9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
Size 2.0MB
Sample260930-gp615ayva1
SHA256 9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b
MD5 ae4bf61b353bf368c35f4c8f0c88d4a9
SHA1 93cc0b4e092b7fdc3be095a580a5cc0593d44bf5
SHA512 64d897601fe93209c4e0b8a6d99919e5031083b9119248223ff716f639cfc4d81ad6c101c3d6682ad7e577e1ce33f664548543e7051b1e1d0c2dc0a58c1f65d4
SSDEEP 49152:aaWecIr1wdryNtegltLyvH88YzRp5/NJwfJ4klKXn0:a1ecIr1wdCtzrGvwb5/rwfJ4k
TLSH
T1C5A501117692D036D6B251B05A2C9B36547EBE700F6248DBB7C05E696EA02E33B34F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
3972	elevation_service.exe
4792	elevation_service.exe
116	maintenanceservice.exe
1196	msdtc.exe
1688	OSE.EXE
1468	PerceptionSimulationService.exe
3296	perfhost.exe
2392	locator.exe
1768	SensorDataService.exe
4832	snmptrap.exe
4660	spectrum.exe
1268	ssh-agent.exe
1548	TieringEngineService.exe
1412	AgentService.exe
1168	vds.exe
760	vssvc.exe
2572	wbengine.exe
1220	WmiApSrv.exe
2668	SearchIndexer.exe
4168	alg.exe
4280	DiagnosticsHub.StandardCollector.Service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
\??\F:\	elevation_service.exe
\??\F:\	elevation_service.exe
\??\F:\	alg.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\System32\alg.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\System32\msdtc.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\wbengine.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\System32\vds.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\16263f0862f6ed0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\AgentService.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\vssvc.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\dllhost.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\msiexec.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017bcd-327.dat	upx
behavioral1/files/0x0001000000017046-326.dat	upx
behavioral1/files/0x0001000000017007-325.dat	upx
behavioral1/memory/4168-589-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/memory/4280-609-0x0000000140000000-0x0000000140166000-memory.dmp	upx
behavioral1/memory/4168-622-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/memory/4280-623-0x0000000140000000-0x0000000140166000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe448effa050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000633ae0fea050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072df42fea050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7d6ddfea050dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b9ce2fea050dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005837fffea050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000afe223fea050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027b0d6fea050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3972	elevation_service.exe
3972	elevation_service.exe
3972	elevation_service.exe
3972	elevation_service.exe
3972	elevation_service.exe
3972	elevation_service.exe
3972	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe
4792	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	740	9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
Token: SeRestorePrivilege	1548	TieringEngineService.exe
Token: SeManageVolumePrivilege	1548	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1412	AgentService.exe
Token: SeBackupPrivilege	760	vssvc.exe
Token: SeRestorePrivilege	760	vssvc.exe
Token: SeAuditPrivilege	760	vssvc.exe
Token: SeBackupPrivilege	2572	wbengine.exe
Token: SeRestorePrivilege	2572	wbengine.exe
Token: SeSecurityPrivilege	2572	wbengine.exe
Token: 33	2668	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2668	SearchIndexer.exe
Token: SeDebugPrivilege	3972	elevation_service.exe
Token: SeDebugPrivilege	4792	elevation_service.exe
Token: SeDebugPrivilege	4168	alg.exe
Token: SeDebugPrivilege	4168	alg.exe
Token: SeDebugPrivilege	4168	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2508	2668	SearchIndexer.exe	116
PID 2668 wrote to memory of 524	2668	SearchIndexer.exe	117
PID 2668 wrote to memory of 1568	2668	SearchIndexer.exe	132
PID 2668 wrote to memory of 2396	2668	SearchIndexer.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe
"C:\Users\Admin\AppData\Local\Temp\9af5f8ecd93c448136154e3589b2939a96dba1ee90b9afa6ba1d9d7f393d464b.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:116

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1196

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1688

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1468

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3296

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2392

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1768

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4832

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4660

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1268

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1272

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1168

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:760

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1220

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2508
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:524
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1568
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:2396

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4168

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dc0a234edef72ff55540bf3fe391252b29a664ff1af24805f53f277b82c191ee
MD5 238cc3815b4cc3600fcba2397a5c9195
SHA1 1ba0fb0aee11c0cc0eff7e8977d81cdaa104968d
SHA512 cf30316540eaae501ebc00b2059e770b44e800e4887c92389cd4992a1fee0f34141f62f52a1e2864810b45864c95d8512f66051ac04a474a650421c771bf6508
SSDEEP 49152:Fb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnvfJ4klKXnJ:b3q6mjBMfJ4k
TLSH
T1E7D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 b7edf18bdce275dc083f056531ec1c7b62595f9667ba5f77b06ee10af9ad41e8
MD5 2055a5ad9b6afc1b4a5244a0a9423003
SHA1 e8a6420db976448d29b173a009e165359639bd46
SHA512 b01b17350b6481b0c0afb2287081b33a2988480c229d580abda565d62baf459bd5d390fffbe39491ac57c27acc19287dfb9162942f132c9c083a84aaf79c413e
SSDEEP 12288:T1XLsswWkxy2lRq2czA4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S2:JXYfDtczA4fJ4yL/tNCJPXUQrPh
TLSH
T12305F12973D008F9ED67827CC9A1C101EB32BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 be297c623057b3d3ca0effb2a80618d1855f9423e47f7f7a7c5ad40c3b2b85df
MD5 2675ede485a19c25de22e93164f5dffe
SHA1 c4602bc0d025b5dec3fbc8ee187888bfbf125b88
SHA512 9a1d6c7a786a3c939e500ae763ba0688be59b43f99e95ef1a603baa23460ae64866b403ecbabf34c175cb6dd4b7c64f4068d22095eceed0c6436423c7ac3c10a
SSDEEP 24576:10Le5ji0hmxhrMHfJ4yL/tNCJPXUQrPu:1Pji0AzufJ4klKXnG
TLSH
T1BA35AE26F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2ae5197c2f4a3e167c40c088b985bf82de33aa76009f9199e001f92681d29bcd
MD5 049808b4c22e63807f59027ef9993fa4
SHA1 f687c1c2b3232daa01f4d71765a192e24ea5eb1e
SHA512 6ab3a94869c794a0d883b72d1f9551d0e7163cb95478eb3a92fe642ccc7389912bd754af5d3af366d5dc606abcf08e3e02995f1be5d114e562fe2b8cad9548bb
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWj6q8wyuxfJ4yL/tNCJPXUQrP5:K/ezSC6vUzPv+HjyqfJ4klKXnx
TLSH
T180756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ccc17af04a9e6b4ba156b09a7a13ea1904ceb2fb3a2c39f1cc78a7db20a0823f
MD5 95c8c60806f60df50c23f42674dbf621
SHA1 a067d6ce5cf110501c80fb11b169cf876137cf03
SHA512 d3f21a660b2f8d6da68276c836223c356281d9c8958eaa987017fde4dc0a670f5e6d0fbb5a5210071de463033410fb1f0f0d911d4460470ed4a2ef79ce0886f7
SSDEEP 24576:mVbqPb88hv/l+B8fJ4yL/tNCJPXUQrPX:mVO88hXl+OfJ4klKXnP
TLSH
T15F559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 dff1e5cd4e23e94cf4a8032c61855569c39d54c38a230f34b8f86cb06fde5502
MD5 977c26ecf7ef47bc691fb2393f341550
SHA1 e73ef5e3deae32ce295a1981ea88ecf49666c9b8
SHA512 aff00ae4f3efe1fdd139eaa7b3107daac8bb18e97f198b35812d916f0d21ea37c4ffbeec776967a8fe31134415b4eeb355cacaffb8e1edd8586e139d2653f0af
SSDEEP 12288:TG7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:TG7fJ4yL/tNCJPXUQrPS
TLSH
T1E6C423E751849086DF6A87F82A88F001C714BEC5562FA2E7CE42BC853FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 6d8cd5fd6a60d53b858487c773c34df6c376b0d6f82b027e98fb48e42c61ef04
MD5 d636e9a9d7e6e25b4140549a8fab7136
SHA1 dfa5b7e1493d20f38393c1b178aa20559f1a7f00
SHA512 0113d4f605d0367fbf1b26a831c537e763cc4d3023bc6b1729d503745f095a89b01e309467582129b664e01de189aebb84f443bdbe7cea7a8b4177ce15af54ce
SSDEEP 12288:EeBNUbTVO86U0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:EJIU0fJ4yL/tNCJPXUQrPB
TLSH
T14905C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d6bba1df3ace7738e377954d8dbaaf146871b8372f04e701a5c6aa773d81e3d2
MD5 00f116a7c322867c0a6a8d128faed09b
SHA1 6bf9d058975408da5858848f652513c523b50fde
SHA512 bdd2e9de414fbb22209b22a8c6c6bc995eeb480864c4c7f8b1ccb4c788c0ce069142dc007cb0123f6e774ad4a5d8c46ae427f6be847e9828bcea50ff3a55e85e
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THJ:AQvGAdlCEL8c/WRNw5ChfJ4k
TLSH
T102266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 7df18a6e4dfb210c3a43b463a32cb25049e58830d6fd11dbe48202feeeccae66
MD5 912eb4c74ac3258ec25706cd8d0c85f0
SHA1 bdc3f337526822fe45499f057cb3135a412d96d9
SHA512 fe3058cfc9ebe41405863375e98481caf48a301fe2ed836e7eb09abf0f0642c6c7a94650d49240b3fb9fabeff56eaacbee7ab1a1d63f66492371751aa24ee1c9
SSDEEP 12288:FAwSfxL/2Dc3mDLLmt0LDQewsAjefJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWp:mfewsAjefJ4yL/tNCJPXUQrPX
TLSH
T18515E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cedd3121bcfcf362b475b67570d05f054abab38b64c72e09812b845c2ed25c6a
MD5 4bfb40e30748f46733f4988832abc35a
SHA1 3e20301c4da190b9dfde2de64ac7243ab07ee041
SHA512 b58d3a569d3be3489a979a6ffae622b047ce949716b40d8c617ae20c348f84c1ecd26a13e9731857b13af4b299d4e1add60bdda852e16251f90a515293f961d3
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHGfJ4:yUEtQevvqc2W1cpV20I32G
TLSH
T168474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 296ede44868719b557596e3474ba817670ae701972cdd0f84aeec0b65c117971
MD5 8d85cead66cac75cc268c42774096792
SHA1 5e275390a4e8768fcf844c361d57bdf112b1f0a2
SHA512 152462a1fc379210c204966820cd9a0807b6e7e97e6999b8f8bc046b2a60c0f0889b785b6f44d565d0c2b23c0762c9407afba1457c62bc26eb0b9248786564c4
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/z+fJ4klKXnu:LoqtVjnmNfJ4k
TLSH
T147D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 49aaa236090ea0eeab50e76dc0ce75e358bfd2998edd4c991348fe1575eb6c7e
MD5 2c90cb1ceb8d059e90900871b0b8fd52
SHA1 1cbb8fcda910f32d86f65761817d1709c0272d5a
SHA512 5c0f3c67e1492828508bb4f98246309d3a0cd177f84b2328224e27fe24f9516137af179ed4c544cd0a444fd6771a2980cf52d398fc5eecc86ede441d8aca473e
SSDEEP 24576:IAhGL6IFoiwtA5l7S53tfJ4yL/tNCJPXUQrP4:IAM5Foiq59fJ4klKXnQ
TLSH
T1F1359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c0fb072246c5749f903821b13b511fc2d3c033b9a6075612be7871090e2f5c18
MD5 de0a2d86ce6d6bd9f774fe672ad63a00
SHA1 7b6e024ab7c87007c7889fd967c0695fe20be117
SHA512 b63fee41315d531e009308e5fb83a348b0d1594e6876645b086373d75e995cb9b639ad556f376d1ba8bdb175e4026e4b26700211087c3071542001ebb7ffeffe
SSDEEP 12288:pmw5HEjsChNEBFgl0WDm+CRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTY:kwuROWKfJ4yL/tNCJPXUQrPM
TLSH
T1E505014A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 a03dafe6bb39c19f52a71e6cbab6e53a8016b050aaaeca126be97d06e0c33575
MD5 e652734927bdd0ba7dc5808d37bbd873
SHA1 80329fd5282bc225e9f53dbb8411ebe39c3d8542
SHA512 3ffb3d7b1267ed6e4b296244bbb2005c6a0c28d5529f580967bfdfbcfd5093a6b15cd2944cd2b15542ed0fd4df7158a84395694d2e47f01411838d03fc75b4ec
SSDEEP 12288:AyZ1IyOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:FZuffJ4yL/tNCJPXUQrPy
TLSH
T172E4129B32D460F9DAA782BC89D4D101D3317C92233A53CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 011f8eb51eed96df2657b7fbf06550a763a116630b92359fbb5a18211d89bee6
MD5 e67e41613e9f7703ef6b89a8e740f6ff
SHA1 414c70eeb917db609209fcc03dff931e4aadfaa1
SHA512 92446d03657be64fb20eeb1bce4e34efa840fc3e40aa89e44e4d2c50f21c00b5fe9da8928b29928969ab5ab147c601f71878d34fd8f24bbd8c0546af62549694
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uh:uQRQyi36YOcPDLvw2gAf+PN3QfJ4k
TLSH
T18E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 224694d28b6fc6924c80c8b09bc18bbfb45dc4366a4ad117e8751ca8a1095228
MD5 ed8df3e862f47033e0bfd1a0f0a226e5
SHA1 cfbe35fed38d600d5ba453b8c9c11173cb27562b
SHA512 45f965eb1259e5b948ebab970daa47995deeb62d564f2ab051794762980a7236e1875efdc84643f8063d541cbe3513b8a19bcba10e16f54a90e57b4267d4eee6
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UJ:xQRQyi36YOcPDLvw2gAf+PN3QfJ4k
TLSH
T12F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7bf074ba4b0a4c64094fef38426e21702248a628e89b8edc8c09eecf7f76ed91
MD5 6b34e8a1b86c07c715f9b753bced37a8
SHA1 c80e611e30d463b33d9fa9ce0c10e052153f6d0c
SHA512 87475c87304c71b042736637187f422ee942bacbf16da8b277b7cf51f44c93a23b2275824a9cd8c7b4895cf5c054769a8b344d335a7f8cfbb8dbe815b9ba3598
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0vfJ4yL/tNCJPXUX:b68Qg55nhkeWu7PNU3/ufJ4klKXnI
TLSH
T1FCB55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d3839b52f1966099584b9c8175e8144ce32c167cb9847813700fc4aadcef6972
MD5 5a7ca45fa8ae00580228c4f2811bc0f8
SHA1 1ef0c68fec19b279c71c05a53df3175b7ea0e6d8
SHA512 85c7dbb69bf4dfb559a713084a2c40cef3a3d762a5723ec249fad37129e4ae09a6c38001187fa2371392dab8b03565feb7520b087e6e0a3f0b478bcb3bbb5372
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99Z:Dy5112gYy5azzVvU69nLKnhZ7fJ4k
TLSH
T196167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 85e99b850ef47fa31031d46fab9bfa4e16960a30d572434fb4ce6533424bd8f8
MD5 184e6cd21d506beba290841ddbbef6ec
SHA1 52d48caeb09751c9bf463f1bcf1ce05526de4ff3
SHA512 cd8ab6ace2fe8e795a867a4d7b27fb08e70516d9608de939e36b8bc3689b83b2b5cac2905804cc563bfccc5a2edc35c22359983ab9108708dd57dcda83f10175
SSDEEP 49152:HB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glIfJ4klKXn8:Ju6JmIxd2dIfJ4k
TLSH
T1AED59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0361bc37a08c3da8cffce668b4f762a5e48978d52e183514008ac0d17f1ce42c
MD5 082092e6ccb3ed3875f358041be9c0fc
SHA1 f0105a37c65fd8e0c171aa724f81eef27d08ab11
SHA512 b2fc7a48fac2dc4127e493fc3fc4c9d947687e5fab7ac3ac188aebcf305616b16fa81005e5d772f8580f32b922484bd194e4976eb8609c7c2eac92d54ad43c95
SSDEEP 49152:o1hpsNoJpF1A67U44CwH7R4xUfJ4klKXn6:omifPqRNfJ4k
TLSH
T108B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 14259bfe36c7719efa2080ce9d39afbd8b7b6e256a2b5114850cbb26788d5b01
MD5 d79730e06b95060abb65a8a57897be47
SHA1 33f541a058a50a0ad9d2a0246b2e8146b031e7cb
SHA512 d719912c00deafa23b8f612f0158b9656ce92e518581ee1c17229eea47097c4628a564aef127506fe339c237108c9c3466ae8911a7d485161ecabee967cc470d
SSDEEP 49152:7SuZQIY0Be2KkRVtOnks6NMHqffJ4klKXnr:p5dKqi61ffJ4k
TLSH
T1DCC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fc30376ce9130dac0c36e96f7d92ebbfd0cdf3e28772ae541994e980009263bf
MD5 398e3640ce5c7290205a23876ddc7c6d
SHA1 3915ff8006aee714af7a150e24809252a43471fe
SHA512 a055d857c8c42b87cd2cb0388b5e5e3f8247b11b06d56aa91166caf4371f1d96324b3b592b55c25ca2ef0a2bc710ccabeb3c169dd968cb86b92d583da5e80eba
SSDEEP 49152:0htSn8EApI0figjgiDn0AP5w4fJ4klKXn1:VX2iWphJfJ4k
TLSH
T1DA95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 baf3d4051d4bcdcfeeb2bd77ab648ffdccb049fbe18f72cc93c141c2140a49bc
MD5 e1593d6e210a82122ec812e36243de6a
SHA1 9edfb61b3e457090a10c8fd1c77807c344b6faab
SHA512 3f1d6f1f8f1f86bf7c06811c8847124aa43fd22d93dfc0f93f63470ad1bd0307c3a8e5b3d5699548fda0fb43131c7566f1044d822c11594dd6e0a5a6d5a3698a
SSDEEP 12288:/TfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S4:/TfJ4yL/tNCJPXUQrPH
TLSH
T175C423AB60D5948ADE5587F81688F001C3047EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 d8e5f1a4d0f32d7c59a51a266d9d48f9c4432de3ad143c50ff8ca503d2be0e57
MD5 55b9572471000c12764b04279d560a3d
SHA1 dbf82ffac9d4bedad49fbd80e4d168da1b5d6734
SHA512 efe27106865d85acf7dd7b04bb90b1451531c4f1f8b04ef60e712b42d50a03a2c40a9a8b7f12f751b51aa66fa2bbff08500b4eac8ad85ac7a91500d3f2ac3777
SSDEEP 12288:oSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:oSfJ4yL/tNCJPXUQrP9
TLSH
T197C423AB60D5948ADE1587F81788E001C7047EC6672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 dddef91ed01f9b06dd2d8c5e0334288808766ba6d17737636235823dafe00562
MD5 ae3cd80544963bab46c7dd6af1f2548e
SHA1 ef9fcb16d1acfa5d970ee3c25bc7611a577c011c
SHA512 be41b05decc3db0397b39db8c84be37576b5677f9586edb0640e8b5c93c562b633dfbb4cf8aac2108e68ae86c57f8c32a549ca349b7698032bedd7a8c54c3080
SSDEEP 12288:lMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:lMfJ4yL/tNCJPXUQrPM
TLSH
T151C423AB60D5948ADE5587F81648E000C7047EC6772F62E7EF83B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 e0a219fa99166dbbe669cbdaa35d47561485630a3e630b5a847182ad7afe80eb
MD5 06d4e10da8182fa9a806d03f5b1da227
SHA1 da312a474960d927f0d8c886edab26b589f411e2
SHA512 68c3b5bebe32e5f59d5593a3b69968dc01b6243626b60e526e5cd9f7d14d9ce29e88a7c7dea6f9ce07e36faa6e3e330ffb36bef2889a4c7b097d25f73377afb4
SSDEEP 12288:6VNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:SfJ4yL/tNCJPXUQrPj
TLSH
T1B9D42397219480C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 05efbc150b9f13e74f763643f2c71de6594a5040c10e93eedd569009aab295ba
MD5 67decd1c477ee496ac7233d3959ba9ec
SHA1 93d407d620849422915cf48906ba2b298b8d3b49
SHA512 43393720d3d2effeeef9fedf5bf3c3cdfd42292d07c503fd5a7df0db219ad4c5010f877faf37ded957f2e63c2b108132c3d688ba3f67622ea5934db460970b1b
SSDEEP 12288:a1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:a1fJ4yL/tNCJPXUQrP6
TLSH
T146C423AB60D5948ADE1587F81A88E001C7047EC6772F62F7EF42B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 7026f26eeacb654e303ba104dd1185a5f0dd796c1a32dc42c950a65147835a8a
MD5 fd56e95576f9b77930643b149d5a0754
SHA1 872ab5522bf92582686788c51499571b18d5b372
SHA512 bbb62f3ea6ebb4d469b4f4c573a00263479234be21c76a97c17d893059a5f41dd1612671c1d1a8992fd4536163baf6488628f516e487aeb55f26fd814e643d38
SSDEEP 12288:Z2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:Z2fJ4yL/tNCJPXUQrP+
TLSH
T1D7C423AB60D5948ADE1587F81A88E001C7047EC6772F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 17aa8cf8726307b29bc488e49844ca822af3386148c592c151adfdd4cd1cce39
MD5 74a08d04313540320de47478d1e79988
SHA1 f8296844c28c816dba2130cb2794a7dc8bd7e02e
SHA512 968f7b9c8b7f8cd0e867080c2cbe16e0f8fd8bd40af868872dcb82a8fb277719cc6e6acd0683d1adece04c235dd088a7a05af1ffd9c7006ee83b93b422501265
SSDEEP 12288:jafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:jafJ4yL/tNCJPXUQrPm
TLSH
T17AC423AB60D5948ADE5587F81748E000C7047ECA672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 11ad265cea88dd4c56924c6e0ce105972d19dab81b743631532fd7220968c6a5
MD5 fad0e20344067ac016b064db3b9c0376
SHA1 3ca5d9134231ace605e28246cbe07e69b96d5c4b
SHA512 68e24ce9f39f2edfc1398b67c3a8db0c6cfc961455bb9eda38d9e18b7345255865fcbdd33ae0e2cab76545e2e5d3b538980c4a696d26665748258d2f4b0aaf3e
SSDEEP 12288:TiZwbDzzFEoS2cPvyyfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:+ZM3zFVSOyfJ4yL/tNCJPXUQrPi
TLSH
T1150501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 8f03796d4ee4b3f61c3e87bf0898fc2e350c43c6ff12c4b1c48cfad46b8bc955
MD5 92004a64a49cd457a13125ae75c75147
SHA1 39a43acbaaa7aa80be1aec7ea8796b6fd8b3fc4d
SHA512 5c3bd22332d0cc9b4bad493f924570b058c93b441e2eba69674fa087dee3bf45a9119a84d897fb1a4ff536a9be93790883a88dd1da6232d38dd75b2241c18b4f
SSDEEP 12288:EPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:EPfJ4yL/tNCJPXUQrP3
TLSH
T162C423AB60D5948ADE5587F81648E000C7047ECA772F62E7EE43B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 e505bf79faa31e00a68dc3b0b83e9620d5d1d01d620df26bcfc9357d78e4b67a
MD5 97f5872b71326f4d26baee55e7b83840
SHA1 6a7c4ae7e0ce355e9177ed1fe764c79b38a5e84e
SHA512 d12527ddc9f7cf793762d2bb0b90a9bc04d4b6bc989e7c3384f91dccb3f2569b6e51da6e04a971b911573e48c81e0d4d53cd0f6c935d973cabdd80ff53e65aa9
SSDEEP 12288:ArfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:ArfJ4yL/tNCJPXUQrP3
TLSH
T19AC423AB60D5948ADE1587F81748E001C7047EC6772F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 d44d0beb44456199b545e9ba91ed363ee5c372e75cb4d3bcafaed0f42cf3dcd0
MD5 02ff879517408959ae0507e68113ed75
SHA1 67c11667ed52e00725160b04aa7165d802c0e766
SHA512 9289fa24eb4d7a6eed5e15365c3df40e07734f7507a3731fece895155a4807eda7ad7b2dbc45748fb00e767765bbc27ee8610058c0ea5a6879cd1a4211e19c80
SSDEEP 12288:FyPz5L8OfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:MzyOfJ4yL/tNCJPXUQrPN
TLSH
T128F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 b6906210492605ec3fa1dbebacf0dab689724d41d140210c3dcadc7d49e37f3f
MD5 0c56a1184dc50b5fe0327246aed11c37
SHA1 893d489059da96ff01d7988f718e7790991e3bcd
SHA512 c2c35ae444f6d3c8e99740a7a5584a2092180ec64c0318d775778679f253f09cb2ca0889f65dd488fd6cfbb9f8bd873476f748e2e2d353e5d8e73e0f274058e6
SSDEEP 12288:hPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:hPfJ4yL/tNCJPXUQrP5
TLSH
T1AAC423AB60D5948ADE5587F81748E000C7087ECA772F62E7EE43B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 ca431e906dc9b072d20a3837db21256422259101c252c673715aca704c826609
MD5 6a56aea63fda28d8645beb5274086eba
SHA1 5c6fabd95416c68d44adc45095824e4746845029
SHA512 f0d2532a8616b7013bfecebb626f15db22d84d4d967907fd9cf7d89035201dd2d89d882c8062033cd67b8b7778d80034c58faa2ef80dd238944ee894358fa36e
SSDEEP 12288:qPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:qPfJ4yL/tNCJPXUQrPJ
TLSH
T1DBC423AB60D5948ADE5587F81748E000C7087ECA772F62E7EE43B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 671a38b62650688b125565eb5f3b895b7fbd36fd18315cb16fb4a764aa696c92
MD5 829e7e78544e3d747a0b959740542bff
SHA1 f058a0c8afe19dd88a7302cd4f633de97726f408
SHA512 4bd1b9d282772f9941795b9bafe9475e34110db64279a5af1cd2915936e9e9f67146ea1b901121b1c4a391331bbc404dd89be93a491f03b0e5ba5418548ebe2c
SSDEEP 12288:EyPz5L8OfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:dzyOfJ4yL/tNCJPXUQrP/
TLSH
T117F4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 5a8957b64b7879fb8cfd9240fc92c7737089e33fd55c36dc42a998329a3e5ace
MD5 7061e28418b6497b04ab3399629624c7
SHA1 49ad09b1079cf131eb585c772f37fe4057d0761d
SHA512 5aceb92ec6ea8855a72b0b2ce2b04865a97ec707575edce2e201cfd5eb3e679d7d4a0b0e444c0e2fb89dfb924fb093b228d57c1e7cdacece8a66d4ea1e4cb10c
SSDEEP 12288:NCd91WYoaLHF3z0z04PDvhcfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTd:YT8aLl3z0zDcfJ4yL/tNCJPXUQrPB
TLSH
T1770501A9B39018F8EC67827ECD549502D3B27C9A0770C25F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 7ba24d7d99678b83740a96b7208326aa6a36de3c5b7bc7e44c0dcd13b9d4e194
MD5 7782e74ced39893417f2c4fb722c09d8
SHA1 423a8a1cd540713ed05a93aa3cbce12b8df9145b
SHA512 f13911eafd0e2d3e74b3073f0cd86e2429bea8334c296e344e3f0121b6d90b30ebafbf91d88de2d0fc01c9f4e60294986063fa83143f8e456593266ef531be69
SSDEEP 12288:Wi4e7+RdTfgwCHKy7GLbbdIv5fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGE:W3rd9CHKy7GZwfJ4yL/tNCJPXUQrPv
TLSH
T16125CF91F3E410E8F0B7CA798D659501DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 80bfb8a8bcd58ea2b93af9806ea22fdac9c1a4435232e1a4bba31d5660101d93
MD5 8c6a440e0dd11dfd3ed4df45e21d0c95
SHA1 97cb89dd94abed4b24037d61450a029966471d61
SHA512 473ab4fdba506170a2200d0c3448e2d2c607cf3345fc237a300138c064c6110348b18ba500b322ed2e00b7b69aeec9c0e64baf33a94c69547357c40823af1fb4
SSDEEP 24576:KcP4mcvIjkGOxhKP2l71nNKbrh/8KBXfJ4yL/tNCJPXUQrPH:VP4m4IpOO67W8KhfJ4klKXnf
TLSH
T12E65AE2DA7DC0096D0BB917886658A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 7c89b0382363f37a1022c5c98d116f994d63969f36f61d03d4844203c1c47649
MD5 d670e21e4825ed5a91d4f0e7ca29de53
SHA1 645e2c500b23c27eb1f9e708a2cf18d1863eb45a
SHA512 5e918b0990df0d7e449f43d7acab916a519de12fc3fc18afc0ac7049c94b3d415d83ddef7a6f9faaff8c65c794205027ead5de627fbf993de36fac8c14ac94ae
SSDEEP 12288:kpsfffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:1ffJ4yL/tNCJPXUQrPv
TLSH
T1E1E4015AD29841D8C46E92B8CB449200F3237CA593E2D3CB97C0F47E2FBA6955DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 1cd5a664027f5c3442093fca5bcec11d4543de17eb0e62208080f273508d5284
MD5 b474c54904d4039b41bfb11df710d016
SHA1 c3a1946d138f09f4b31fe632936a485e3a1b171d
SHA512 dd8c7c828361a4c4e9bcbdb86047819af8e0e243069a5be4eb57e8c01b262db03eee46df43b10f134118a0756859a5613bb88a4079f2a39469a1abe541076f66
SSDEEP 12288:V/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:V/fJ4yL/tNCJPXUQrP9
TLSH
T101D423A761D8D44AEE7687F81648E00093097FD56B2BA2E7EE42B4853FFC9161D6C313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 349650d953b1bd8c9dc7a43c8b55f0bbf4e4c9a734ad6a147c2f9cf4ca374b6d
MD5 d8b51116d85de894b2727994bd78c46e
SHA1 117b2549ba14cfe78b3ec0d20f68ec1960b43c2d
SHA512 ac2c16cd8c274efb2c789aae8b9acd041633b8f7f045cdc6310cbf838315531a2649fc51a881039df9a25f953c0e2815a747f8346afbcf48e5b6818c14223f70
SSDEEP 49152:Qa0h2GEkuAe73q3pp46zwwQ1fJ4klKXn1:Qa0hNYG4JwGfJ4k
TLSH
T1F1859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 a222336bd4b4d0928da1ef562209623c2b65afbabd1897268de48789e1f90277
MD5 5dce867e2ee10007f4b28c2c278d4a6f
SHA1 e9a606d92d5daa2e1f5cb12061ef4a1bc0cbc60d
SHA512 083e8000780c459f8769329871eea113fccd88c436064188f10a88e57254c0aa53fa2da872cca78bff3368b965810eca2197bf9acebc6569334ddc4f87c709e4
SSDEEP 12288:rbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:rbfJ4yL/tNCJPXUQrPZ
TLSH
T13CC423EB6084948ADE6587F81A48E001D3047FC5272F63E7AD42B8857FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 5f691327ebb78bfe160686ddc18c1db438978508906608de880150b5b70f1174
MD5 2456f908e0e163c0e930ef37ddbc4b27
SHA1 732925df5b33695256b76f7c13256f1759077013
SHA512 e0fcd97db6155b4c0aabe36126a616bc33e30249a187786922eda846ecbeeb2c58bd85cd269bcb54a4589c5ab3acc80cd576552ed3aa0c9dda35455856306cde
SSDEEP 12288:1ObIA4LWOsvAYFT4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:yAL3UT4fJ4yL/tNCJPXUQrP5
TLSH
T19B25F155F29400F9ED6BC23C89A6D512D372B89D0324E3EF07A88A552F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 134c418d9a1bf28acf2145f62982777b0f7840672d764cfb8205211ada8dcc55
MD5 6450f9505350f3442831924713168d3f
SHA1 3654a5f18f6456134e0fd8ef3c4450989fd32cff
SHA512 d8065413be6d8cdc5270a7a9906a5641e8e823511ec562bae1a71d577ae66c7abe996d3d32bd96eb962d0668e0e344b0b6ef59b637ae9ad0a20aff68a63de0be
SSDEEP 12288:ppFtvOUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SZ:vOUfJ4yL/tNCJPXUQrPO
TLSH
T124E4026A32EC10E5D576927C4A85D209D331BCA6172753EF46D080AE2FF7EE82C39761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 244dd6a0d38d784402823bf36cb90874959845c9580117df030976f4beb502ab
MD5 e5f2a298bac435115571b9dba5a014b1
SHA1 792c79d131b8dc8884302d839ba3746a67d7c222
SHA512 ab44ee408afa56c984810024cc2b1fa834d83ed87131864f2b4451dac50a532e20673c86d12b83880ca8c9e71ba7e9c4d812abda7483e738d0f0f9821368716e
SSDEEP 24576:/7NM9YqZqmWMUkPjZM48Mv6bEhsPfJ4yL/tNCJPXUQrP3:/7cBWMpPjN8DbEhCfJ4klKXn/
TLSH
T13965AE2E6BEC81E5D477D13DC9A28205F6B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 86556e45a9cd41db9599d563e152675fadf3fb3d009d51c2f1964de3f23be5d3
MD5 c8a4a280beabd6da09eb6d1c89fe2439
SHA1 b153ebb6f00d5d290d029419fd643575a5323de0
SHA512 ba5dbc2eab1c07b781ff98781aeb8df297ae38697c1a21c3a6492fccd6c4c72b83f4b5d6da69c83baf336bff6ebc6a2cd71b733cdc6760386d2215867a9a0fe7
SSDEEP 24576:7W6BApg2YuyuNDYTabvcdvNYf8km1ZfJ4yL/tNCJPXUQrPV:7F2YuHNETovAvNYf8kmvfJ4klKXnd
TLSH
T154858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1256c525cd778a0fbc253362f603bad051e1382717e249445d14b3af2bfcfaac
MD5 d05e5727b0d0b7359c54f9f24365d2d3
SHA1 d61f1925c10a81a391164c97015087a7c64b1436
SHA512 96a485c32e0e7f76319634e4ef528031a79739aece3c22f858b2dd367483f94fb47ae22d47e906d73f067db3bc7aad7060d4489132c60fe1b2608b1e63d99614
SSDEEP 24576:CAFs06+Omlf8NXEbTowfJ4yL/tNCJPXUQrP/:7Fs060loXuVfJ4klKXnX
TLSH
T13965AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 23951aa6d97447ae07d7fec09d792479405883f80f3a0376d18d8f59fc62ccd2
MD5 7656ff56f25e6a3ec2255eaf8ceb832a
SHA1 3fc18ac03364cf2f2f2d125539e64170099e50b0
SHA512 dbd2669092ed52a51053786fcb78f5d4c9aa69c50040760631fad7f5231ad232640bd46170abc51207435df0625298af1fd80b44b55e3b78f1d4633a68121a0c
SSDEEP 12288:jCJnJ5D3VkrDzxvfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:+JnJ5D3WXVfJ4yL/tNCJPXUQrPe
TLSH
T16015D02DD2A810E8D4B7C3B482496746FF72386D2F226AC768B4D4353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 759466cc86fe06bdeed56305181ae6f4b95b976b2b1779fdaa10c490dfadc086
MD5 9d9f50a950b260ad5953de9b9e1ee35f
SHA1 42a26c79f7f7908acf522e037f2a3c353f6fb542
SHA512 65b4e4f3e1e4c561165b163a9c4ec7933809411ea7712f538c90bd2b4ba78542479f615e2becb0ea939aaffb4f5576b71c309ef5b15d3e91c6b1ed4a3de17482
SSDEEP 24576:rEPghm6/7IIXdwcXrif7qQncjlP65i3VuKfJ4yL/tNCJPXUQrPX:Mg06DIKdwc+eQnSt65aVTfJ4klKXn/
TLSH
T1E9955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 2b0c1fd7dd4243285155fc1add1e724ebf87c894897cef28e43ebfbd11c4c1f2
MD5 7d742bd802ab9e7e09a8d0e63c33c6f1
SHA1 cffd710813d1081f1005ccbdf1d991669d6baba2
SHA512 f2131ece49a62e67d3abd41fe4562b039e74d1e1746cb4ebee83eeea5450a7034442d9e236f6615f1f59ea89aeb8a00a68866ed59e67a9aa06cea59057ba07a2
SSDEEP 12288:TEP3RiMrgBC4G2ypprtDMC1jH7AFAU2CKBh1eGuc+jYRM5zqWGLTzFexFs7kMd55:YiaTBt3byAUHWreGf+jY+JqRp5fl9NJn
TLSH
T13D05129D13EC60E5E13AA13945A14205D7B2F0652FA227EF14E0C23D9E737E62E3CB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 f9b52d453bc2e22ba52b47f53c9fc4e05867bb590c61b17ab0a8b08b6cf09df5
MD5 9494802eec2e5322be6786e0d5b1d417
SHA1 fb48abd9cfc0aff1d5b11bcb539dc6f1f0aa94eb
SHA512 3991e73f3b33f3c3e9b901b721c529565af9ea26d9a4376ab66a5d9abb10315d76ef0a207669e72b8deff604043c7170ad691dafe81a191fb00b0481e9ea9dde
SSDEEP 12288:ajkySfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:aIySfJ4yL/tNCJPXUQrPe
TLSH
T189F4224A23D4A085DAB647BC5A55D140CB34BCA02F2693EF9580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 b427d59ee035303dbf4cabc218276c1d337a6ecc1c9181e999c79c275d3c6485
MD5 7d9e4f4bc8a3d1d3f31ad277d5e28ddd
SHA1 ebbc2da4b91be14d951f7c70a91f700568e57ec9
SHA512 b1c42c24d7d1a6cca39a828cecc4df5c640105e39f58692fec9de6452cec145a0e09e43dbde0def895215a5ca382c55c94e9faac116a62c5b48a302737beb563
SSDEEP 12288:OyEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:3EfJ4yL/tNCJPXUQrPL
TLSH
T1BBD423AF2195A08ADE2587FC0648E000C3147ED5272B62FB9DC2F4A17FFD99A15BC791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 69a457e97e5865dd686a6cb0017aa856bf0510c84fb72177a10dcb1e8c0af5fe
MD5 05d6582ffd40ce822d2a5bedaff3a7b8
SHA1 7beca8aee497e5e4ed004f06359ce6043193d3ab
SHA512 001bbbd601946c720fb15a1c1c80d7b4c742c90414bddb7cdc62ab70c30e036634b766dde7e6358e9023907f3282de4d7b098521208bf8de7621907264bc45a6
SSDEEP 24576:jQ9MxZKdcz9dw3nfJ4yL/tNCJPXUQrPr:jVKZnfJ4klKXnT
TLSH
T121558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 c089f97b63211522c811c8223294b9c9c28be89e029ac65d15eb686f96e9b32a
MD5 0e6e6d2d4e72d1bdd1e326593d4432aa
SHA1 6d3cc1ef6253e51230793e439bb99502c1e823d6
SHA512 ba27475f00cd00d044652e79660c351b8d91fa2eaa766273e9c9f24964beda2737a8eebed27c553c463a1080077e29a5527351346b549c7c982bf98b071c0ff5
SSDEEP 12288:cyoKo2JRple9pefJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:cyocDApefJ4yL/tNCJPXUQrPf
TLSH
T1F6F4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ae329fffcfac75cb686a735f32ab6c7ba9442343782a80c32d04fb63d3e375f7
MD5 c4792ee8d7b7368494d0603cff0b643a
SHA1 157be45a35cb06ae74a65ef451d496fe4fac8b77
SHA512 f50a077d3155ffea60678820ff37ddb63e99d15b2d9314acd4c6c644080bd256494addbe36ea361c9173f933fd833154546137ac07a9dbf8bf4326cd9605403f
SSDEEP 49152:CWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKefJ4klKXna:00zuNI4fJ4k
TLSH
T15CA57B3DA2F800A8D9AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 a9f50dc6b1313fa7f0968d82af5358e57e94a3b7755babb1cb966b1473ce4fce
MD5 257bf099459d0ebfa5178484b624b6e5
SHA1 3e014062acb7fd49034179357d1e544ae03c3cb1
SHA512 9b5bef9d66b0158de060be04d477e3af4eb56af81577a091fb9bfbc09ca0362fed2e4b5b2463bb59c18da58a15ad35cd5a4c1ff64b369d4c0056bdf9fece26bc
SSDEEP 24576:31QT7EcpfxR+N5AWAz3ooiYhjMqboTBt3byAUHWreGf+jY+JqRp5fl9NJn:KTDxR+N5YzTTjMRltLyvH88YzRp5/NJn
TLSH
T15675C02EA7F815E9D1BE86798B23C512FA727821073193CF42A0C17E1E675D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 848KB
SHA256 4455edc593b979eb0b1709252d26194867f1c914ff55e8a3fbca68a2f7b94c10
MD5 db768a7378c8c3a4a6d2d7843444b4bc
SHA1 6568bf491ad34d7e1d427e525c85f1566a99ccd6
SHA512 9ff5088b2407749579ac592f9063bcbd9fb8ee83bbb2cedf2dee6e592dbb03075912c0b43a697e2f98ba2e72f2b5b82a395cf341f2038c152c50b72013bc46cb
SSDEEP 24576:IhbHjPWTBt3byAUHWreGf+jY+JqRp5fl9NJn:IhbHjultLyvH88YzRp5/NJn
TLSH
T1860512AE12FC10E9F175A23C46A24206D671F81A1B2297EF25D182799F33BD22D39F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 c6376a3c9514f9ddb806418a0af923381ee21284fb16903a6d5e16b646ed7276
MD5 59afa028304e53e73090920091a64b23
SHA1 554ab82538f5a0bd638042f9e56f435dbbf6f80b
SHA512 a8a033cf21871225797689ff39cf07e5bfafbc9ac32ecce894d93fb5def8fcd358cface9b512c9a49323cf93a4bf774436cf2ab0d22ca08b0709f090a205616b
SSDEEP 24576:lTMdOz0FFS+UmSLNfJ4yL/tNCJPXUQrPY:/0K+UmSLNfJ4klKXng
TLSH
T1A515E17E63AD14E5E57BC27C9642D906E67238A6032266DB06D0C0793F9BFE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 778139e708738b60d288d7f443fab88632f723d06a094627b02a6ff778ee94e7
MD5 9c664cae1b684ce321ed4bed46a8a7d7
SHA1 34bdc6dcb437ddff262be31b97b4ca320babf684
SHA512 302005850237146024a92d50a590acb49169d116a402445c3822a84221544b59dafdfd61c28754e5055f5966eb7ddec55804ea1df77390b0036f9df04cfe3d2e
SSDEEP 24576:p3YgnJcRTk4yti+R5dBR/KfJ4yL/tNCJPXUQrPI:pIgnaTk46pBR/KfJ4klKXnQ
TLSH
T1DE45B02EF2B910B9D8A6D236450143B5FB71782D1F2196CB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 8d78951d20c7653d7b3610960fe326dbf04700bc681868b7c0d8c3023ff37782
MD5 80edb6e10578532fd2ca3b09ced8386f
SHA1 ba7f6d624e029575af640ca6d0d4ad56155a12d2
SHA512 721fd7e01815dff00bcaf156bf073bcf3a0a1588686ae17ff632023e17436729cbb21945af26a6fb4b570820b4c7010355c370e11929600845901272622ce3a6
SSDEEP 12288:L4K4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:X4fJ4yL/tNCJPXUQrPH
TLSH
T1FCD4125E23D870D5E87293B84B54D101C330BCA6232A62FF39C1D87A6FBAAD5597C712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-59-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/116-73-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/116-70-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/116-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/116-67-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/524-424-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-452-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-428-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-455-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-427-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-425-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-423-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-456-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-436-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-457-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-437-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-458-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-459-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-460-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-461-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-462-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-464-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-463-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-442-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-443-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-438-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-435-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-434-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-433-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-444-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-445-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-446-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-447-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-448-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-432-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-449-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-450-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-451-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-426-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-453-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-431-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-430-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-429-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-454-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-441-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-440-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/524-439-0x0000023443F80000-0x0000023443F90000-memory.dmp

Download

memory/740-7-0x00000000021E0000-0x0000000002265000-memory.dmp

Download

memory/740-343-0x0000000000400000-0x000000000060E000-memory.dmp

Download

memory/740-0-0x0000000000400000-0x000000000060E000-memory.dmp

Download

memory/740-57-0x0000000000400000-0x000000000060E000-memory.dmp

Download

memory/740-1-0x00000000023D0000-0x000000000256A000-memory.dmp

Download

memory/740-20-0x0000000003040000-0x00000000030A7000-memory.dmp

Download

memory/740-14-0x0000000003040000-0x00000000030A7000-memory.dmp

Download

memory/740-2-0x00000000021E0000-0x0000000002265000-memory.dmp

Download

memory/760-162-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/760-415-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1168-414-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1168-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1196-152-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1196-75-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1220-417-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1220-170-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1268-146-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1268-412-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1268-138-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1268-144-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1412-155-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1412-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1468-90-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1468-161-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1468-96-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1468-98-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1548-413-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1548-149-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1688-85-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1688-157-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1688-79-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1688-87-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1768-381-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1768-174-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1768-118-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2392-169-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2392-115-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2572-166-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2572-416-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2668-175-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2668-418-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2668-421-0x000000000CE00000-0x000000000CE08000-memory.dmp

Download

memory/2668-184-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2668-200-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2668-216-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3296-165-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3296-104-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3296-105-0x00000000004A0000-0x0000000000507000-memory.dmp

Download

memory/3296-110-0x00000000004A0000-0x0000000000507000-memory.dmp

Download

memory/3972-34-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3972-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3972-43-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3972-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4168-589-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4168-622-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4280-623-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4280-609-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4660-356-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4660-132-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4660-126-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4660-134-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4792-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4792-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4792-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4792-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4832-323-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4832-123-0x0000000140000000-0x0000000140096000-memory.dmp

Download