valleyrat_s2 | 0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/09/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Size 1.6MB
Sample260906-spfpqaxbnd
SHA256 0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6
MD5 83803beb0ddf793b9dc073847cc3da85
SHA1 b71ffc844297a38a88cc761c3e2586ef6c63361a
SHA512 f2a263801b5cf70985b5b3217d4a506b37a9a234b4fc9b8b92a410222e0438b02f0a6b68b0c335e49652c9338f3f7cf4c950318f1571ac3041ad3d04c599ba64
SSDEEP 24576:aj7CD05uJiIfSucFUM8DbpUgkHVUpoijR2:ajEgutpGepoOR
TLSH
T17E754A2C9BA4836FC393613D58A985DBE221AB4583E5715E3BC3350B0DBE5F3450EA2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution valleyrat_s2 persistence ransomware spyware stealer

Malware Config

Extracted

Family

valleyrat_s2

Version

134.122.155.220:443
134.122.155.220:80

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Executes dropped EXE 27 IoCs

pid	Process
1232	alg.exe
5064	DiagnosticsHub.StandardCollector.Service.exe
3400	fxssvc.exe
448	elevation_service.exe
4028	elevation_service.exe
2552	maintenanceservice.exe
4012	msdtc.exe
632	OSE.EXE
3052	PerceptionSimulationService.exe
3936	perfhost.exe
4340	locator.exe
2412	SensorDataService.exe
4312	snmptrap.exe
800	spectrum.exe
2636	ssh-agent.exe
4772	TieringEngineService.exe
4464	AgentService.exe
3484	vds.exe
592	vssvc.exe
4820	wbengine.exe
2116	WmiApSrv.exe
3168	SearchIndexer.exe
4716	~sys_27772.sys
1372	SvcHostLoader.exe
3120	SvcHostLoader.exe
2324	SvcHostLoader.exe
4776	SvcHostLoader.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceController = "\"C:\\ProgramData\\SvcHostLoader\\SvcHostLoader.exe\" -onlyctrl"	SvcHostLoader.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\alg.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\59b825353a3ba122.bin	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\spectrum.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\AgentService.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\vssvc.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\wbengine.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\dllhost.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\msdtc.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\msiexec.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\System32\vds.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
216	cmd.exe
1272	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000877579eb123edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5397eeb123edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e1277eb123edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085d151ea123edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{288EC71C-D957-462C-A808-C0C4E78C94AE}\Shell	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{288EC71C-D957-462C-A808-C0C4E78C94AE}\Shell\Manage	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{288EC71C-D957-462C-A808-C0C4E78C94AE}\Shell\Manage\command\ = "\"C:\\ProgramData\\SvcHostLoader\\SvcHostLoader.exe\" -onlyctrl"	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{288EC71C-D957-462C-A808-C0C4E78C94AE}\Shell\Manage\command	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{288EC71C-D957-462C-A808-C0C4E78C94AE}	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1508	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
1508	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
1372	SvcHostLoader.exe
1372	SvcHostLoader.exe
2324	SvcHostLoader.exe
2324	SvcHostLoader.exe
5064	DiagnosticsHub.StandardCollector.Service.exe
5064	DiagnosticsHub.StandardCollector.Service.exe
5064	DiagnosticsHub.StandardCollector.Service.exe
5064	DiagnosticsHub.StandardCollector.Service.exe
5064	DiagnosticsHub.StandardCollector.Service.exe
5064	DiagnosticsHub.StandardCollector.Service.exe
5064	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1508	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
Token: SeAuditPrivilege	3400	fxssvc.exe
Token: SeRestorePrivilege	4772	TieringEngineService.exe
Token: SeManageVolumePrivilege	4772	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4464	AgentService.exe
Token: SeBackupPrivilege	592	vssvc.exe
Token: SeRestorePrivilege	592	vssvc.exe
Token: SeAuditPrivilege	592	vssvc.exe
Token: SeBackupPrivilege	4820	wbengine.exe
Token: SeRestorePrivilege	4820	wbengine.exe
Token: SeSecurityPrivilege	4820	wbengine.exe
Token: 33	3168	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3168	SearchIndexer.exe
Token: SeDebugPrivilege	1232	alg.exe
Token: SeDebugPrivilege	1232	alg.exe
Token: SeDebugPrivilege	1232	alg.exe
Token: SeDebugPrivilege	5064	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 540	1508	0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe	94
PID 1084 wrote to memory of 1372	1084	explorer.exe	115
PID 1372 wrote to memory of 1272	1372	SvcHostLoader.exe	118
PID 1272 wrote to memory of 3120	1272	cmd.exe	120
PID 2324 wrote to memory of 216	2324	SvcHostLoader.exe	123
PID 216 wrote to memory of 4776	216	cmd.exe	125
PID 3168 wrote to memory of 4784	3168	SearchIndexer.exe	126
PID 3168 wrote to memory of 2436	3168	SearchIndexer.exe	127

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe
"C:\Users\Admin\AppData\Local\Temp\0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\explorer.exe
  explorer.exe shell:::{288EC71C-D957-462C-A808-C0C4E78C94AE}
  2⤵
  PID:540

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2164

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4028

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2552

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4012

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:632

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3052

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3936

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4340

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2412

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4312

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:800

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1064

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3484

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:592

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2116

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4784
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2436

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1084
- C:\ProgramData\SvcHostLoader\SvcHostLoader.exe
  "C:\ProgramData\SvcHostLoader\SvcHostLoader.exe" -onlyctrl
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "C:\ProgramData\SvcHostLoader\SvcHostLoader.exe -reonlyctrl"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\ProgramData\SvcHostLoader\SvcHostLoader.exe
      C:\ProgramData\SvcHostLoader\SvcHostLoader.exe -reonlyctrl
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:3120

C:\Users\Admin\AppData\Local\Temp\~sys_27772.sys
C:\Users\Admin\AppData\Local\Temp\~sys_27772.sys
1⤵
- Executes dropped EXE
PID:4716

C:\ProgramData\SvcHostLoader\SvcHostLoader.exe
"C:\ProgramData\SvcHostLoader\SvcHostLoader.exe" -onlyctrl
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\system32\cmd.exe
  cmd.exe /c "C:\ProgramData\SvcHostLoader\SvcHostLoader.exe -reonlyctrl"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\ProgramData\SvcHostLoader\SvcHostLoader.exe
    C:\ProgramData\SvcHostLoader\SvcHostLoader.exe -reonlyctrl
    3⤵
    - Executes dropped EXE
    PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2e1a05adac51acc6fe88d761dba17379f25afbca6012f04e35c765261c6a62ab
MD5 36ed29bccf309be0d29aacad6e41e1e3
SHA1 c7b0cc55bd99e1b1e936931d40621f724f19d93b
SHA512 68d57b882357f0210f808a7b55a88f25336f7b81bd716126283e0cf5877392d17f665ee29cb0565c262ddf771a2684f56f86b3dfd069ff6301dea102f292dd17
SSDEEP 49152:Ib+632BuPkFKRrdE6ohrstBhuXjfS4LWxnYpGepoOR:i3q60jBH0e2
TLSH
T1B6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 ea3a2cea40adaf7b9d78ac48ba8e2515f9af6e653bff817064bb60cef09a22e1
MD5 3f3e885fb039174aa77a7dab546930bf
SHA1 5470eb3a62845616ed9eedfcd36e5ffe1e78b35a
SHA512 63c6cf1c2565056ab2ff29f3fa208a234842bc91cfa9aac997cb314086d0c0c724985c3803f21194cb3403b00aae22ebda236fe3bd93cf6d93c316d07e8f647b
SSDEEP 12288:F1XLsswWkxy2lRq2czA1zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:LXYfDtczA1M8DbpUgkHVUpoijR2
TLSH
T1D5050128A7D549F9ED67817CC8A28412EA7378950760E7CB03E0997A1F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 434e08308ef67dc146b237c407e64d4289d49a52169ae89e30b9e84a4a4518e1
MD5 865fe10e62a9729c64f25371d162015f
SHA1 c274c9765548fbcb317cfe39efc4d1d04277adf6
SHA512 ebfb8d1e48abeeaad75d60ecec1831c390eb563497b0407c644f739c4b22fe08c9374ef519291518a05e77201f6a72c86f3c65a936af709d3bc491e0a509342a
SSDEEP 24576:H0Le5ji0hmxNrMGM8DbpUgkHVUpoijR2:HPji0A7lpGepoOR
TLSH
T116359E56F6748331D073C0B9C5D2A69AED7230861B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 298a4ea4d3d37f7995ce1e8e7992dd3363aaf0e4fb4ecef8a00e6e9c412c677a
MD5 de6e24bfaf1afccb74040926b21e56e3
SHA1 32b0959c11efd78062798c2f8c59bf9a690ecdff
SHA512 66938f3dd9fb9bd1d385c29e1641f3768ef29dbd32e8f044acfb34ccacbe33946ac3bd3a3a3463108a1a438e5de2e3e86ebebf8e8ab4ff9bff8a8721e945dd57
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWr6q8wyucM8DbpUgkHVUpoijR2:u/ezSC6vUzPviHjyJpGepoOR
TLSH
T1B8755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6f9ef1ef72254c5f15d8964185a9ed102342bee398f3728b8db8742b91a54a6f
MD5 cb42efd8a46ee55f3cebe9ba8b83c929
SHA1 2f92db8e1838c30e06e56745ff5a00ec061a2f9e
SHA512 2ed4cd773a8fc47bfd057836ca622c6c0ff63767f90c6eaf3be5e98b10c49a92d8ec90e02d5081e3b04922f3a226b0c916effd6fec19649bb22c751eb2e3471c
SSDEEP 24576:zVbqPb88hv/l+bJM8DbpUgkHVUpoijR2:zVO88hXl+DpGepoOR
TLSH
T18B559E66F574C331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 2810f0d05d779e33ab26f5bf689ecbfb3f0ce44a44869289b68029cd425ee3b5
MD5 133d8a5650e787e63ba2f20c2da9f948
SHA1 d6479b93134ab0aa6b4dc805ad9589b3dd59031f
SHA512 ed8d5145109d1e9625b83b1ff848babb7013f5346443a991519c5b93ffc4c40704605e42a32969d47ddcecfaa0ebbe0aff5fe2336769ae07724e54d227f7acd9
SSDEEP 12288:1j6zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:1j6M8DbpUgkHVUpoijR2
TLSH
T1BAC423DDCE45E2D1F3C79CB878BA14E218B66CCD1D0659578280B47E6AB85D1F0F232A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 0c2229fb1e50c817fe68eebbb5f3cd6ae9e9babdac963b83edc1520326032bdc
MD5 dad5d5261bf9ca75f25c7554dedc1388
SHA1 af4c8c7a1d453bef36435f01d115b46c6ec21807
SHA512 65151915d6199f093a39c97753a787d257ee153ec31f2e1864e2ad45147bfd0f71840632b97d867b400aa147740e205a90b4987c5a153ead4ec2a41081a29595
SSDEEP 12288:teBNUbTVO86URzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:tJIURM8DbpUgkHVUpoijR2
TLSH
T14005CF7BEE28FCD2C27A8DB85A918640D77278704F52A3CBD164C20EDE235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c8b87bfdd534031956709f5b00fbbcc9cebb4ed7e527dc1ab4addd041bddf351
MD5 b4430d44b481b28dd4de6336e565f236
SHA1 1632099f0e1f33f2752748e4a6387ef37786c9dd
SHA512 17122935c3755bd28c74cf898fb4bf3319036e7dcc6c708078ca25d61ce571598ec5e671c6a576ad754bbdff8cb5a006447a6293fa59cf8dc43f95d515838b9d
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THD:wQvGAdlCEL8c/RRNw5CO0e2
TLSH
T1EB267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 6f68e1a94c796976311b7f5e6abfad5ceb3ae6ed24085aa6c42910b4e16afcbb
MD5 a0331440be5abb72aca5c05808523587
SHA1 75b4db9ae7d66aff63bc4cf805e246996f681be4
SHA512 94b6961cefebbfa7326a3f5cf861e495dce5f1c5ae8fa4d5d3e108be48af8c24416d1d6b6e54cf3eddab7dbcc4d17a873a7175938a74f184b4c0e5f32dbeb10f
SSDEEP 12288:aAwSfxL/2Dc3DDLLmt0LDQewsAjvzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJf:vSewsAjvM8DbpUgkHVUpoijR2
TLSH
T11E15E031EE75E032C3BB0DB62B36C716187D79604F521AC3E3E8899E59742D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7aa13534268eab7f4d8695c825a09426c176faa2004a3a84d8769268539bd7c9
MD5 552a97088150a3fda6794ddede8d8725
SHA1 2e4fe7e1495ff39c5495d3bb1bea220a770f4dad
SHA512 6f8698e139534c11c795e69617f1487995f30224b2d08b3be3bcaf242d5847696612c005c161aded54802421d814111bf296099d9c1b1324b8c3b6bf590730ec
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHd0e2:CUEtQevvqc2W1cpV2RI32We
TLSH
T14A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ca30c0f5560af6b1fd4d580ccaf8666e78db00b10dcf944138d836ba8d537511
MD5 8a880ed0c3ae231009be819c02b97030
SHA1 7e7bceab3f19ca2ea64b94ca037a554e86509486
SHA512 de627932ce51e5f52b1ad13845e49fde064d7cef23326e27699d540246a55661a46cf5d130a20599d5a901051cd88194c0122e62347524e2c31fe0405d47893a
SSDEEP 49152:NCbRquA/m2yL5zifFiV+XenmE3/z1pGepoOR:qoqHVjnmy0e2
TLSH
T10AD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a961c44850b1b7265c0f100ba9f1d9cac9a9466d42b5c19ff6e5bfaad3fc7faf
MD5 17bc9fd047779cca2b6ef995e9eda968
SHA1 79847b0f5ec73928cae24b93d818820fa9207cdf
SHA512 d73ba99a89ca03c092cf577d278700be70d78a3b773e57063c6f4882780f18a8afbc6451c88b98cec9b306c9649dd8e90265a373ad1c4bb176209ab34881c1fc
SSDEEP 24576:zAhGL2IFoiwtA5l7S53YM8DbpUgkHVUpoijR2:zAM1Foiq5ipGepoOR
TLSH
T14C359D81EBF955D4F5B3AAB899B68171EA76BCAA1E31C20F1150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 3db1b968a1fbf56edb5f3d4d4af8b95bb74ef7077268c73be2a4e1ca504042d8
MD5 984bfd6c9e05854447e687de22206134
SHA1 55e6b29b2e1d0a5278eefb175892273923803ef6
SHA512 212be21b5c7fa2b67b4cbad3c2b586759137a4958493e1fb08a9d2c0ac2688a1061e1a4b669e1f58969d8b9a6c2444a465336824b0b9e786a24e44f7340c7c48
SSDEEP 12288:lmw5HEjsChNSBFgl0WDm+C8zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:AwuXOWbM8DbpUgkHVUpoijR2
TLSH
T15205F14966A54CF9E5A78538C5978036F7F2BC062A21DB1F0360C65B6F37361BD3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 870fd1a8ff1d598ff9639057129a35b05689959ad4d15889cca6dd4f41aaead0
MD5 b9b82f90162516c8356c06ec3c6ad60e
SHA1 8c6aee32ddd9539812b065982990cbaccb80d34d
SHA512 e31066f4f37a9e382a7ffc42b1ddbc9d603d78c84f62509698a0d5e34afdf173f7889c0eee646711db1e578a723f6a69d38064ce85721ba071a656491c2077ae
SSDEEP 12288:o/Z1Iy/zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:MZuuM8DbpUgkHVUpoijR2
TLSH
T1A2E4229D27E4B1F5E293957CDCF50485E7B278962B3243CF0250426A2F72AC26D76732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bd9e918ab94798b241c927947b6e1723745dcc324f692c202d038013cc8562cf
MD5 19bd22f39a7cb37a321e3d051fac3058
SHA1 8f06d3709e8209ec38d0bff1c6fc33aa4907feab
SHA512 6b95c72c5bd6f9f06122ce9b09dc61651b61d1067a377ee790bcf955b1ead77c4c8513ef0e8c8a4168d13e4ab13fea694094ea3cd0d1bfd205cb805822b7af1f
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uf:HQRQyi36YOcPhLvw2gAf+PN3z0e2
TLSH
T183667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7cce208282da6e4b069cc0683183e03b11c1b829972641807a0cb1d5e071bfea
MD5 8bba3fc9c0b305754d92d18880ad97b4
SHA1 9e834fe96bb76e9a64f5f2dde22200a524d59b62
SHA512 2534e659945338896aa63d151f4369c987acd37661f5d5a810050ac2cab98ee1b688f6d1a3f8c601c76ffa5ed30a979d403acfc188dfb8cd5dcd61db3980d127
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uf:nQRQyi36YOcPhLvw2gAf+PN3z0e2
TLSH
T12A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d19297a2199d06e11c6b17472cfb48c178afd6c179c5d4c016d19c85eab9fb84
MD5 99f9f436f12149839e5089b3d742b02a
SHA1 8995439a539a17f87ef3a88012146f0a3f167c73
SHA512 5e335e1298afc40b4540fb7581a5b42817331e898687b9894faec5ccff31f76a1a0de8efd4f12da6faf646a5a3539e204d6f2128220ad2f70fc15ff846721e87
SSDEEP 24576:dwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0eM8DbpUgkHVUpo1:Z68Qg55nhceWu7PNU3/lpGepoOR
TLSH
T1FCB54A33B2F600A9C44DE1769F4A873196D27C758FE1E3DB850172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e1501711354f6558900104a384dccf0e386812cde392d6a4ea2d8d706aa2871b
MD5 e06b676378ae8c17e850b15afd1016b2
SHA1 1dc9d72e3191fdefaf7d0d451bc694b2f33b9a6b
SHA512 c305292856f8dd9591c086f3b4a157182d73ff6ea4fe50d0371ac6cbc76d23545aedbe452e32a04d579dc41d8f2f02ad53dbe17233372b52ca256a3c0608aa75
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99F:jy5112gYy5azzVva69nLKnhZM0e2
TLSH
T128167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a7247e594d8c9da605be8ea44a332ecb8b75401118802e0dc3c7af33782c4a20
MD5 6a8a675731eeb07bae7fcc184a5ce6f9
SHA1 9ffce800929925652bd17ec9fcfad6e26519fb8d
SHA512 1783aa696345728f10508af61a5361a35e0cdc7aa93171ebc95dc44cfaa733e61bdf38d5ca325fb49e6dc738536ce16ef18f6b87441cd2f70039e778afbecc36
SSDEEP 49152:DB+taZ3usBWOBr4tEG20bqx0z+n217aau1glrpGepoOR:1u6JmUxd2dr0e2
TLSH
T1A3D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1e04dd2ec6c1c03b6ffb71b5dadbe60b60a5bd6b7f8ca724fd7d14c69c523127
MD5 3ee1db8e86a4eb636217ac6e6113cdde
SHA1 a4f454b47d37ffa7dc9489b69b39268de16b9857
SHA512 e39ecf597bd30e96e2c248bd24a076249db6ffab9f8408d8d0ec97739cbf0cb6f3419b0ed5fa4c6b813d4a419e1641ed959705444b8fabdacb4760b416f6e2b9
SSDEEP 49152:s1hpsNoJpF1A6BU44CwH7R4xPpGepoOR:smifPkRy0e2
TLSH
T1FEB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3feb226c2555dfef9c33d61268e084f7981b974c869efaf799a8d09cd4aeef6c
MD5 91641ff2947f7fa2b9ec04c4922b981f
SHA1 e6ea0897a431a3a8d57a6ec79478f6d8ea61aeee
SHA512 e47fc6fa1c9098a83578b62f85093b36fe7be176bc3d39512e79a3a34634a025040923bce146feaea0237f8c68c511ac2ef5e2da6fb4378c9206e21d371d5766
SSDEEP 49152:hSuZQIY0Be2KNRVtOnks6NMHqIpGepoOR:v5dKvi61I0e2
TLSH
T105C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 934195c92664a9a5bdb128d18f9236939390cf760cc85278203382e0d3a009e0
MD5 50d3a03413c18e413e24ee3ae23f5d76
SHA1 6d885446e9b2c19e1d842affc4a07345a7236703
SHA512 8d73808a267ddf92c70e45acf4f46d9798086c99d073c9d9b4dda2131e3e1267eef98732214f971a46cb3017384ca83116c79cf2430c090e2ed500570dcf21ba
SSDEEP 49152:BhtSn8EApI0figXgiDn0AP5wbpGepoOR:QX2iyph20e2
TLSH
T1BD95BE13F2D940E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 a9b9fff0178ae56f261e013cc0518a245967e658646bb21f908977a5cc3c8565
MD5 ce47e4691123c70ed7b3bf983dddc4f7
SHA1 55e4c0857e3a6a9211f077f569b7b1a014b526bf
SHA512 bee5f2dbfc835bfe0f687da3ce3b982a5f92509cea4bd13fedf4e7f89cf2108a2cc6d3640176fdda0c3da51bf97a52cb320e8e72a04166c7bf0f6ed13d40fda9
SSDEEP 12288:sCzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:sCM8DbpUgkHVUpoijR2
TLSH
T120C423DD8C57D7D2E3839DF4B4AA10D668B96CCE2E0715978280903B7BB86D130F2769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 da7c6974e90a4f8c9118843c4e2104124bee2c70fb5dc4e74c6f943da1a5701a
MD5 539ac2d08d399b66c1621562e2c37d24
SHA1 355f8ae2a9f3d4fd82565fe342ce7fea1192d205
SHA512 93a4068d03552a342f4a76071712153ede8718c747c597073750342a19bbeaa0bbca519e4e9d125c08395d305a79cd32614e0af2b182d9691f0344f0f9cd41f4
SSDEEP 12288:Szzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:SzM8DbpUgkHVUpoijR2
TLSH
T135C423DD8C57D7D2E3839CF4B4AA10E158B56CDE2E0715978280902B7BF86D130F2B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 959c2bb5b909ae76d75e092fa810f1643b2b2d78234a431a0230b7b6c27effac
MD5 0c042ac8e11f09dcc61e42d5fd51de36
SHA1 00f6ef3e5384e8424a071a8d2e2cfa75a9bc97dc
SHA512 6b9b3e85b1afd90c71e10f19cdea0047d8fdd905b51ab22546c0d52e073244e847cebac67c8bd83b1809d7164a9261cdf6c602f27dafac478cd949bdbfc4b361
SSDEEP 12288:C5zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:C5M8DbpUgkHVUpoijR2
TLSH
T10AC423DDCC57D7D2E3839CF8B4AA10E258B56CDE2E071597C280902A7BB86D170F2769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 55a3ab914500f12c18e746f5285d0eb79c5219a9559993f8578b4e735542db7b
MD5 0d1bd035531ce98f3ef6824ad696d109
SHA1 ef04f40377457077b9d53e3bd32ba8ce321e3d3c
SHA512 f5fa7a2d3dd00c9a1c66b3c46fa48549482df39b40b640975eb3ea54a8539493306be93a2cd4283d990d0602815c63e05c79a5b9566e7539361eb6310f581198
SSDEEP 12288:lV4zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:YM8DbpUgkHVUpoijR2
TLSH
T103D4239D4E5AD2D2E283D9B8E8B600E1A5F57CDE2F1256DF8340446A1FB03D074F1B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a93d9cdb9c835a8bada67d0c75aea2b9ac08800ffebd90384ed738c03da8524b
MD5 3cab91b9e3d634370ac002c028b8b8bf
SHA1 295ab4f0d6f23b0c3ba4b86c9b91aef64c777aea
SHA512 ea78a01ab88a90dbebf69342b9e8d87bdcde6bcb2d736d5c4c885d713be6999ea5f34e96ac54616b1f9dce93d0314ec355f55f3b1f9ca3f267a5fe7ac4663680
SSDEEP 12288:FQzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:FQM8DbpUgkHVUpoijR2
TLSH
T1E8C423DD8C57D3D2E3879CF8B8AA10E558B56CDF2E0715978280903A6BB86D170F2768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c02968021e0d34051112adb97524752e649e304f5e7e43d6244be10282c488de
MD5 007ff031de9827ed22eaadc69d0ce525
SHA1 3b9c20ce39f67a93806b6980c31e545ae6a7a7f2
SHA512 e4725a7d50f09ccd776e5395e0e4a5a59937cea60a90bf3f616cb7b82e4121800738b9b713a71e21ce421db9def20ed7d8ce82eb6e650fc7163b8a88aafa1467
SSDEEP 12288:b3zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:b3M8DbpUgkHVUpoijR2
TLSH
T187C423DC8C57D7D2E3839CF4B8AA10E558B56CDF2E0715978280902B7BB86D170F2769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 6ac84baafd2ce4f7e6bc98321938be35261f9e47d886f8c2fa1a1bad70b10cd2
MD5 15aa142027f1479d60b0c641f4eb51bb
SHA1 0d7734798671d6fcd6f5175c1bcea189b70ed92f
SHA512 415165fb72d12cdba3d1182715141144f2aad0efeafa1b97a4c15c2cd269a35e8b9bcf4f67b7af7071623260ef449c781bf1c67f4e230fe0a2d9f9af2ccb5923
SSDEEP 12288:BLzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:BLM8DbpUgkHVUpoijR2
TLSH
T1C2C423DCCC57D7D2E3839CF8B8AA10E558B56CDE2E0715978280902A7BF85A170F2769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 4660b7da93b749ab80d9aa949cdee0af8a1de9ab5cbdc1d107594f863805c2c9
MD5 8b8abb071af8f42a1dd0129debbfb5c7
SHA1 7dbf5fd23d27b456afc1ed2eb7052099c581fa8a
SHA512 41db349351e911dbb6b69f964a9e20e75209cdd470b76b69278d595595939521fb486894def70fb8696c004c63a77bbee0c0c7810ca5b24653c92dcba753efad
SSDEEP 24576:JcP4mcvIjkGOxhKP2l71SNKbrh/8KB2M8DbpUgkHVUpoijR2:+P4m4IpOO67N8KOpGepoOR
TLSH
T16365AE2DABDC0096D0BB917885658A4AFAB1742E1F3286CB1160933D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 7503401d03c1a921599ce1f5be4638847cf964112386d7da42e21ad89902900a
MD5 c3b51b86d1e2d8a84653b177fce8238a
SHA1 708cf598217dca8499d03077bc9b63c262868e76
SHA512 4d77bac22f1bba623057998e8b981e187651a666e6bc6fdc625fc773f6cec7f435811818d85057151eb23a9cc23e021c3bb35d8c61812a98430072504947a106
SSDEEP 12288:IGsfuzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:YuM8DbpUgkHVUpoijR2
TLSH
T15FE4F159C29882E8D19EA179CB560981B3737C6947E2D3CB42C0F43E1F75690ADFAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SvcHostLoader.exe

Path C:\ProgramData\SvcHostLoader\SvcHostLoader.exe
Size 1.6MB
SHA256 0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6
MD5 83803beb0ddf793b9dc073847cc3da85
SHA1 b71ffc844297a38a88cc761c3e2586ef6c63361a
SHA512 f2a263801b5cf70985b5b3217d4a506b37a9a234b4fc9b8b92a410222e0438b02f0a6b68b0c335e49652c9338f3f7cf4c950318f1571ac3041ad3d04c599ba64
SSDEEP 24576:aj7CD05uJiIfSucFUM8DbpUgkHVUpoijR2:ajEgutpGepoOR
TLSH
T17E754A2C9BA4836FC393613D58A985DBE221AB4583E5715E3BC3350B0DBE5F3450EA2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~sys_27772.sys

Path C:\Users\Admin\AppData\Local\Temp\~sys_27772.sys
Size 43KB
SHA256 9d438f1a82ca8ae0c5ddeb523ed1882367c5f4254a3184afdfca8de4e8ceb838
MD5 1185fe0293c1b33783cfb1707d3c0208
SHA1 67b720aac97d25533466214c198d7adf282d1519
SHA512 33e9dcae4cd2fe13bfde121fcbae8cc5f20f7a8a1f1eb3a5cfce64964fe988bd4abcb8d3cfb1c475fc337de03f6e4beba14c8840a93a62c7545980d7275d8673
SSDEEP 768:YHA9D7gCnjvabLa4cewnBpvwzLOdNqc8ocNe+Sc088:2+2dcewnrwOWc8ocNec088
TLSH
T16D134A434A6928C5FEE69DB1D1E5D82BECB2B7922F8099DF1070C0544E52BD0BF3961B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59b825353a3ba122.bin

Path C:\Users\Admin\AppData\Roaming\59b825353a3ba122.bin
Size 12KB
SHA256 fcc56a3cd3756e85430702dc52ed7b4c5a2d4883c7676af46fc612e90266c70c
MD5 9b547f47e3ba9506b7a06f100af715b4
SHA1 077f762d401c01bca141008bfae713eaa68a0a63
SHA512 ee3715bb7ad21c838713ce5b52c710a7b37014d087d082401425dac6aea31c8e768f0152d0dd424e595e8f5ef28b02cbb65f9fa4330a9502c4c6f9dbb2c2fe5e
SSDEEP 384:U1zmIqH57bDGH+P4cljGPIGACWAk4meqt9:KJu57bPQoGyJeQ9
TLSH
T1BC42BF95B8AA8A1E59DA5EB32C1D0E5FA55F9923BE76791568EC010CD0309B1E80F098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 7a738d45c20bf694e7ba0a54f4df60dcf651c2b00256bf402931f43daae8ca1d
MD5 b3134a4b3d85968e3a0709a926c85ecb
SHA1 73bfa81d98eb1e480f8d95fdf058b88f10ab69f8
SHA512 6eb31a4a88e4bc028f11ad59f0282399f11597a2077eaf43e55dec865b41eb79a10fd5086f6c86b976d1721e0626448bde26318645952f0e4b8d7cbf67cb8ff9
SSDEEP 12288:7Ozw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:7OM8DbpUgkHVUpoijR2
TLSH
T16DD423ADCE59D6C2F2C7ADB4747A00F1247E78AD1F02958BC140507E6AB89D1B8F172E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d2bcffd1d74d072d1b52d8a360484f55838235c70f3e41cadb5e04d52a8bb983
MD5 5415a0771721f257033627b416d01446
SHA1 7bb0fb9d8470a6b3144e6195173ec5ec4f246393
SHA512 04625d0f1d9b0b42d8de63d3b5117f2b60dcb0ab75ea8efb460ea4f12c2114fca73fc6978965356d8a08aec442d3be6d249e2ae96e21b18c4f76dd3068d0b3a4
SSDEEP 24576:doiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBq9EzwwXg/bcM8Dba:da0h2GEkuAe73q3pp46zwwQ6pGepoOR
TLSH
T17C859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 b192be5723591222c80a2644e07090c5a846af04cd79eff0484323d9302f0f44
MD5 9e388b6580136d3e7e2a967616a101db
SHA1 da09ed6ce84beb0ac397985e7bbe50e05b503235
SHA512 67113c2ae1a22b3a2c53fb0bff524434ad512e098316f7ef2e87b2fb92fd27de8b01f3422d5b3702dac22308b08baeea98c5f56c6f9565702edde7011c6647a4
SSDEEP 12288:shbHjfXjzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:shbHjPjM8DbpUgkHVUpoijR2
TLSH
T110E412BE0AAC21D5F262E5BC95964486D371B86A1B1293EF03C1817E1F3BEE01C75F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 eb71931784155be6f8cdff7d4bd6627dc72a9c63391f627a72c1f030e17aef0f
MD5 15757b21c13c2c9b1b2c308005a5ac9f
SHA1 6fd5e0568829e48e54572ddbc948feb0bca9bde9
SHA512 f60eac658713c49d5304eac514e2e7caf6775b011b54270d45bb4e59dc767eb4f0dfeebf6c53e331e1062d1bced01130411ea5e4bf714eec6514ccb9d8dea5ab
SSDEEP 24576:g3YgnJcRTk4yti+R5dpR/bM8DbpUgkHVUpoijR2:gIgnaTk46ppR/ppGepoOR
TLSH
T17545BF2EF2B910B9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 5c6fc0083a9b9c9adb643f9dc8e5c9a93b080cc838e0ba2b504f391411c05f04
MD5 d34078527b2dbd4069fc8715ad7bac5e
SHA1 81577d726983c2133272d5a4447997ccf29d87a4
SHA512 f557b13606a13dd0d9d202c43f1a6dee8a0c016036fd647352b0cc2f74ba48ea5d4f4b70975839253b96b3cf688bd9a26c0af1f5a83026288bf9094d09ceb17c
SSDEEP 12288:nazw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:naM8DbpUgkHVUpoijR2
TLSH
T11FC423DC8D46D6D2E383DDF878AA04E624B5789D1F0716D78180907B6BB89E270F1729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 cfb6099ab22b667be77aa9dde52de693401ef2dfbc38d1b9779b176e7ff2a8ac
MD5 98fd127fcb7a160947fe96c8423f63b3
SHA1 460057925eab8a50c1c36c63477f95be53b711da
SHA512 e5b0b55cd4256a532bba8895d64aaea09408d17ff2b422d8f736339b8811e24295bd9ec85235f8a898005f6aaccf5bc5e3ff05fe7b1b8a4da4c5679a6dc2d200
SSDEEP 12288:TObvA4LWOsvAYFT1zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:8rL3UT1M8DbpUgkHVUpoijR2
TLSH
T17F250259EB9440F5E967D13CC8B78512E2B2789D0724E7DF03A84A661F637E24E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 a36f742677acbfe74ab6d3e4bc974d1fc979d05b1c974b81c941a50609640e87
MD5 6343b5f5cf6d583755fae13908adb0c8
SHA1 c20c5d040192fffb05541f8cb2bf45783e0033fd
SHA512 fde57d9fde1d4d41cca414b58ee9f72ff40f72909a100b271e177cc8bae917eb0c9c033983feceb81692a0b317877f93ddd8d54101cb7c2d0c57e0d04aa46730
SSDEEP 12288:zpFtYOxzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:GOxM8DbpUgkHVUpoijR2
TLSH
T178E4126D26ED50E1E166A17C9993428DD3B1B8660B1257EF02C0807E1FB3FF86C76B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8dbf8260f36b692beea53565feffae070c5cea0067ec2c1336e63a377813efc4
MD5 4fcf8de6ca7fb9e8fa3175cc282be4b1
SHA1 eef4fe186e1a408c15a617aaa477a1f45df7d539
SHA512 1a3f2a8c5065e8152739f5627e1abbe0ccca375a7200da00dddea00cba94d0c572f02c96ea47a0202335230a1b136e14f8cf1ba070a0223ccbd9687210ed7cb1
SSDEEP 24576:W7NM9YmZqmWMUkPjZM48Mv6bEhs+M8DbpUgkHVUpoijR2:W7cBWMpPjN8DbEhBpGepoOR
TLSH
T17C65AE2E6BAC81E5D477D13DC9A28246F6F2B4611B318ACB1152833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 ff1382c5cf4aecbfcdcaa913691a6c658de90a04cfbf8a6bfd250b7b50076f1e
MD5 41d2b57b19cff7503ca52c37d340c17a
SHA1 71f4fc43f9abd6efbab9b781f74820b74cb65c1e
SHA512 e693fa38f80a445713b0b456b4ffa5e9093abfe03c8161cf6095edda99a1446d887d6eeb4040cbb820c9d3183a94c68f513e3ce1ba7a7ec15eecbb1ff46d0f6e
SSDEEP 24576:eW6BApg2YuyuNDYTabvcRvNYf8km1UM8DbpUgkHVUpoijR2:eF2YuHNETovcvNYf8kmYpGepoOR
TLSH
T1BF858E6927EDC0A4E0BBD27D45B79186FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b194ee1fa7f2f71a0fc1300c08fdd05d0e73197c05ff1d6ddb504cf633c9ba5b
MD5 01eaab54f860920115f83671a94b1b70
SHA1 45aa56f8e6d0d9b7d9bfd55b5a5ca5603d412c34
SHA512 a97c1a50e3fc89125bdb6d78c47d4cf68bea60236526d35dc7aae2cdd92b37c644939e5d7454f2a4c21589947fb291260346d0b9271497db8b42496fdabadd63
SSDEEP 24576:HAFs06+OmlfQNXEbTo9M8DbpUgkHVUpoijR2:gFs060lcXuapGepoOR
TLSH
T17165BF2F66EC00D5D07ED17D8A97C91AF6B1746707215ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 5e9f8af89223d4b044147e1bbc1d564862e560df3f34c1a723727bf6c7550c79
MD5 219610e464431d7ca63c9bdb508e61fd
SHA1 87e747657a4d2637ff7d4bce464b92f9bda2b30d
SHA512 520e66e7fa0a1d2102dd8176784abc956b2dc85ab5a1d7ae3889d3eaf1099835abdaaa50cc2bbe5587ba976351fdb4cef23bb0b90983a7bdc4ed707153d7debe
SSDEEP 12288:wCJnJ5D3Vkrlzxezw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:FJnJ5D3WtwM8DbpUgkHVUpoijR2
TLSH
T1DF15D02DD2A810E4D4B7C2B4819A1796FE72387D2F226AC714B4D5353F22FE0A979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 75c8b2c8d8c633f8e6003e24d7f5f6035d39ea3182d09aa9469030e009bb1e0c
MD5 b5736175c9d3f6821f6cc6a153a83579
SHA1 3c67a88b57046e76167cd096da3fcb45ce77f246
SHA512 98a235126f7c5553ea3311cc6935a36c137a614ffe7e60ebf3c059f1559e07a773b542419a821645d69bf3b1e9ece6a2ddc902f5d7306aba8c5ac0c267e9b6ff
SSDEEP 24576:FEPohm6/7IIXdwcXrif7qQncjlP65i3VubM8DbpUgkHVUpoijR2:So06DIKdwc+eQnSt65aVEpGepoOR
TLSH
T192955C15BBEA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 c67e355a647645e02149c04e84bac422a5c29f950cb9a0fe1b5b5528847ff2a6
MD5 6bbb08105f86fd69b29f570ef43eb1e0
SHA1 f843dee98e16eeb11596c77660cd616ae9483ed4
SHA512 cc5911d422a925bd9530917fd7e0c41bbd329ba5856e088d158d0b3995b97705f92fd7cb90cd82b9e54215014abd968d198ea7917d0d39515765b8a68cb9813c
SSDEEP 12288:MEP3Rr8zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:Hr8M8DbpUgkHVUpoijR2
TLSH
T19BE412AD5B9DB0E5E266E07C95A24185D3B2F0B52B0227EF42D0C13E4F77AE52D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 852c4645f22930cdbb6532f7ee31b2195f3cd6484f90a1cb0acc7b46f6cf31de
MD5 d7034b0ba4c51a8f5a8a1857b0f1b59f
SHA1 de28622b90ccfb45cc93276187b93f480f1de2a2
SHA512 0ae742c929d14110ab54adc3546fcd448cd9bbbb10ed176ba67549c442790e92fd7d7afb8170d33004f722927e3ea418cc53ce08bb2db4251282f50f5a5d9c16
SSDEEP 12288:djkyzzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:dIyzM8DbpUgkHVUpoijR2
TLSH
T159F4224C5798E1D1E2A64A78A9B740E09E75BC241F1253DF81C0E23F6F76BD0B871B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 7141cc53ac02487ef61a490b2c89baae37b485e31e64b5ade1b6e17f50c473a0
MD5 ecf78184f8c8eea45da2a61af459f307
SHA1 66b31ec329cc64f01a780d15967b710c0caa0a95
SHA512 732efbccfbae29c69b2040bc0bf3ff5f19b3f855a8c03a32206a8b2bc1882923cf74c338fcc9eff3d475e50d66b7486822e0a8284f4868c13c877b5849c631ed
SSDEEP 12288:6FBzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:4BM8DbpUgkHVUpoijR2
TLSH
T1D4D4239C4956F2D2E2839DF864BA04E114B578AD2F0625FF41C0E07AAFB86D170F2F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4b1b95149bf6e2ac9198e31b89aaa27f7fd2217356add531ac41e171fc7792db
MD5 e29e861f042b7141804c2bdcb1daaa9b
SHA1 953d99b2beedf9f147a67627f853ecce5e6ae812
SHA512 26d66401fe5c4959509f5e92401fe44f2afd1a428f07d1af140e1a5a63191f0acaebb8f423d0de1ebf5d72065ef5d62c9dc78f73a0c9dbe6fe3669e58b5b0e1c
SSDEEP 24576:2Q9MxZKdcz97w3mM8DbpUgkHVUpoijR2:2VKXQpGepoOR
TLSH
T18D558D2DABE905CAE177D27994A250C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 56f9f57703d0a78f7f02b9f6382feb2f7baaee5b40ed2aa1b44bf92729d4d60b
MD5 4b0b71e6757751f082dc751ce6d5f2d7
SHA1 7584c731f64fb83266c999366075bd81d01ba37c
SHA512 2af5c7dbf6be861871d8304814c3b65633208048cf845ab950c53a5f96a3058ca650da9932deafd48660f5dc590bb5f892b6a6bdb1d3bcf97825880bbf769f5b
SSDEEP 12288:VyoKo2HRple9pvzw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:VyocxApvM8DbpUgkHVUpoijR2
TLSH
T1D3F4E05FBB6E80E2E166813C89858285E7B3B0741B5257CB5181C33E8F77AE9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 54dcd87d50fad091ebdcdc95753ece17eda8f75ebee8ba2301b0d55525c6e69f
MD5 b44bd2f0105c275dd44ddb2544161119
SHA1 a5882c83b9938a229ee728900318efbd81118676
SHA512 881133f665c1b6c5dbb2ee090af7fb62319ecf86315f1c2c97f94a17650b94695d74a96c66e4a35f5d0ec1895f954e76ef86e6cb553cd40c6eef165ed499198e
SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKVpGepoOR:40zuNIZ0e2
TLSH
T16EA57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2eec96cc0faa9e367c980ba660374e6f100d289e9b24f743069cd2cc01b349a6
MD5 bd23c41fe12deebd2831693f245da320
SHA1 87302d4b574caf71e2e4934e93c3197f99a9f47f
SHA512 75307d5e577239b7ad2ae8cfb66aa58000ec2c299ce7b74b77c5d714e59827f32f0a1c4bfae4218b3a18212474089eaf2598e1e7cfc5b7006d2373b996b02446
SSDEEP 24576:i1QT7EcpfxR+N5AWAz3ooiYsjMqb8M8DbpUgkHVUpoijR2:/TDxR+N5YzTujMvpGepoOR
TLSH
T1E955B02EA7F855E5D1BEC5789A238512FA727821033193CB42A0C17E1F7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 125eb92f40809635fd4a0a0f8642a92eca15f8b0392c3deb650fd8668e502d18
MD5 b1ce3cb1ae79a87df9c6545c04101857
SHA1 53fba91c6c3dc5d3a1ca40083d05f1d59133800d
SHA512 ba3b91c9f7c07a90158c0869f0e2230aca39741d6db3567f2da2b52ed97c99e4205a11c30f4995120178c2db1a6e588ab1c61283a0999c2a3cc6c8d77d52af85
SSDEEP 24576:sTMdOz0FFS+hmSL4M8DbpUgkHVUpoijR2:k0K+hmSLypGepoOR
TLSH
T1E015F17EA76D14E5E47BC17CDA438906E6723466032266DB06D0C07A3FABFE43979B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 01373458df9f9a136f99ac9757d7ab4318b6a74f71e07607f35ecba3f6b36ef6
MD5 99a089a261576f12882bba549eaefbed
SHA1 d1dfefbb826d85143507085bba37206e8e722e9b
SHA512 f7c1dec2f79b1d3857242abbc743506e998549e979c931eaaf256c1afe0d4e9a0039757f2fe9533681ee22ac0c455ba268bddeb3b9572ca64e5c501bfb28508b
SSDEEP 12288:L471zw8vXrbt428WUgITrZ5V6DtcYeVNpZFT6xJRpqZK:+1M8DbpUgkHVUpoijR2
TLSH
T1FED4225C47E8B0D0F1A39978AA7700D69570BC7A2B162AFF21C0C47F5F76AD0A4B5B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/448-61-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/448-63-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/448-184-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/448-55-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/592-239-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/592-245-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/592-531-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/592-248-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/632-115-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/632-235-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/632-111-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/632-105-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/800-176-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/800-445-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/800-182-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/800-185-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1232-114-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1232-13-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1232-14-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1232-22-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1372-454-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/1372-457-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/1372-448-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/1372-496-0x0000000001FE0000-0x0000000002040000-memory.dmp

Download

memory/1508-9-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/1508-74-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/1508-524-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/1508-0-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/1508-6-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/1508-539-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/1508-7-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/2116-272-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2116-269-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2116-621-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2324-509-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/2324-501-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2324-507-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2324-526-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2412-530-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2412-153-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2412-284-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2412-159-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2412-161-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2412-528-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2436-573-0x0000021B18330000-0x0000021B18340000-memory.dmp

Download

memory/2552-84-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2552-78-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2552-91-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2552-89-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2552-86-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2636-189-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2636-195-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2636-198-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2636-456-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3052-127-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3052-117-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3052-247-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3052-123-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3120-479-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3120-626-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/3120-473-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3120-484-0x0000000002BA0000-0x0000000002BCA000-memory.dmp

Download

memory/3120-482-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/3168-326-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/3168-294-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/3168-276-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3168-532-0x000000000CC90000-0x000000000CC98000-memory.dmp

Download

memory/3168-310-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/3168-282-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3168-285-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3168-622-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3400-40-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/3400-50-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3400-51-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/3400-46-0x0000000000A00000-0x0000000000A60000-memory.dmp

Download

memory/3400-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3484-520-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3484-236-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3484-233-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3484-227-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/3936-260-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3936-138-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/3936-133-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/3936-132-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4012-220-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4012-93-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4012-94-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4012-100-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4028-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4028-75-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4028-197-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4028-72-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4312-389-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4312-171-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4312-173-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4340-142-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4340-148-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4340-150-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4340-271-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4464-212-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4464-225-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4464-218-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4464-221-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4464-223-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4772-209-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4772-481-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4772-201-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4772-207-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4776-521-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/4776-523-0x0000000002BA0000-0x0000000002BCA000-memory.dmp

Download

memory/4776-648-0x0000000140000000-0x00000001401A5000-memory.dmp

Download

memory/4776-518-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4776-571-0x0000000002BA0000-0x0000000002BCA000-memory.dmp

Download

memory/4776-572-0x0000000002BA0000-0x0000000002BCA000-memory.dmp

Download

memory/4820-251-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4820-261-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4820-556-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4820-257-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/5064-126-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/5064-27-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5064-35-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/5064-36-0x00000000006B0000-0x0000000000710000-memory.dmp

Download