910CF4DC67813AC8664946D1B27C6A1BB0CA1F13A8366B5F373A11C3EF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ca33cf3c62b127f084eee53404ddf52618e03a353cd494dbc57b99c8d3b5d135
MD5 fe99de7804c2a09ccb6ab2f6543699ea
SHA1 3d7e004f66dc1e1e91894acb9c90edfbbde7be70
SHA512 0df34a66fc2d4de2ad607f03b716bb49756d7c120a7c0927534fc402c1b174409ca6dd6d7cae7810e91cb9fd67089e548d116f8029937c840e315f1a0211455b
SSDEEP 12288:TgpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:TyKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T10345230F7D5789D5D645217180AF03C9A462ADEABAF14DA7B08CF64E5F3F89C812CC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c58416d9585a146f8b91b82c368c2c6b1bb1cbdb02ab91cc5dc4e610143c8435
MD5 f47a388a80774c193abdc734784c8298
SHA1 bb58703d1386b5c06c664850395a5917d1b6d0f9
SHA512 27fb143af1d9aa52141ffbbf7399e4791caab81893d0b602a6c26b45a377bfc35790fd0425f89dc112ace3790e2fefba49f56304bc459026e8fd42d812be72e1
SSDEEP 12288:FkpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:FuKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T1C945230F7D5749D5D645217180AF03C9A462ADEABAF149A7B04CF64E5F3F89C812CC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2e09495bca4065f6a840762efd8d8451aa733b3fa8a0bf1409f752f3fcdbd6b4
MD5 11fa735c4f82a2df489b24c127a167b8
SHA1 f9fa2e4772c6c84dec4c08c5d0e67fac9cf57840
SHA512 f27c526d7e150a330edae1be8335d14e6b95d2040a9696411d155328db646d04a24b474b9c2840f346cc066ba80a74a52235acb335b527f48359ab0d0deff8cb
SSDEEP 12288:yyPz5L8ZpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:vzyTKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T17A55120B77A220F9D1665230C4A60A45F372BC7617708EAF5394577A2F3B6D49E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c294b36d541fa3ea54b0d92c39c5b0f74b33ed458ab2c8102950d16480bf2ea1
MD5 f7c3e9139727c8e2998c050351e6d7bd
SHA1 5af16a8318650d4126c44b7f0b3bfc4e6ebd1805
SHA512 df076be1e2491771479e0b24f99922f48e7730c292c6f40ec646296e4743ca7e1c596f79defd6a84fa47dea86f5f3a69b3332566b19b86c71537dc1c4262b70d
SSDEEP 12288:RgpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:RyKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T14145230F7D5749D5D645217180AF03C9A462ADEABAF14DA7B08CF64E9F3F89C812CC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e95da1f453046339ba10c1f5e58f9a683c70bd47cae5810c7feabcac6a6e8e78
MD5 ab73ded323b599a57a583528b383fa2f
SHA1 4760cb0fc2360f4bc38160c78366f13178449755
SHA512 013d9deff9420b9d1ff9cd4fbc8023f4487317fbcccc2604bdd1305720905911ae487244dcd5dae9d7ad669e2557995c9a7f81c74dff9ee31d042e58d5bc8d6b
SSDEEP 12288:jgpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:jyKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T13945230F7D5749D5D645217180AF03C9A462ADEABAF14DA7B08CF64E9F3F89C812CC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 6cb4ce2d4ab3dc9aade378dd2bf5e9587da88f9974577127975f046b64bca254
MD5 be2e55e0fa8a0ae607b123f1de1c0942
SHA1 6f0e0c92b909f2cc70ce70a5c0cb50969d7fdf76
SHA512 786e3eb48c1790e0ee9029c4af3dda9fea7d2d6bd0ba2acdf505198f88eca8e6fa569d753fbbe9cbe8b9c0d3aa220665743f56e296a71002f20e017e26089ad7
SSDEEP 12288:vyPz5L8ZpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:CzyTKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T17555120B77A220F9D1665230C4A60A45F372BC7617708EAF5394577A2F3B6D49E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ef528be0a7c3209a7ff1ca7675436c2af493e57fa69c6369eb79424702c00dc9
MD5 36689ea4bd11aa8b3f530ddf44bb929a
SHA1 fd9a212d4e4a6b98a420a6a8278563d992205643
SHA512 b9bbbf3e0becbd2da68c0d682be1d021a7353f67421441b29bf187c1ff83917bb67bbaf71b85b43e5d05e9299809cd7ad36ccd1e125c0168fcd26ff9a17a3c04
SSDEEP 24576:QcP4mcvIjkGOxhKP2l71nNKbrh/8KBqKy9c4bAT00FBGwOXKFVsDQ2:7P4m4IpOO67W8KkKy9Lk5Fp9w
TLSH
T14065AE2DABDC0096D0BA917485658A49FAB1782E2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4911c5c0184fb6601c2b1e6a3927bf4107a917e4417b2daf1210c385efbe1ea1
MD5 63255f6f9a3b58642037a17a658c87f0
SHA1 87cad8f230a92d059732b8b125a4ba0c17f928fd
SHA512 c1056584ab526b228d182ac0880a1acfd94adad385cb7cab32dd74e958f57f5ea718e9954b398dd603e9b02183d4f054d6b57e8d0f6abd1e840a960149e0e8d7
SSDEEP 12288:2bsfQpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:dCKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T18755F10AE29902E8C16E6171C75A0685F3337C6697F1C7CB62C0F53E1F7A9949DE9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2c793c8ba31a4d600dac068a482c3fb1544c0f9aaf1b7512b791ddcb6674efd1
MD5 6afa19b7b4c98ac069a37f46b4d72f0c
SHA1 8189a9490e5425e0e1f9de6cdfbf578a6a0ed986
SHA512 66db428e7a4ea479bfdc8966bfadf155cb6dc014364409d22ab0682931b0e0e121b2041f946edb9742746b7506228129e69b7e5bf095228f0fb128751b2edcb0
SSDEEP 12288:PwpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:PiKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T13B45231F7E9B8995D6952570406F0288A027BDB97FB08DA7F048F25D5E3E898C93CD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1ca258d26bb216e47ce4781fb316b4b0dc6d2b2e53c05eb020ccb55c7639667e
MD5 0f5f874d65914618644f62a1a515105f
SHA1 e7e727281ba56ba705cc416fc5b37dab812967f9
SHA512 6bf0beb9a96691ecdaee2e68516843f8ce3c36738c23635b2c852047a43c3c78dd2599396a953650183155def9fcc1e9f0f6a86bdb7ca7d9fa703b2fbbb6a89d
SSDEEP 49152:ha0h2GEkuAe73q3pp46zwwQ4Ky9Lk5Fp9w:ha0hNYG4JwbKyeS
TLSH
T15285AF1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 dc37c54847bb3ca79cf8ccd92e5f498d68cf7057d6fe7019bec423ae3c0f3bee
MD5 cb8e2bad550db665a2c6e194655ebbeb
SHA1 5d0f0b7a8094159c2adbe5edc3c1378981fa4ff8
SHA512 273aaf8772aeda86604f08a023d029c4f7746ebe687da696af576ab1aa455200194ee869581c98fa711508314413304b878adf5ae2cda6984c69d2f301a2871e
SSDEEP 12288:6hbHjfXVpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:6hbHjPXKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T18F55127E2AAD10D5E271A1798096424AD331BC66272187EF62C5D27E4F3FDE84C39F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 6e77627113b26683d008c5d6a6c203290648be7c7fdce54ac7121461f41993bc
MD5 20a0b23c99d3665c2428c3db683a77c6
SHA1 e9bb93ffae57c934cc4331b7d1a91e578f4722bd
SHA512 5aba42fa9a8e3bcd05fa5e4ce3595d48b9dff93e1f03cb535f5593fbb6c378f1d621458afde45feaad11c2f0586cb81214ee131c9e21453ac0ec6454f2166613
SSDEEP 24576:53YgnJcRTk4yti+R5dBR/PKy9c4bAT00FBGwOXKFVsDQ2:5IgnaTk46pBR/PKy9Lk5Fp9w
TLSH
T11D45BF2EF2B910B9C8A6D136450147B5FB71782D1F209ACB0174C538AF1AEE89E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 a6c085d4ce18cc4a5034a5d5fc5bad7d4a9a7c43bcdc88f40807a1b783f91e49
MD5 0ef4764e58a9eee53d3e85730c654c20
SHA1 0a7fd2051182e1e73a3b849e994114f69f14fc81
SHA512 3ebb50c644480265c1e9865f72b632398d8514bb05abda7f6378b1ce57b2762fa43d44927822e343f8f0b24814fe354494d5b99d9c5994a0ee41291edd7317a8
SSDEEP 12288:x0pKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:xeKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T1F845234F7D4789D5C64525B140AF0389A022ADAA7BB14EE7B088F25E5F3F8ED853CC06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 68a0e474cf9d06967ac7883765af20606fca5238701c5acdfbd219c803310b71
MD5 98cc0bf9b47fa37c5068e8793cbb7cd1
SHA1 c80f6666f1d1eae5ac92682d6a59047e18f39e3e
SHA512 1729f454818f82e6d17fc5630946a3f2b5e48f722f38d95e340a4be4322ccc889c034766c669cdd4e3ab8df8a85a6c2dc48d88479e7e478d7ad7ec793c7627bf
SSDEEP 12288:EObfA4LWOsvAYFTDpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:pbL3UTdKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T173750119F79500F9E967913CC4A78616E272B89D1360EBDF03A88B591F336E54E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 0534a9099bbbb5479e31498efca561a78ce1ed554e4ddaee5c5a0dad0bf66596
MD5 6e08271f7579420efc38d0a2850bb396
SHA1 aade5dd590acd67f74e9331b5c804aff0b19706a
SHA512 d1f7a31a555c8ecba0b797752b55847e323b7421c2d035f063e73ab867b3c8cae2f088d9414b3cd931996c3dd704674251b690bb0d9a3349a9b7b055a30bac65
SSDEEP 12288:FpFtIO3pKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:UOZKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T1FA55021E3ADE10E4D166A1388597434DD372BCA617614BEF42D091BE0F7BEF89C39A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e2f9a617792bc7eaddf745615f87fe53ab79572124d53af034fe14ba8d76d0ff
MD5 ffd0a69058c3668111ee53d0aa1afcc8
SHA1 3839a2711500fd3056266dba87f1a7df950a8db7
SHA512 f01de3845a88ebe51305a8aab739d13065b909220b9e45841e86ee2611f16cef152a277821b0d42e1dd0ef6dbc02f92f4ff9b914a86bb7b5b27bdb5e54326331
SSDEEP 24576:r7NM9YqZqmWMUkPjZM48Mv6bEhsyKy9c4bAT00FBGwOXKFVsDQ2:r7cBWMpPjN8DbEh3Ky9Lk5Fp9w
TLSH
T10D65AE2E6BEC81D5D577D13DC9A28205F6B2B8611B318ACF1152833E6F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 45dc86357da38262e2329bda7cfef2f7477f8ce9f0460b1b9e89fad0714a3902
MD5 1ba03aec66db7595a6def36008b1581c
SHA1 8c11b8ac5d7f9710031735ba32e1bf85055e29ab
SHA512 9b1602fd5c3beed27f6b47b77d037d2567718f3a87796bb4779ce933206fd00a44008786fb16d5516ddd0b243f7ec64a10868c991b1c9c805804bbdc9580e6dc
SSDEEP 24576:OW6BApg2YuyuNDYTabvcdvNYf8km1sKy9c4bAT00FBGwOXKFVsDQ2:OF2YuHNETovAvNYf8kmSKy9Lk5Fp9w
TLSH
T1C5858E2A27ED80A4E0BBD27D45B79246FAB2BC511B3055CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 52ebd24aed30a4bda6847f20ae7c7ab8309973805acb86029b875e03b97d26f9
MD5 7798f7f6d289fd4a40e3749b607a7576
SHA1 43293ad434b34f9a3d70cf1c9fd74676ae045635
SHA512 4f8aec4c181f3054213393f3ad44ca7f2cf64c4bdd91b22725b30e2fb4bb199ff246644e2a09c7eae1aadd3634e8b9c9002d5a8f16dc91cb8f5df3508534cdaa
SSDEEP 24576:OAFs06+OmlfkNXEbTolKy9c4bAT00FBGwOXKFVsDQ2:HFs060lwXuYKy9Lk5Fp9w
TLSH
T1A265BF2F66AC00D5D07ED17E8997C91AF6B1786307215ACB0160C63E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 74c2fbe28c559eb4c8f3470d2c3aed02ec128ecbe57707882d260dbd4d85d22c
MD5 23b312a027d1e2755330b59fd6135d8b
SHA1 326c1e886d0d6161e12b7008569917c7909d2dfa
SHA512 097550ee230be90e1119a582294f11be796534ed485d1999b2328a8f80c9f3cbd6d33a67a658bc695bb542d7a986a99dd1e9035d5de34a0f0bd0b9304f19ce48
SSDEEP 24576:7JnJ5D3WXYKy9c4bAT00FBGwOXKFVsDQ2:7JnJ5DGXYKy9Lk5Fp9w
TLSH
T18E65D02DD2A810E8D4B7C274819A1786FE72387D2F226EC724B4D5353F26EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f906d0b7de031f3c63287c57277c99e9e9e500ae5da15ac135f553846e595b5d
MD5 7fec942a067eb9ea1c0bd38f0899835a
SHA1 9b601604c328ab4aead6db5cf885f54bbd1b5162
SHA512 fcc317f692b645e4a06635c24fd278f248ae775200604c1071716788e80b6a58c0bf1ae228a6e774e60798c84ef9b6ddc5a2efff37480845df543dd1738fcc20
SSDEEP 24576:bEPghm6/7IIXdwcXrif7qQncjlP65i3VuPKy9c4bAT00FBGwOXKFVsDQ2:cg06DIKdwc+eQnSt65aVGKy9Lk5Fp9w
TLSH
T116956C16BBEA5294E8B3CAB1C96291159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 44f4874054b12693dfa25b60f900cdb22d1efeb5be0e432ba984d6a0aa7f999f
MD5 bf7d947fd2ff2f5c64853f51de4f38e2
SHA1 d5eb8962cb14f45934da91e3bc625083ba18564f
SHA512 05a004e9ac3bc557be2c56f81fa9c7aea72fb5c843a00c3e6d27d36986529d9f4e9a9efad918604d6e70174a0c17c5573465c79be0d64c9654d872aa9d423152
SSDEEP 12288:iEP3RnypKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:hnUKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T1E755125E3B9E60E5D126A03980A64249D372F8B52B621BFF51D0D23E4F3B9E95D3CE01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 699dce78210e8e24d76d8c7d21f35df05f2bcb05147aa1a89e3eb0e65f86a5f3
MD5 e378237f2a8a563926f00a2088a27415
SHA1 e4935a8a77176bcb50a7993132b6087f57021dc5
SHA512 cbe49b2c890347761157d95d54ac81dc8b7372e9ae295502e31e9702fc318e433998667e2224ff59397c4922399f6dff5dbbc65b4aed2426f697b2e6ca3e9708
SSDEEP 12288:DjkylpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:DIyHKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T19E55120A379594D4D6A6123485B702C49931BC716F314BEFA080F73E6F3BAD8A938F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 d6564140803903fdf82c3ad2893b66cfcef073dfcf1fc8de5d023e20b18abbdf
MD5 c27808fc400912f9bffb38f7a609cdaf
SHA1 7e42eda11d10c2828a2860afaf7f2eaf80e0fac0
SHA512 d0be12f18e4720e660ef1e999cb2af7d923d26b736447afa2aa3704892be1e8f31119f0fb07b14e162f7d8a8eeb3aa1dcae81e0a1747e673875078a2a2e3d9ff
SSDEEP 12288:oyHpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:lJKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T10B45220E3A5759D5DA462171406F0389A0627CBA7BB00DFBA0D8F67A8F7F8D9913DC06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b9529b50b925fa26b7c091e5739710d118a3be7f41d48f18ed14c2ed2fd5a35c
MD5 a8a5631ea1223b584fe113bd40792a78
SHA1 0352dc5d63b05c0a897c1d55f1e9f9ff9e0d9308
SHA512 e25eabf2401dd9613bedc190962e4be46f40093c263b5d8a82be0507ca39749b0a3e4e94ae437c95489505395bbf7cd21b2551d25c17c7ca3f4a9fb68a97333a
SSDEEP 24576:KQ9MxZKdcz9dw36Ky9c4bAT00FBGwOXKFVsDQ2:KVKZ6Ky9Lk5Fp9w
TLSH
T139558D2DABE9059AE177D27594A250C3A673B4311B31C6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 947b4383ba8c9a3c570dbb27eaaafd01e81ae4053a4a4a7abd021099140d61e6
MD5 45f08f81e19c91d31bb08e05ed25d6d4
SHA1 187b65faea5d9afd1213cc68a0b1d624490c7d6b
SHA512 94ef8d8f06a9e4193c82fb40bb8858ffeac263ec9ff391075960f71f05bf5427be7a92e8b563913c9671021887297697487eeadf4737f3941af60905d368de2c
SSDEEP 12288:ryoKo2JRple9pJpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:ryocDApjKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T12055E01FBB6A40E2D166913888868345E773B4706B6257DB6191C33D8F379EDBD38B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d0a094eb18cc272685cc4f7119ff0f4d85374b6cfef4bb014ad3eeb317abf451
MD5 05897f1902bcaf13c2048d3bd3c4ef94
SHA1 ea9d742cbf6d1cf927fcabb13bcc7069faf4e0c8
SHA512 45be578d8081717d0203ce8f6f6d9b0c97f851e4c0b250bb7bd893d73b0129add3fb021d483ddc95b3360aa328bdaad2540a278ae106d27e2a882dd0a3e06745
SSDEEP 49152:bWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKjKy9Lk5Fp9w:L0zuNIdKyeS
TLSH
T192A57B3DA2BC00A8D9AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 08d54fd625ef103dbd9369bb7230560e489d9e5e99a8cc20ff912a0889b176e8
MD5 5a2f0584746cddce20586759926222ed
SHA1 187c0191966a4cbea55ae300fad5217508e8123e
SHA512 9dd73917e784711728ea163637ef69c34601a0144275dbba4fb1316c733b32419b3a77c307957ccfaec29948a7c3713a55edaa6618922d984649e73e24966f0e
SSDEEP 24576:c1QT7EcpfxR+N5AWAz3ooiYujMqbUKy9c4bAT00FBGwOXKFVsDQ2:BTDxR+N5YzT4jM5Ky9Lk5Fp9w
TLSH
T1D655B12EA7F915E9D17EC5798A238502FA727861033193CB42A0C17E1F7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.4MB
SHA256 b031b9668ed3acef274bc5fb37076e53fa760facd79e8ad9d00a25cd34fe243f
MD5 c64940a0bee2c30889b4c84c1e689273
SHA1 acad785a1db255b37edc1ba74b3a7dc6b74267d4
SHA512 3e0decbe4a9cd8e399b6e16fa1e87c3035e88cdecf79d6b60ae118d1469174cb4c1773bb8b65e4c881eebcf11f70841a30f6364c5d136bf02d5544a54054008d
SSDEEP 24576:tTMdOz0FFS+bmSLgKy9c4bAT00FBGwOXKFVsDQ2:X0K+bmSLgKy9Lk5Fp9w
TLSH
T1B065E13EA7AD14E5E57BC27C96538A06E572386603216ADB0290C17D2F7BEE4793DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 d229f772ddcb2b70d6a5da48a03807ac1c2917a5c8cfc3b9d2d0c4e03c5068ee
MD5 9328cc8f566dd59d92639c00e90e89e2
SHA1 08ef9b767fa314f5ed9e1ed0497ad9a778aff3dc
SHA512 4ead2d6858c4de741b5ce790c7aa1a91c222bc0c6e0d676362c10b0322b8f20a9d7a3439f5b1ddf7e61155a9ced5aebf056202d18cdbe7137ac217ffb653f9a4
SSDEEP 12288:Q4KDpKy9cjGHbATBYzurTPR083jaHQgAirqbQKjBVsP2EQinQbq:GdKy9c4bAT00FBGwOXKFVsDQ2
TLSH
T18A45120E27EA24D4E5626271857B02899131BCBA27704AFF30D4E67E4F3B9D8D538F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/528-160-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/528-383-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/620-224-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/620-176-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/620-201-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/620-464-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/620-185-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/624-151-0x0000000140000000-0x000000014020D000-memory.dmp

Download

memory/624-366-0x0000000140000000-0x000000014020D000-memory.dmp

Download

memory/680-62-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/680-69-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/680-56-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/680-65-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/680-67-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/952-94-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/952-88-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/952-98-0x0000000140000000-0x00000001401D6000-memory.dmp

Download

memory/952-162-0x0000000140000000-0x00000001401D6000-memory.dmp

Download

memory/968-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/968-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/968-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/968-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1144-34-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1144-40-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1144-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1144-133-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1316-1-0x00000000029E0000-0x0000000002A46000-memory.dmp

Download

memory/1316-6-0x00000000029E0000-0x0000000002A46000-memory.dmp

Download

memory/1316-0-0x0000000000400000-0x00000000005C6000-memory.dmp

Download

memory/1316-85-0x0000000000400000-0x00000000005C6000-memory.dmp

Download

memory/1316-390-0x0000000000400000-0x00000000005C6000-memory.dmp

Download

memory/1316-8-0x00007FFBA78D0000-0x00007FFBA7AC5000-memory.dmp

Download

memory/1316-394-0x00007FFBA78D0000-0x00007FFBA7AC5000-memory.dmp

Download

memory/2148-97-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2148-17-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2412-437-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-371-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-370-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-373-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-374-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-378-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-377-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-379-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-382-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-381-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-380-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-376-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-375-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-372-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-432-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-434-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-435-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-438-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-439-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-448-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-449-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-451-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-452-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-454-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-369-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-455-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-453-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-450-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-440-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-441-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-442-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-443-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-444-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-445-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-447-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-446-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-436-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-433-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-367-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2412-368-0x0000021196320000-0x0000021196330000-memory.dmp

Download

memory/2868-111-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2868-29-0x00007FFBA78D0000-0x00007FFBA7AC5000-memory.dmp

Download

memory/2868-117-0x00007FFBA78D0000-0x00007FFBA7AC5000-memory.dmp

Download

memory/2868-18-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2868-24-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2868-26-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2964-76-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2964-159-0x0000000140000000-0x00000001401FA000-memory.dmp

Download

memory/2964-82-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/2964-86-0x0000000140000000-0x00000001401FA000-memory.dmp

Download

memory/3144-138-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3144-351-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/3144-144-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3144-148-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/3204-431-0x0000000140000000-0x00000001401F1000-memory.dmp

Download

memory/3204-171-0x0000000140000000-0x00000001401F1000-memory.dmp

Download

memory/3232-112-0x0000000000400000-0x00000000005C2000-memory.dmp

Download

memory/3232-108-0x0000000000740000-0x00000000007A6000-memory.dmp

Download

memory/3232-103-0x0000000000740000-0x00000000007A6000-memory.dmp

Download

memory/3232-167-0x0000000000400000-0x00000000005C2000-memory.dmp

Download

memory/3332-168-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3332-386-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3364-70-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3364-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3432-153-0x0000000140000000-0x00000001401E4000-memory.dmp

Download

memory/3432-73-0x0000000140000000-0x00000001401E4000-memory.dmp

Download

memory/3484-175-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3484-118-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3484-350-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3684-170-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3684-115-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3968-154-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3968-156-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4320-384-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4320-163-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4984-123-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4984-293-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5112-134-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5112-131-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5112-125-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5112-335-0x0000000140000000-0x0000000140169000-memory.dmp

Download