valleyrat_s2 | 08f2c963906b126c0a10b47aa28eccebf8e209f3885c54489f771e948dc89b1a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/09/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2df08b445585f5db43736868b4bc8428.exe
Size 1.2MB
Sample260914-cpp1dstcpb
SHA256 08f2c963906b126c0a10b47aa28eccebf8e209f3885c54489f771e948dc89b1a
MD5 2df08b445585f5db43736868b4bc8428
SHA1 053f9c64a94448d467f0ca20e0ee5346c2f7a308
SHA512 16aa3cf097282a1c7ba8ec24e4aae23bc2692d97d8b6bfa34c7e612cff353bfb82c62b525a63c75abfac1db5bbb7c1298337a13ca009afd85493ade182a4b067
SSDEEP 12288:/QKreuMBX0bLaL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/hQULZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E655123136D0C0B3D147227884F1CBB29EAABCB2076549DB67D02B7B1F745D29B7825A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery valleyrat_s2 ransomware spyware stealer

Malware Config

Extracted

Family

valleyrat_s2

Version

43.229.114.114:6669

Attributes

campaign_date
2026. 8.24

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 4 IoCs

resource	yara_rule
behavioral1/memory/4164-344-0x0000000003CE0000-0x0000000003D18000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4164-356-0x0000000003CE0000-0x0000000003D18000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4164-357-0x0000000003CE0000-0x0000000003D18000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4164-358-0x0000000003CE0000-0x0000000003D18000-memory.dmp	family_valleyrat_stage_2_v2

Executes dropped EXE 22 IoCs

pid	Process
2860	alg.exe
1744	DiagnosticsHub.StandardCollector.Service.exe
3752	fxssvc.exe
3660	elevation_service.exe
4988	elevation_service.exe
2556	maintenanceservice.exe
4876	msdtc.exe
4484	OSE.EXE
1380	PerceptionSimulationService.exe
1952	perfhost.exe
4012	locator.exe
3240	SensorDataService.exe
3944	snmptrap.exe
204	spectrum.exe
4332	ssh-agent.exe
4576	TieringEngineService.exe
4672	AgentService.exe
4016	vds.exe
1072	vssvc.exe
3728	wbengine.exe
964	WmiApSrv.exe
1668	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\M:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\O:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\R:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\U:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\Z:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\G:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\K:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\L:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\P:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\S:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\T:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\W:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\X:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\I:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\Q:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\Y:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\B:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\N:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\V:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\E:	2df08b445585f5db43736868b4bc8428.exe
File opened (read-only)	\??\H:	2df08b445585f5db43736868b4bc8428.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\System32\vds.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\22558cf60f3a3fa.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2df08b445585f5db43736868b4bc8428.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113156\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\UnlockSwitch.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\UnlockSwitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2df08b445585f5db43736868b4bc8428.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2df08b445585f5db43736868b4bc8428.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2df08b445585f5db43736868b4bc8428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000391fd1f1ee43dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a54932f8ee43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a30addf1ee43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6a6b0f8ee43dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002479e7f0ee43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033c733f1ee43dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eee64ef8ee43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007547d8f1ee43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe
4164	2df08b445585f5db43736868b4bc8428.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4164	2df08b445585f5db43736868b4bc8428.exe
Token: SeAuditPrivilege	3752	fxssvc.exe
Token: SeRestorePrivilege	4576	TieringEngineService.exe
Token: SeManageVolumePrivilege	4576	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4672	AgentService.exe
Token: SeBackupPrivilege	1072	vssvc.exe
Token: SeRestorePrivilege	1072	vssvc.exe
Token: SeAuditPrivilege	1072	vssvc.exe
Token: SeBackupPrivilege	3728	wbengine.exe
Token: SeRestorePrivilege	3728	wbengine.exe
Token: SeSecurityPrivilege	3728	wbengine.exe
Token: 33	1668	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1668	SearchIndexer.exe
Token: SeDebugPrivilege	4164	2df08b445585f5db43736868b4bc8428.exe
Token: SeDebugPrivilege	4164	2df08b445585f5db43736868b4bc8428.exe
Token: SeDebugPrivilege	4164	2df08b445585f5db43736868b4bc8428.exe
Token: SeDebugPrivilege	4164	2df08b445585f5db43736868b4bc8428.exe
Token: SeDebugPrivilege	4164	2df08b445585f5db43736868b4bc8428.exe
Token: SeDebugPrivilege	1744	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4164	2df08b445585f5db43736868b4bc8428.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 4680	1668	SearchIndexer.exe	110
PID 1668 wrote to memory of 1504	1668	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2df08b445585f5db43736868b4bc8428.exe
"C:\Users\Admin\AppData\Local\Temp\2df08b445585f5db43736868b4bc8428.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4164

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2860

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4952

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4988

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2556

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4876

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1380

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1952

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4012

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3240

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3944

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:204

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2248

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4016

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:964

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4680
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dd956b717b211ef1b974eb945f9b1464de7f45da2c43d35217072c93092e8d9c
MD5 53c3b4d67fad359ec51034e3d51319b1
SHA1 7890bc74765b9d408a5c49b7453c228c62955fcf
SHA512 7f81ac9390922c6a970c37ac38d50ea31604609a5ca81e999ba8c7c12b1c1c8826ff7054c49d252a3983234c3968b7ca73c660d2d1cf7d642d07e107616827d6
SSDEEP 49152:Nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn5e30jaNf1TWbdz:T3q6HjBIU023W
TLSH
T11FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ba35361f0820ed1a10227a7725b8b67e1f1cfc381ccb96aa80adee141d5b4696
MD5 a4eaa41462af815698d43cb71cb7b2a9
SHA1 b138b0279630561482d59ca7526d171a44947bc9
SHA512 860f7a64652b5e98fb7b7c66bcf542bd4e0059ec5ac70d0bca7165adfc41e5c48de298eb4c2e7577ef59ae8f92319d954703319a8a8929041fda8b2f09ed71d7
SSDEEP 24576:4XYfDtczApgXe4i7ojhsP5Lgrk1TWb4AN5:vtcPe30jaNf1TWbdz
TLSH
T16165F12867D409F9ED67827CC8E2C611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 fff6119243ceb1a2d9affbe892a4a11d6a7450b9fb757210234ab8035b6c4434
MD5 f9c4662465d1e8bd280374536daabb27
SHA1 e8fa0342071c6a12af253fa39ab8780369d96ece
SHA512 cb4618fead20fdaf4d39d7b1a1c56e25533cb756e999803ed8723c94f89bcdbdc7bea4a5716ed98d56f0a90cf27ba7dfd645b374c2a3c4ab9594ee104efdd819
SSDEEP 24576:D0Le5ji0hmx5rMegXe4i7ojhsP5Lgrk1TWb4AN5:DPji0AXWe30jaNf1TWbdz
TLSH
T18D85AE16F6748735D073C0B9C5D2A69AED72308217308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e1cefc96bff76471178bd4cffec9c88739e0941d4a8d0b2065b99a72a75137fd
MD5 d2a9dbf6ff3ada132c5dc232f35dd79d
SHA1 aea0c3680668ce7c426c6db0ea6e28284ad13cff
SHA512 59d8fc3e81e6c9983219eea331caa9f8a97ffea55db39a6e2f0c86699c10200c2bdb08b41e368c75210b38d31e90fdcb2da2672e13e48ace91b47baf076a8f94
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWE6q8wyuogXe4i7ojhsP5Lgrk1TWb4AN5://ezSC6vUzPvxHjyCe30jaNf1TWbdz
TLSH
T187756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 69dc9bb37e070ddf110f6911d5fa1e523d3626d48eb0903b94da65a217593e30
MD5 6f79ea018918b8c7f40e1ee77787376c
SHA1 3134ed121271bfe5e0d9cedd50b0ca895ebbbdc7
SHA512 1cb29f17fda83afaa9f9ce0b98c21b8d049de38f7a665317de4ed43ce1df89a742b0f90f7ddfafbb343552d010dd4965601be0b64491324fbbe3b4f6722e39ad
SSDEEP 24576:PVbqPb88hv/l+69gXe4i7ojhsP5Lgrk1TWb4AN5:PVO88hXl+Ne30jaNf1TWbdz
TLSH
T1C9559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 24d7b30ed671071d9002f174ab597ef982b6a6175fd7017d3c4486c51a155f35
MD5 a76432981875f8a0735b9fa0cc32ecbe
SHA1 a415060cd75704685ccb6d512b0c5f6b5a547cac
SHA512 c5f6da5428356f531c5a9b42e51c76a89490a775ab122c02eb8bd7193acaf146e0329e39e85beeee0fb04376189bce529cfdcefdf45b557951e2332d94095773
SSDEEP 12288:25V0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:25igXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11A4523929F5409C6F38BC3F0A0F7CB91E9A11EC171444E6B47E0FE9359BC8A9DAD8059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c41b4418df30da18a76083f06d20c37a88cc21d7cd5bf5750a06ed68ab834357
MD5 e19f7d644a65a5da38c9199ee9df1328
SHA1 f6fb66186b78195b2402a102c2694d8bdc4e18c4
SHA512 49c6f52650594080c2d243b9eed1727a759121ef5ef4d3f4cdb3ac4e8dede7b0d39765e794cb10b4f80fc0921032967c7e0fd80ae41bc0413eb7409448d7b67a
SSDEEP 12288:WeBNUbTVO86Uk0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WJIUlgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D465CF7BEE28FCD2C27A8DB85691C740E7B278704B5293CBD164C20E9E235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9dfd0e5d2fbb5b5e7b7e7190d9a55b23bca555243fa3bd15dea68442ff2e213e
MD5 41d540692ee78c2ad8943dedb6f1c51c
SHA1 da89f1ca230b8cb7b0ff33f5cdcb876e45b4ba03
SHA512 1dfc245f043f3c913348f015f8994ee6b01c97ff4999f19a05075077709043da7c0e22d86b2c68e42432d972cfcda604e24dd9199f9fcf8993256c92f0579b7b
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THU:fQvGAdlCEL8c/yRNw5CvU023W
TLSH
T192267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 a458ad1139fa8aad49521df875b364cc19bfeabbae8ce5ab5b8b07efdf62e623
MD5 cce77edd60958d895ecf9b8b39c40fab
SHA1 b01693723fbed736cdb93ddbac956694737a0997
SHA512 e07e9640d2d3649b0995073f4a31407d2a727b77fe3f5799d820bff125be73aef76c543b74f114e80f25befa061c6003afa1b24e749fddc9704ef35d30f304fb
SSDEEP 24576:BmewsAjvgXe4i7ojhsP5Lgrk1TWb4AN5:gljme30jaNf1TWbdz
TLSH
T1A565E031FE74E032C3BB0DB21B76C712586C7A604B511AC3E3E89E9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 474a245c8eb9cb54588b0c38ee76810250f45170dc4dc3d8e88d25956d8c95fb
MD5 2b57c5c7a6e7e63501831b4233f23bae
SHA1 00876a1a6bbe54044fc1bd0657ea87f0c8e0496f
SHA512 c31ef85bee2c0a6c6681fd567914072e8c80211bc5c71fa5ee65e590835d9e7cdcbc8862b60b2926c20bfa171980a1464ee8cf05542c063b365c6925948fa221
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHup4W:hUEtQevvqc2W1cpV2EI32m4W
TLSH
T1F8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0a62330e49d4a9658c0304879da764aa39682ee7478dcf67b949bb744fed546e
MD5 48d702dc7953cbc13fda12b292fb27f7
SHA1 cbd20ebdcdacc348b0bc7e4f76c61fc43b146e33
SHA512 aa1b2eae582591bfaa72a69028d4afbde8be6fe46b545e5454cb7d07ee635fcb2a6ec37402c3ec44fee5eb549c41135b7486399e1acb97b672250108d36e21f2
SSDEEP 49152:zCbRquA/m2yL5zQfFiV+XenmE3/zGe30jaNf1TWbdz:MoqtVjnmrU023W
TLSH
T103D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ffef6a3b3ae4cb245b4f129eee897dbb71e9788274735dc62dd4af660177749d
MD5 60ebc52c9611d1e146141206a0b4740f
SHA1 d45243bae2baea2f81ab9a6aa735c7fc2cd3afa2
SHA512 ba9f56a902a11ef787d0b68b664c8740edfd9114915264d14d7a50e7f47426269ee0e5ffb015de20b77cc48c96c7e1ca1e91ca6af34f81dc7292e2a063c7230a
SSDEEP 24576:vAhGLJIFoiwtA5l7S53kgXe4i7ojhsP5Lgrk1TWb4AN5:vAMyFoiq57e30jaNf1TWbdz
TLSH
T10D35AE81EBF945D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 84aa37a37ae7717f63ac517940876e32b152e0e852c8a4a139ad350892b547c1
MD5 b76cbbc2e28e431b81b6c82fbcffcaed
SHA1 9cf794cc2c4dde2efd3b696944fbbbf70ca79f0d
SHA512 57be6495dd4af3cf38b1d22aee74340ad6af0e40ff0b6f3974251fe7f272e6a90460e1ecbaea5527f1d61fe7fa99ccde002509660f065f6610e09b1fcb7aae12
SSDEEP 12288:+mw5HEjsChN8BFgl0WDm+Cr0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:XwuxOW7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15455F14676A40CF9E5A78278C597C632F7F2BC412A21CB1F07A0C65B5F77261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 69b1d41fbd29184788d9e6eee9a429b7600e30a0b7f485eaa4f65c4995b2d7a0
MD5 8a90c10570857d900232a39329ce545a
SHA1 b1ad0a8942899d0a9718ac33e3980b7b7f5a5a0c
SHA512 ac78ce061691b5d80a5d37696c3506028a38572c839f1b07156e398686a8145fc51769511b869c0116a6168eec5aa4b5167bbe48a497bd0ae889603bb97cd245
SSDEEP 12288:DZZ1IyG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:lZuGgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T194451296379421F9E2978278D4F28B41E7B23C92233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1611cd9cf7194fbaae6e8eda6ab94afd84dda1f5858ab7910141a7f2527b141a
MD5 405fa7e7b5e13b94c396294fd82facd2
SHA1 c6e3cbd855a9790a6c0268de325c7c34779baefe
SHA512 a3a3747db54023281c32ed35ac5942b84812f9aab966d79aa986ea6a4ac11f6bf5911f3b843cd0f80bf3a0ab3d200a8f66a145f13a38a7b79208d9dde2e29477
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:5QRQyi36YOcPQLvw2gAf+PN3MU023W
TLSH
T109667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7f937b2fffcdb4fd2ddd5a48f1647de8058c4cd132270228a0bf6e7ac6f6f6ff
MD5 61015f97da7d622f3f2a422afc79986d
SHA1 2b4883a70b98944310f297e0a015787517463e07
SHA512 4817ea4b221785f89a5f198ac958e5f0a2cb6a113dc1b5bff1d2dc1a6958a2c32d6aff1dac7fc309f648a1a5618812ab65c22777fe788c10cb1a73cf8b4a4e21
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:MQRQyi36YOcPQLvw2gAf+PN3MU023W
TLSH
T13D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fb3de6457096e88aff35eac6bc7fbac67b00e7f3c07d55d7f889266bf2710d94
MD5 44b9c7b80cb9fb1db71c1e6bce19f3f6
SHA1 4cebaa4c35a8a5d4488d5e551d862bb81f625122
SHA512 5f5278fe57fce1ddcc4345b29edbedaedf07a768536620678432defa49e0141fdb7104c0f0b7b528401dc4c3e69475f9090ffcf99f7fd0cdeb6165d34adebd1b
SSDEEP 49152:y68Qg55nhheWu7PNU3/We30jaNf1TWbdz:wthWRc/WU023W
TLSH
T1FBB54933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8e7da8599ba759f02ea056113ad1815d45a47f910aa25e8167c17c6781e431b4
MD5 eb02612edd132ff7358d91b13e70d7f8
SHA1 0a5abc31aff2685d432fcc33f1992f03d29f38a5
SHA512 b316f6e2a701999dcf37721f724f36ff5e74dc0c63613723404208b8efd626093260cec0db3cf22a971f4c36df88b8fb813a59757e0eb3f2d360247c2cfa39af
SSDEEP 49152:L3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99C:Oy5112gYy5azzVvL69nLKnhZ1U023W
TLSH
T168168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4efd4fd74a5bad2cbd8b4a2c33cbbaa487a8de9496869559c562e5913c9f9884
MD5 5110f3309ac3754278a950867e439a61
SHA1 9b70e3b4df4cefeb7f45ebbbafaa09e849eaf8c9
SHA512 11a3fb490158ef26b7517974b7d6fffd4948b365980bf72c8f2ab3294612a72f7651573b3de73f4f92ac815c888fca29582fd363483f9286426672d5e69cae77
SSDEEP 49152:VB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glEe30jaNf1TWbdz:bu6JmVxd2dEU023W
TLSH
T161D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b642de0b769514e8b44f42acdb332b27326073e2884a231fbdc39ba773787461
MD5 980fc08be71db6db97e26ef6f3aa6ff5
SHA1 e1eff1a36744ff98c9348d55f110661d0688478a
SHA512 c763b3e3c4b50b22ff2a4ad2be71d3c90f72451c8fcc7a06de443b09b72444aef7c63d98941669266d5317d761cbaf2381d1e1a25cde189529796c52c2125939
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xQe30jaNf1TWbdz:0mifPbRrU023W
TLSH
T1EAB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1c37cf1a36261485c9a102bdade1c7b2f6d0a0e18b24334f3f74f8429ba0156a
MD5 a9612fcc05ea5b992f9173b88943685a
SHA1 38f3050fad2c02fff3a44680843b8a7011ed3a41
SHA512 7fb2b7bcfa2ba48a52893e75dab8f08c9f63e948778b5489fd0ed61b595b6428a72edfd51b6827f914bb5a3efdd6ef049caf3e61f7351e3cbc9de577725a2ee2
SSDEEP 49152:WSuZQIY0Be2KRRVtOnks6NMHqJe30jaNf1TWbdz:45dKTi61JU023W
TLSH
T1C7C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 65d23578d71043672020c6bbb77614f04e050a4359f76c9dd6d49ec55a4ab3df
MD5 39a46d343ab661f5e96fbe637751a070
SHA1 8fb04d6bd8e1f5a031957d3d58af595cae27596f
SHA512 68a9d875a1daf0a432756f4f8b14b7fa09e3216300f6bc3c7cceecfc0949a34b46b97b86d4fb796233c697dc26f7a5bc78efea9431a44a7da07bb1e47fc389ff
SSDEEP 49152:6htSn8EApI0figngiDn0AP5wUe30jaNf1TWbdz:7X2iyphXU023W
TLSH
T1A095BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 371c9adf0099bf7b12febc41e86e2ae7092e0589f2a192b902b6a9760255aba6
MD5 c8c30f06d33fd1f2f4b323bce1a59093
SHA1 ef4684e0b277ff8745a69a51f180485f4d9b9e86
SHA512 57a10ec9e552cb9d1cf2bbc26b37d547bb503ad54824db03b29e0e3a9642b89947a15a2dcab5c5875e83d2e805136a56845e3951b3eba2273277546871164ed0
SSDEEP 12288:G90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:GqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11B4523919E5509C6E34BC3F0D0E7CBD1E9E11EC272414A6B17E0F9531EFCCAA6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 14e7699a73433dd7e3fa83bc88b1824b20c695ac8a6e2eeb5cc03ba6ec0f3076
MD5 7ec7ed844466ccb53f2eaecc37b6a594
SHA1 e26febeecdf1764fd2fa0f5b4bae7541455bf9a1
SHA512 2a3807d3030db8d3a0048e1ebda9d857e6eb8a0957e3ee4d860ffa9e22ebf55fca167711e10db386402e7e8eadcc155b46f3f64fa180350e11a1396e12fde62f
SSDEEP 12288:za0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:zzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1774523A19D5509C6E34BC3F0D0E7CBD1E9A11EC272414E6B57E0F9531EFCCAA6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 6f2b06dce57bb8031eab0556a82b96e2f5338940feb77312dd7dfa720d8a1a0f
MD5 f82a6e3b54e0f0cb78757c3348fb8682
SHA1 da89d8dc7f9123f4088bf5ac4c4b0e5918c5e625
SHA512 16b1c680e55477fe5bbeb7d3c06f485724eb883eaf938c14dc86e91a1975d8d0b3d19e5a99fd2d54e57efcde677e6e2cc98086a7277d707a9bab54367abc3ff6
SSDEEP 12288:As0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ANgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1114523A19D5509C6E34BC3F0D0E7CBD1E8E11EC272414E6B57E0F9531DF8CAA6A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 45edf2b50e1e6d57b45d377e0d765ea76cc21a9084dac2d54aecbcd0d3a4ef1a
MD5 6cdd79c7091a42ba41d769ff93c23898
SHA1 3ec42ce224fc6a3cf9f350a916ce62c29d87b199
SHA512 144ed6859f256abbc2252b6ce189f813c48b407b3033e7f7aaca85138bdd9f5a2694f989b7e8e62f219952f5eae867cfca671b2dafe2e9c1ae9552d562655a73
SSDEEP 12288:iVX0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1144523926F5505C6E287C3B4C0F3C791E6F13DC173114BAF47D0A9530EB4AE96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 3738bd198d159adb9d655310867bac5e6676acb3c99722c69c2f1b98cafb8f99
MD5 e556e8f8f183bdb5a97662865f2b12dd
SHA1 3b95612284c2fb68ccacb951e8db3e9f120f5f4b
SHA512 f5bba7b410df8abc5323eeb3f9de79814ae9c026cd80ee178231f688dd9adf69e1d8d5d2e2a91acc9761ccc7a7f669c3d1ae20de417d010471a48315a8c726ae
SSDEEP 12288:uv0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:u8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FC4523919D5509C6E34BC3F0D0E7CBD1E8A11EC272414E6B57E0F9531EFCCA96AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 f15a49744bc37c6db1312c2bd780d6d2d480e30dcd4386d497a565bc7f302e5b
MD5 9c5c0479d197912c1ab5fe03209be6e2
SHA1 1216792f4e2a4dac670ef310a7d7a5725cbe4670
SHA512 f709112f0cc228c84ffbfff5e7b725f119e9732091d01f713cdfdfe74e1289f1b8b9dee5e6dae80b3fbc28ac9ec480bd16d22b1231bf730ade6aac6e44bc6ca8
SSDEEP 12288:K+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:K3gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10C4523A19E5509C6E34BC3F0D0E7CBD1E5A11FC272414A6B17E0F9531AFCCAA6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 c72b38295bbb826d8c146eea3c097d2d06658385fa081d304a6f6558361de159
MD5 6d859f3091419038aa4a6abee86dbbb8
SHA1 2e0f78625027a72497f12bb13dd5a14fc8762fb6
SHA512 e7fb589b3da9bff2c66e299955a4433898c54e4a5d2618a2d5ce14354e9780f6a6f85e60498113875b4ef9ca33acefbd58bd00d420b61f7ac6dc9c5708a341b0
SSDEEP 12288:LS0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LLgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C74523A19D5509C6E34BC3F0D0E7CBD1E9E11FC272404E6B57E0F9531AFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 170b678b7b12afd5349dff63abcaa9db079587626b6eacb3a1d1867a1548e9be
MD5 b2c43781cc464f62126bbfb0d87a4665
SHA1 bb95256ba1ef3684fdae71b6f93c039c727f2ffd
SHA512 b298ee4201bcf892eef18f18423f3fb5e4fe99b6c319280df1ea82cca76d8e928a92c98ae8c2c17f98f702245fc098d9a6985a0e7f04179774135c5aee061bad
SSDEEP 24576:pZMhzFVSOTgXe4i7ojhsP5Lgrk1TWb4AN5:pZMhzfOe30jaNf1TWbdz
TLSH
T12A650195B3500CF8ED67827EC8A68A02D6B27C561760CA1F03F436671F737A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 5c4660c36c38aba25f0695f0a4778df4a5020c607217176d304db582899311c2
MD5 74d508bd7f20d2a1bc41b3cb2eceb77c
SHA1 db02c18058111b34b32237f5af7f7158777c83e7
SHA512 8850169364f3a4e76ecba689446a3e2639adca23f6c9698b66ce30cd95d22de6887aa3311ad8f0fd03641f15cd72f8e909ee97ed75e66bc6a90acc07e80ea881
SSDEEP 12288:up0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:u2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10A4523959D5509C6E34BC3F0D0E7CBD1E8E11EC272414E6B57E0F9531EFCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 2c8d8e83851c9f7fe15071afd28858af5cdc5553c5174c89223bc0d6f88bdf75
MD5 21639bc098d170a7fd8e00821fdabd11
SHA1 7e6e755d9f29ddbd7ce30230664c7fad840795a0
SHA512 5b3a1b96cf844c1b3ff2b3d90ff2a62e570ebdbb5e5e4bc43d1dc8e24ab67a7f424e9cfab9dcaa0cd559958ddfa06b8962864e11361c4f237e5969b2a66afbf4
SSDEEP 12288:dl0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:dSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DC4523A59D5509C6E34BC3F0D0E7CBD1E8A11FC272414A6B57E0F9531EFCCAA6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 0a7270428c13aea7863fde714984180d682cd233454fa074db113912e4b16bc3
MD5 3a8de866b05941d9789fbfefcc13ae30
SHA1 196b3ed1bc999ce247e5e6114757250f32f31999
SHA512 73742412b534b6e5ed005623f9cc43dead3058bba64ff4bcc2f9c0928e7c76f3043251c1e5541a3f24b786ac2696b7be8b8b65cae2d0f8e74659b2842390df2c
SSDEEP 12288:3yPz5L8G0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6zyfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EF55025777A120E9D1678278C4E24B41F7B27C7217208EAF03A057732E776E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 e1db6aca35c11fcc44af4227a5fa37faf280b4d28224861eace223a02f855000
MD5 f77aca41e68fa159d7aeddb03b75e7d5
SHA1 9da0eced588f6a4b031779192f53e22eee8940d5
SHA512 b8f99de31b5608f571524b919b26210929be0c7d20eadd037262779aab968e80949339aafdea2ba9d1d1d1ec4c980ebffaf46e683b061c571be6d53413d2bc3f
SSDEEP 12288:np0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:n2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F14523959D5509C6E34BC3F0D0E7CBD1E8E11EC272414E6B57E0F9531EFCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 7830414ed4537a9513e057bd17b8fdc9154dcb86e3a08ec1ff61c006e1f87be1
MD5 45f2d0dca57a89ea118f18ff41143fc2
SHA1 8f96c006062001071bf13a8221c9300bd15c746e
SHA512 ab302ef5da9c39514478336db0d797d8adffd953815e7864fbfdadb611c1014b639bad10b11569506ea7ad105be98215f83ce9693ae342122b4bd1b85143f52c
SSDEEP 12288:Qp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Q2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FD4523A59D5509C6E34BC3F0D0E7CBD1E8E11EC272414E6B57E0F9531DFCCAA6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 a33cfcbd323bf45a55eccd340bcbd2fea2289f95a5ae1551f3fb421c16de6344
MD5 c21b194e8d00c6bb6179152961af07c1
SHA1 316e4b617bb0e38ca32c26c8b58d7486b416e689
SHA512 30dc200caea359f2c14e9f6dfe8cb565fd4bd320d589ef7faea2b11fbe0b8d7a8c86ca23f0207f298af91ca5f158c83d18bc5dec510beff0a193365aead98b6f
SSDEEP 12288:7yPz5L8G0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2zyfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13655025777A120E9D1678274C4E24B42F7B27C7217208EAF03A057732E776E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 9db50fce1181cdcccc7f3baccf89431b1a6eb43141362282975631d06a2cf6d7
MD5 2f25d858bfe6d540c68e75ef32159470
SHA1 3bdbfb4da53bb749b76582395c4b754266001261
SHA512 e62f930ce32881088004a68fcd7adec3f2efd942a861eb3f3a392c251b63779ff72f439f2888dcfce35924c6331f66fc9def888679053873e0a65925a4dbbc57
SSDEEP 24576:IcP4mcvIjkGOxhKP2l71nNKbrh/8KBugXe4i7ojhsP5Lgrk1TWb4AN5:zP4m4IpOO67W8Kve30jaNf1TWbdz
TLSH
T12E65AE2DABDC0096D0BB917485A58A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 beab1ac09048dee6c4c8cff02385fc3c755d1e66bf306867dec7a9a914689f9a
MD5 06d6466f523eca100433e02d92637643
SHA1 46121499ee6aebdbfe8dc07ad549ded10c390911
SHA512 a89e3f0c64f08ea35a573474c1b5263efde842f0014b70576c5853beeb3e113906c8afc0f3d8aad633393fbf3aaa8146ea7bb1b5e46bae3f02f909016aaa240c
SSDEEP 12288:6ysfZ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:eGgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15455F15AD29802D8D15E92B4C3968A81F3733C5193E1C7CB13D0F93E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 11791f10cef539a54c9948daba1a3386ea1513bb9ba32c3564049270b5891152
MD5 564a3aad6ef6f5d3bfcff557864baebc
SHA1 7e54bd357b48ecc11e6eccd80aa1f474381d0607
SHA512 b886c3ef5df32de2c0845ede62e9d69ffa62be5a27219df5d49059b9efb2e543f9578379aedb594b91d2c0727f35aba1eaafed7070dc87ca7bb8b14b7a11140f
SSDEEP 12288:f50DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fmgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1504523629B580DC7F29BC3F090F7C760E5663FC17B008D9B52D0BA5319B8CE69EA8519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6c1a6503fe594c5501838e179149fa7e28fa56ef1acd9289395e2a8e8d23b727
MD5 7df13b2a4c15030bffaa29fc714b8f9f
SHA1 0629bde6419a61622335e04259880aa04bc61039
SHA512 96ecd4d23d55597c1fcd77105551e522bc705b78a768b6df25f2e03df3d969aa9e3c894963f9b29ed38ff22030cd3bcb02c1a6a85f91c5f010710f68e0c82f34
SSDEEP 49152:Ka0h2GEkuAe73q3pp46zwwQTe30jaNf1TWbdz:Ka0hNYG4JwuU023W
TLSH
T10985AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 ef0bab18ed8e0de74b19ed2b18a0f0b2171ee8f7038adf678c16427c1ad450d1
MD5 7760234f6b079d8fe7130f64ae01facc
SHA1 7b265902acce96e8306c15b51cd8b0dcef9e7092
SHA512 8d74a5bdadf5107f4c7b6bcdda8cc50fde20d166f7a6ddb02573ac7740f0fde14657a278c78674a340446ee06513f5beaae520efc0604ab8238736e7734bb0b9
SSDEEP 12288:shbHjfXK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:shbHjPDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1404512BE1AAC10C9F276D2BC91E28642D371BC55271187EF13D1927A0F3BEE85D38A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 52850085c96aa0ec3e295c58b4fc6339a719f4b1b2228917335d008569f8c7d0
MD5 9390d5cb903e3d5649fef88c55725c75
SHA1 4a6d5186d4ff5bcf80e4e20dc449b08b89dd3ba2
SHA512 353baeba575648307646f5289697bcaeedc9bcf0f28e45b5e27154d6444ae945b08f082f6f0e9fd579651195f9e4a424200edf508ef866edf8f75945a0d57ec1
SSDEEP 24576:f3YgnJcRTk4yti+R5dBR/7gXe4i7ojhsP5Lgrk1TWb4AN5:fIgnaTk46pBR/ie30jaNf1TWbdz
TLSH
T1CC45BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.1MB
SHA256 58946828a6ac732959f91d46876d65e295509719cc76da8a0d8a8ce748669dab
MD5 0ac90207d168fef44a86fe807b327ab7
SHA1 4bc957a4030173a931069bac39fa3c7667ad3127
SHA512 ac2e3a5ebf4a7f563954f415ac61a1919e7d6d95c2c52779f0b3ca3649b152816ac37eb45362ce9e2d614b189b3b4cc1d66b4c19a6af9e0e4a456357513e017f
SSDEEP 12288:F10DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FCgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1413523959A5509C6E34BC3F490E7CB91E5A12FC133014EEB16E0F9531AFCCEA6EB8458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 d5b4f5894ab569f438e2dd8ff1fbce9d3472a741fa34be4325b42ad5b55d4682
MD5 19876fb2c580969341675198c9e904a4
SHA1 4d231ebf8a0bdec53fa0c956b0023fa7688cd023
SHA512 12d48c063e7b0a922c160724500691e18561338a33460d653e9bbb49ebd13f69bfaca11ce1e30561c1a247f890db9435d128af45d2934c1daedd18bfa10b6df5
SSDEEP 12288:GObGA4LWOsvAYFTI0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:vWL3UTpgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A265F155F79400F9E96BC17CC4A28A12E2B2789D1364D7DF03A88B661F637E64E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 ae484e5ce78deb1471c1c65d858f584cc6435a8b28bb90d376d6fc7eceedc66b
MD5 6d670e3e59e66807903d564ba8a312f2
SHA1 e7fc49c6e26d839bf45179d9574bb5f2da1a02a6
SHA512 dd98f3c6b21ac133dd412c05d2d41e80f771de30a19011adb5a7e662b40a16067a5b2917f1776c942c41a4d955d48e9d3d2e6b853bc86e729d6723018c5ac37b
SSDEEP 12288:8pFtIOE0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rOFgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13745026A37EC10D5E16A927C85D38349D3B27892171147EF02E081BE1FB7EF86C79A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0e09f4134f2ce8529463ba31824439691afea52774570fe19f11b6123fda07b5
MD5 69f36d611b4310602db4e4eb7d3560af
SHA1 85b2db4b75079aa38b2a2e8742eaabbd22d5eeb8
SHA512 cf495485a3ead806ee6322fa1d3672c4db8e281491659ff150fb850e892be806f73264daaf49c12da03b8246b3b09b4d6661139695efcd8b2ad7dc29ab128efb
SSDEEP 24576:t7NM9YqZqmWMUkPjZM48Mv6bEhs2gXe4i7ojhsP5Lgrk1TWb4AN5:t7cBWMpPjN8DbEhae30jaNf1TWbdz
TLSH
T1DA659E2E6BAC81D5D577D13DC9E28205F6B2B4611B318ACF1262833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2fd907f6a6f753070700e592f2b1dd7e1ddc119e63cd7c6cee71e8369346573a
MD5 0db0d62a1a2d4b3385e18f5e51752af2
SHA1 78c61109249de246b2f7b77229c7e29b78d68f4d
SHA512 277c241d7427462b67feb4a0869925fd60b8a4644f5b3f5c8336a83a364ec3d2069d63e36fc97772bcd4fc29c02ac89530b2017e3237b1839389b5be90e4053e
SSDEEP 49152:2F2YuHNETovAvNYf8km5e30jaNf1TWbdz:36BCf8kQU023W
TLSH
T1B7857E6927ED80A4E0BBD27D45F6D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 71e7b27bd75d5ea7dce80e27cd9f7d6422f06aad1abb81795ca5a6085bca56a5
MD5 30ba3a20f0599d0c4faf5073ab5fe938
SHA1 73f61b59a94814946adde17ce77931b958315ac8
SHA512 6ad5f89600455afe49b1c1a4fc3bfc5506a70ec383d3e96e38593c5d771e6bc3ad322c2801b09c65e1fb84f9752a484849b772e0c9a9c845162924b4912c319f
SSDEEP 24576:fAFs06+Omlf3NXEbToRgXe4i7ojhsP5Lgrk1TWb4AN5:oFs060lVXuze30jaNf1TWbdz
TLSH
T1ED65BF2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.4MB
SHA256 9c39b8a09ba900d34e71a23bb4fcc0346735e3e8d2cd768d7865fd8499ee370b
MD5 8cbbfe5ccdf6c7efa99a5b4bc16ca7b6
SHA1 210b6235c603ae2d58482c163a4c45a0956a9a54
SHA512 a3c0e3455e8c054060cdf2f2e4c2d0d9d0354d25bdfd2c218a304fab8b160e18deb86e52dbc72aecd3439c81f9d6d24e4ec94cd2bb55ee7d8277d9cfdc5fee05
SSDEEP 24576:RJnJ5D3WEcgXe4i7ojhsP5Lgrk1TWb4AN5:RJnJ5DGEze30jaNf1TWbdz
TLSH
T11565D02DD2A810E8D0B7C3B4819A5B95FE72386D2F226EC714B4D5353F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b1ffaa05c13b7db8081e008009f77d106e9646879f2a4983aa8435a30ae2dc4d
MD5 58b666a4f7d99d17fd5837c006066821
SHA1 ab38c4ddb0799aac3f5802c75445b35d4efdc665
SHA512 46f1dea6dd5ff1df69862657cdb2f1808ac8ec6dd401e5ca3b1c22dd38395b217303ece8dffa4cb67e36233a32caec0e832f66346450a29a523fda2c5969f1a9
SSDEEP 49152:7g06DIKdwc+eQnSt65aVNe30jaNf1TWbdz:0nU023W
TLSH
T127955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 4fe814a3be06731eb724ffeedd93f86fe586496d28a78d4ce91a750298e07417
MD5 303da4187049360143e9c2a24e831e50
SHA1 77491a8710d1d6e9ee40cd2e672809ede236ee92
SHA512 7218d015c713de414336ff005658deea1b2065c1b5537701d0f3e472434679cf40f3f75af64ed35140f95a76b717d64314571bff00190050abe65e51f4f64916
SSDEEP 12288:jEP3RYr0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:oYIgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15B45126D6B9C60D9D16BD17C90E28741D3B2F4A127421BEF06E0D27E4E779E92E3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.2MB
SHA256 3ef31ac75bbbdb189248ceb75200e6256adda878edb354d61ccd69d8b9398f25
MD5 ba7aa07a432a514536146bc76aaa816c
SHA1 ab9118291e810da3430c7ed636cd494f6916f609
SHA512 3bbed8e848f2c804466782f546b2ca0c507c8bc1aae86908cf3b6d10079e7cb69e93ac70a12e4bf5f14cda9a5d808d920b2f90d7d9e045fa66eb1f0879339352
SSDEEP 12288:Ujkya0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UIyzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T139551244679414C5E2AB8278D1F38390DA71BC602B1047EF52D0FA3F6F7AAE4AD74B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.1MB
SHA256 eae17a34816564fe1df2f3bc9c674b9ca3a5b3a3b8f62c8bba0387908bbc934f
MD5 24c4c5d4a676de41a8ec9c584eb42d74
SHA1 5bddfeca15db5fd12856db09355f406890a9375d
SHA512 08a9ae48a3aa6568c9d607355f43c2a4f5865e75b32ac5b3baf86d4382b08825a62b7cdf392ded1ab5dbca66cedff8369168b21ba205d24d50d7a2f76c793dee
SSDEEP 12288:gqU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:V1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E24523A95A5519CAE247C3F490F78B91E5B13ED137000DFF12E0FA734EB88D66AB4858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 1834e07348ee3768a7d719bbd8d4e69d11d20a44ed86eb92df2b9c4460d17c3f
MD5 63e7a28380acc23e6d715a2f389f669b
SHA1 444af1a68aa22d19c50b4a7eaed1e0830a85d7c7
SHA512 dae98e251336bbcd68ca796c0eabb44ee80386395df7c53838a5094a3a87d9cc6fb23ac55b49fdb357820fc01b8897cd47605b65634aa35bc127cca711c79c33
SSDEEP 24576:jQ9MxZKdcz9dw3+gXe4i7ojhsP5Lgrk1TWb4AN5:jVKZRe30jaNf1TWbdz
TLSH
T191557C2DABE909CAE177D27595A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 b1086e9c9b484121e7dfc72e107d88f0999005b53e184e753a43cc90cdad2ea9
MD5 f3726209109ee5b1aa15bd6f878f6c26
SHA1 85015da4ba941b511a16f44e6d1e83b9d0160d5b
SHA512 dec98378c4057f5868b4531607676d12762f1756520b8934c5c1ecad0f68e74090ee3b31bd0c089fb88841c1e1f72e47c266e03d3d347bf31efabcbb8ad4a651
SSDEEP 24576:Nyoc0ApvgXe4i7ojhsP5Lgrk1TWb4AN5:Qoc0Apme30jaNf1TWbdz
TLSH
T10255E01FBB6900E2E166823C88868741E7B3B4702B5257DB52D1C33E4E779E9BD38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d137395e0318ade9a9ba40d3faf8194da5c099a42fa04af62e2d601ddbac39b3
MD5 d82895241af0a3104aa8c7d8e42de5b0
SHA1 412b705cdd6912d3c0fc5d4420264e6115eed346
SHA512 deee494d42e6161dbcc327bd0ffa9329853f76217c4a903a20444b1cde10a9542198d38f0a9cfb61e0d52a85e863e2119e2a78080e004d5ab2f0cdeae61936ab
SSDEEP 49152:RWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKme30jaNf1TWbdz:J0zuNIUU023W
TLSH
T183A57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f6650e8206ac1bef014d5735dd5b3b8f57e3ba32c21c20281e7f0d844e144f9a
MD5 6596872ada1014b96dd797541f44d61c
SHA1 4b4088035989371f3856dbc20155706d7222078a
SHA512 4584caa84136f999d75a7a04f4db3499cfc8a4e8d893c04679cbabea7490936b6c73142f3bcdd70f12bccd5bf92a1f2e9864675c54a405d58d666b95d397ef9e
SSDEEP 24576:I1QT7EcpfxR+N5AWAz3ooiYtjMqbIgXe4i7ojhsP5Lgrk1TWb4AN5:1TDxR+N5YzTfjMwe30jaNf1TWbdz
TLSH
T1B055B02EA7F815E9D1BEC5789A23C512FA727851033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.4MB
SHA256 23d9b366985719fbcf8c3569af8aa5404ad748f701ac2edc2da2ba4fe975689c
MD5 546c678d45ec9c628caaa413d6edc9e7
SHA1 906a16f3d22f46a3b05b811c39ed78bdf6c7b1c5
SHA512 51dc17ac3df6e998941428c4f9bb8c24c3ac47daf75f860e0a8515e1af2bc7f1e85f745e8994ee285f17192a97f45bef9e7877fd1a9a2fe00c9eaeabbeaae4c3
SSDEEP 24576:eTMdOz0FFS+PmSLEgXe4i7ojhsP5Lgrk1TWb4AN5:q0K+PmSLre30jaNf1TWbdz
TLSH
T1EA65F17EA76D14E5E17BC27CD653CA06E672386103116ADB06D0C17A2FABEE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 961fa5f491bebcb4a5e3800ae18a795a78d9583858023abfbfbac3f64dddc57a
MD5 b93a94edd11f201a1ad60fb00b1fb6fa
SHA1 9cde91081884fd37f781262ac41edbd1ca2bf4df
SHA512 f3d02d9aa8035bfc1dc0c34bb630692a0db9b15b6a468840a4eff587684e777d90b05fe94c2a46447119023f6a59425b3c5e7372a3ffa414ae9f48a1f4af2835
SSDEEP 12288:Q4dI0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JpgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11345125D67E824C5F167C2B4D1B78341D6707CA223100AFF26E0EA7B4F7A9E89978B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-111-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/204-117-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/204-251-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/964-262-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/1072-259-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1380-82-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/1380-244-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1380-88-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/1504-398-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-387-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-400-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-399-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-397-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-381-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-385-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-386-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-389-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-390-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-391-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-392-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-393-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-394-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-388-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-383-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-362-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-363-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-367-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-373-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-377-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-376-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-375-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-374-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-372-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-371-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-370-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-369-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-368-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-366-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-365-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-364-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-378-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-379-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-384-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1504-382-0x000001600C010000-0x000001600C020000-memory.dmp

Download

memory/1668-353-0x000000000B360000-0x000000000B368000-memory.dmp

Download

memory/1668-168-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1668-264-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1668-152-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1668-380-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1668-350-0x000000000B370000-0x000000000B378000-memory.dmp

Download

memory/1668-351-0x000000000B360000-0x000000000B361000-memory.dmp

Download

memory/1668-186-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1744-16-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/1744-355-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/1744-25-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1744-17-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1952-100-0x00000000006A0000-0x0000000000707000-memory.dmp

Download

memory/1952-245-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/1952-95-0x00000000006A0000-0x0000000000707000-memory.dmp

Download

memory/2556-60-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2556-54-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2556-66-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/2556-64-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2860-345-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2860-12-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3240-248-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3240-359-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3660-41-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3660-33-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3660-32-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3660-360-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3728-261-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3752-67-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3752-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3944-250-0x0000000140000000-0x0000000140121000-memory.dmp

Download

memory/4012-246-0x0000000140000000-0x0000000140120000-memory.dmp

Download

memory/4016-257-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4164-344-0x0000000003CE0000-0x0000000003D18000-memory.dmp

Download

memory/4164-8-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/4164-356-0x0000000003CE0000-0x0000000003D18000-memory.dmp

Download

memory/4164-358-0x0000000003CE0000-0x0000000003D18000-memory.dmp

Download

memory/4164-0-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/4164-1-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/4164-316-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/4164-357-0x0000000003CE0000-0x0000000003D18000-memory.dmp

Download

memory/4332-128-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4332-122-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/4332-255-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4484-72-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4484-78-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4484-266-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/4576-256-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/4672-135-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4876-265-0x0000000140000000-0x0000000140144000-memory.dmp

Download

memory/4988-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4988-361-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4988-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4988-243-0x0000000140000000-0x00000001402D4000-memory.dmp

Download