91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
Size 608KB
Sample260930-gpjktssdne
SHA256 91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744
MD5 1163ef11bcca7cbbb4fc20e95d5f6824
SHA1 b68ead4ae3120f67e8d420d38c3a3ef5818460ae
SHA512 d663ec5e449d34815d5d47ec2467ad3ad4d6fcf448bc0be7d5b13abe543f91afb4ae77eea1482e63d1c66aa73da6d7f1b65609130cbc13c91c1be720b0c99c83
SSDEEP 12288:zTtp2vZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZa:zSBhkJZXYGbwinaJK5mlz776UfiP
TLSH
T138D42369A68CBC92E71EC2B42A7581E970329DF6B5806C1776C03F7C1678947F0B8727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5004	alg.exe
3664	DiagnosticsHub.StandardCollector.Service.exe
4824	fxssvc.exe
4544	elevation_service.exe
2108	elevation_service.exe
2272	maintenanceservice.exe
880	msdtc.exe
2128	OSE.EXE
2744	PerceptionSimulationService.exe
2408	perfhost.exe
4992	locator.exe
1672	SensorDataService.exe
1660	snmptrap.exe
5044	spectrum.exe
4652	ssh-agent.exe
4520	TieringEngineService.exe
3752	AgentService.exe
3820	vds.exe
548	vssvc.exe
940	wbengine.exe
2936	WmiApSrv.exe
2304	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe
\??\F:\	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\wbengine.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6a9012f15ef7726b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\spectrum.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\AgentService.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\locator.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\System32\vds.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\vssvc.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000855e08d1a050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b6132caa050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cd296cfa050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c3edfcea050dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba4a5dcaa050dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000461e1ecea050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c57507caa050dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3664	DiagnosticsHub.StandardCollector.Service.exe
3664	DiagnosticsHub.StandardCollector.Service.exe
3664	DiagnosticsHub.StandardCollector.Service.exe
3664	DiagnosticsHub.StandardCollector.Service.exe
3664	DiagnosticsHub.StandardCollector.Service.exe
3664	DiagnosticsHub.StandardCollector.Service.exe
3664	DiagnosticsHub.StandardCollector.Service.exe
4544	elevation_service.exe
4544	elevation_service.exe
4544	elevation_service.exe
4544	elevation_service.exe
4544	elevation_service.exe
4544	elevation_service.exe
4544	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4424	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
Token: SeAuditPrivilege	4824	fxssvc.exe
Token: SeRestorePrivilege	4520	TieringEngineService.exe
Token: SeManageVolumePrivilege	4520	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3752	AgentService.exe
Token: SeBackupPrivilege	548	vssvc.exe
Token: SeRestorePrivilege	548	vssvc.exe
Token: SeAuditPrivilege	548	vssvc.exe
Token: SeBackupPrivilege	940	wbengine.exe
Token: SeRestorePrivilege	940	wbengine.exe
Token: SeSecurityPrivilege	940	wbengine.exe
Token: 33	2304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2304	SearchIndexer.exe
Token: SeDebugPrivilege	3664	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4544	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4424	91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 4528	2304	SearchIndexer.exe	115
PID 2304 wrote to memory of 4564	2304	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe
"C:\Users\Admin\AppData\Local\Temp\91374a0a8c8ce0ae0c25753da5b5688ca2090e1e56f30e5c87af8029a6e61744.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4424

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5004

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3688

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4824

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2108

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2272

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:880

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2128

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2744

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1672

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1660

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5044

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2364

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3820

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:940

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2936

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4528
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e601212ef222960d1e34524f4d3c3671d74ef78b926c53b6a525cc2831d5ece6
MD5 9bfc0051697b93010bb82947ad97b67d
SHA1 96d99539586d8fbe7ce4c469d7bac3689f4270c4
SHA512 14ea15655d966989c9b50d69542392906e8aae6e77d95cc29beb410b3c8a11bc75b34ce05afc554778c824ec56feaeee7e67bd002ed69e15b77915fde0596907
SSDEEP 49152:Yb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn8JZhbww6z776rP:y3q6sjBhtfd
TLSH
T15BD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 3f7f4d15837885808397378b3348b1a0fe6e3d3c26b15c3cff6b7760d9ccbfac
MD5 adbbacd828ca4eb5df1e9389d3669931
SHA1 242c4628d691cdb6714199ed2bf42692efa4de32
SHA512 2e5afcccf3231d7374a33055f76f823e93bd5c2e7f2c51f8440207513fcb73629e05453073c90ec72af1a0cc119e34b6066a430870a1e1c43d6d500d55fb2d14
SSDEEP 24576:kXYfDtczAchkJZXYGbwinaJK5mlz776UfiP:DtcCJZhbww6z776rP
TLSH
T1D805F12877D848F5DD6B823CC8A28111E633BC9547A0E69B03E4AA751F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 8ea748d76d20724bd45c6409fdd22c5d1a05b4046e097d1de1d4908a30077c10
MD5 34d59e338844bae99df7f5e8bb83347f
SHA1 bb0bbac07667d224eaaedd1569e17fb4a843852b
SHA512 b3ec3b50605b86589ed54f1fe93edd3aaa0cbc82a7d69459663ed2f0336a02f598251641987166979745f80a483731e7a7c204fcf17390e3a9bb4047b6f3d7d8
SSDEEP 24576:h0Le5ji0hmxxrMphkJZXYGbwinaJK5mlz776UfiP:hPji0AjXJZhbww6z776rP
TLSH
T14B359E16F6788731D073C0B9C5D2A69EE9723086573089CB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2e79d131e70dac7223d3115a229019150e8e7a60006c34fae4701513928bdb8e
MD5 09a4caa680472692efb225581949f80b
SHA1 0275f5ff50e15cac71822ea5121acdca54a6efc7
SHA512 ae93a34371620996a969f81994d38265cf1fe1eca2d633604c97770648dca76fded4865885c6f217976b5e3175389b585476972ade44a7b7d4f6fc75b2e33cc7
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWn6q8wyuLhkJZXYGbwinaJK5mlz776UfiP:5/ezSC6vUzPveHjyrJZhbww6z776rP
TLSH
T161756D15F5788323D0B2D0BAC5D6AA99FE7230865B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1b33f27790707ce9f8d1a56b13311bd571d1b174e8489cc7a419c235f95401c3
MD5 23004bb1898556772cc00a422636fe7a
SHA1 d5e946e8125c8a6dc9fa0c5edf8da085229c2bbd
SHA512 4c4270686952f5d2906ac6d3ffc112c400f91ba8615c945054012c24e7dc19cb8bf4eaf68308c2853b2b0b8b48ad2fc8cd30274b08352cba0ed651f3558ff917
SSDEEP 24576:2VbqPb88hv/l+YAhkJZXYGbwinaJK5mlz776UfiP:2VO88hXl+qJZhbww6z776rP
TLSH
T14E559E66F574C331D073C0BAC4D29A9AEE3234425B318ACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f9c2e7f7f320787cdd9cbb1ae88cf0599e85a0d69f25c79af9ed608842f635d9
MD5 53d1e5e0451838f58515cf1e3b0f57c6
SHA1 4f7230838bffbce0b99f268497c36061164ff1b0
SHA512 c16ee394aa9b75a0a1fbd6f36a0f0efdda0b75a8ef7ade541d50009c15e22e5b40a2579e4210c3c7b757fa9979b5e4dc85e8828562c152707f0ad3b5149fc84e
SSDEEP 12288:iLTZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZM:iL9hkJZXYGbwinaJK5mlz776UfiP
TLSH
T1C3C4235A9B9CFCC2C72FD13D787A81B97073DEC5B4C8742955A03BA506BCA66E11C063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 8924eeba9baa8309db88aee9084e72a501cf18cd0f790a5766a25b92d8bec74a
MD5 788e1225e6898b80342272f63ba8a5a4
SHA1 dfa8743f1ef5d98a042b71374004a2405d59f7bc
SHA512 de97cc78df621f38f23cc220ec0e4057c7c2e95dc6d4f76a3dd1c392efe2da900e1350c3e02bc665865d2b5b3a6a8a00176c96d380c09ac3ff1f1bf4fe163606
SSDEEP 12288:reBNUbTVO86UmZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/Ufio:rJIUYhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1D105CF3BEE28FCD2C27E9DB85A91C240E77278704B51A3CBD164830E9E275E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7af6e30ee3946891084316bcfe7af3280063d4c3134438282d55f981562fdc17
MD5 95c56a76c27c15ba4f5420a1fe79d50a
SHA1 7c07320717db43522921b775ae7101ec12a721d3
SHA512 ad6b69157ed4a07ed323fcfdd3b1b21ec4e00efbbc5d710f95c6612deca77980f944397abe4f50b88d10d40a9e7df31eb30dc117b88c669e0634c1d5212db224
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THB:HQvGAdlCEL8c/DRNw5Citfd
TLSH
T134267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 211b1791cd49aad5c0c840f76c6727ae39c83d7a0617191e536873b01f739b48
MD5 44cb121a6cd29562beea473c7aa3524f
SHA1 cdbdcc11793eb75ad7da5b46edd09d3bd3857bbd
SHA512 29b8637be46ad902e92f9a7c69ea11dc85c15f82390aef5e02b3cfa10634dcbef1af9f744d616e4c3c2bd20cc830aed6549c46d6734a0fef04ad772211ce32b9
SSDEEP 24576:T0ewsAjChkJZXYGbwinaJK5mlz776UfiP:AljnJZhbww6z776rP
TLSH
T1D715E031FE78E432C37F0DB61B36C316143DAA604B9129C3E3A85E9D59742D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 791cd571144fa96cc01e5e56ba7b449b05c4bf4ea335a31db71f983c44e90913
MD5 28f0a6a1ea19f01138fdbd7c379e8d56
SHA1 a62b3e6c9126646bc77926ab8c6b5ab7fd546c19
SHA512 3dcbe4d00defd343b978e00ead8879d7610131b313e8210e34fd1087cadd1df6fd018b42931cae7e622ba9b02bbc936f883f9a262f3dec488fdf78cbbb6c4470
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHfBd:4UEtQevvqc2W1cpV2tI327
TLSH
T17E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3a646ce04624afca66fa222eb18fdd9b080f883227b683efa86b549e0b992870
MD5 02c16e21070f223971c846afa516b993
SHA1 2be64c50e8c75f4c263c9ec9e086ecdaec9cc4d7
SHA512 d7e2a45b17e096ab84eb2d4c73586caf332f7bb29fe4a3ccaf49fdc6ce157034bc1f764b278167b4a6a8d1928bbe1e6ac31eca737f7865d4d014ff5cb38afdd8
SSDEEP 49152:UCbRquA/m2yL5zQfFiV+XenmE3/zHJZhbww6z776rP:9oqtVjnm2tfd
TLSH
T171D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e02a94311b6ef33439cf037adf463c5aebb5ffa8963f086e67fa5a6deff176b3
MD5 5469280a1b4eef748c74f0f36e43a164
SHA1 dfe78b541d3b7d6f52c2ce93e9fb55770d28900a
SHA512 be147dadffd5f76e6fed786ac40be8ebe417e5fe6b374ca25081312c770724e7e08c166c7b94411e3a47cbf5801dc82af59c3b54c33c7ffaa89ed2a0f18d6eeb
SSDEEP 24576:fAhGL3IFoiwtA5l7S53nhkJZXYGbwinaJK5mlz776UfiP:fAMUFoiq5GJZhbww6z776rP
TLSH
T1CA35AD81E7F955D4F5B3AA7899B68170EA76BCA65E31D20F2160D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8b96d09948dbb46f92155e284ab667d822feee3c89b31b37dfa8828d049d1ff8
MD5 89a3d1d1e232713bf8a8a5711e1ef7b3
SHA1 f8d5b4c43f34edb1a7ca2c6da0c86d3e57a359e7
SHA512 d150f229ee24c63701ca53ded7dba0da0a819eb758b77ee8b194c6712cd7496c20320025e1352f3b52dea7b8dee6c6b2a91ec449128385f51c7b6ca62cf9733d
SSDEEP 24576:Swu4OWehkJZXYGbwinaJK5mlz776UfiP:SwvOaJZhbww6z776rP
TLSH
T1D305F14A77A81CF5EA6B82388557C136F7B2BC422A65D71F0760C66B1F37321AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 43126af27a1777b32f73f3887641b6a428a83f5c019f5ef8276f737698e178a1
MD5 5c41e7b4954d305ea0a445b136437f3e
SHA1 0d7e0eb91c944597d434705918469ac14ace8740
SHA512 bc40aca046a37e87c7273771359c164cdd77a8b731784d3e61d118e505d02f801b9bb3683c676ad5b91c4ad037d94e24ad28f790c3f3b330deccfa3ef328ee51
SSDEEP 12288:feZ1IyUZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZl:GZuhhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1D2E4125A33DC74F1D26B923C98B18255E372BC9273B553CF126026691F76AD29E38332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e0f4810d8ec3eb39c75ae780b45663ef0ce31d649886bcc63695a58003cbca16
MD5 4069e7bd57888e9c5a4a5dc92c19f53d
SHA1 3042f40ae022779dc66856af3820057eed05f043
SHA512 bbcc6a998e243fcee36154c4784058ca089badda0b26cfc68c1d00a5de854fd9bd8458c267b4052556905ca0f01f5436ec226d32f65055864933b0181eab983c
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UV:eQRQyi36YOcPbLvw2gAf+PN3Ntfd
TLSH
T193667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 75923bb5ff3897367f5b436c97eaa2a24fbda9c31c52d2349ba61c491e07a55f
MD5 e9636dbb8016b6056019fd3aa08b834f
SHA1 d7bb638dfd66da65344075e4185bb29e49980dd0
SHA512 76eaece723a0d6313aa9b6d8b09cb2221b67475e13cf4caccc1d6bad7b37037e3c02e5c02f0af6eca21a0eabf7fc3bd15925614d371e8d325c5ea072ad625a59
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UV:dQRQyi36YOcPbLvw2gAf+PN3Ntfd
TLSH
T137667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c70b01ecb6c184ce797500ef337bd7f0b05c5fd4223b0582dd00f93eb574ea69
MD5 847dcebeecbb491941227ea15c82300c
SHA1 881ce04abf6d3ce9a5baebcd21d5861907472633
SHA512 69d2f2e4b0e935f59d744b4ad9618dc4ecb54c672a4bffcc288f774d14719e2b5aa668346af31eb38033bbb1087200957bd6db92c5fde31d75581c491f83b757
SSDEEP 49152:w68Qg55nhceWu7PNU3/XJZhbww6z776rP:qthLRc/Xtfd
TLSH
T1F1B54933B2F60099C44DE1769F4A873196E27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e06a8661d55cc43d7e1a9e6f559aa8f1248a3d4ad5c3ff6005941a20580c92ab
MD5 b7a96102bcf07054fd721f257b852273
SHA1 5d55fb576e733e3743dcb406218afc90ec7f54de
SHA512 e8dd7f84e92492094f2b98f95015f316aaf61c2cb300a4000735ddb91411455f5c2f970c28dad453b45fb62872a21d4a9179b5d6e8222783869ebe8c6fb8394a
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99j:Ty5112gYy5azzVvt69nLKnhZgtfd
TLSH
T1E2167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b250fb61c4f077114d93a6fcdf484b5f8bfd6274334faf002d0b472f8bd6ff2c
MD5 89a7fb1636a81450a8bca2c1809ed46c
SHA1 5db1a393133a27144297e12cfb9b45f723b9cffe
SHA512 6358e0f9691d0b1c233c0c9d6500bc6e239aaf018139b6ad5d34d2e0b6759444a894a558feec9ee04a0b5fb4bbee0f0f1b34689c01e256bece5d61c77ea66564
SSDEEP 49152:aB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl1JZhbww6z776rP:Iu6Jmdxd2d1tfd
TLSH
T1BFD59D13F1D901E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3b55c10745a3adbd8693ace3bd0ba3269765129a4b243b609c38832abdf12f43
MD5 b2d362a88a1dfa75592e3b5c43cf8de5
SHA1 7776612da685c90fa4f5646dab8dd17301b0d563
SHA512 6a01acad18a50e8c7f27f016afdd794d0cfe4e7c96735b64dfdda1fb814a29b6e92df1b67e2efbfd379b1855faae405f0a2dee03bcddaf7fc05d6fc90797edb8
SSDEEP 49152:n1hpsNoJpF1A63U44CwH7R4x5JZhbww6z776rP:nmifPWR2tfd
TLSH
T18AB5AE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6175f650fc52e8845b174a930367c761ed1af91e32192c84f558b667305df371
MD5 8e3cf8b82c9d36e41b33acabbf1edc93
SHA1 70d75351938d5e9a4833ee9a02834ad08c9c314f
SHA512 18c84ec5b29484fa59dd5f97783d1a1d77c4ce9861fefaafff9074f6e2ea556016743084067bce1bd11785ec1fdcc0bd75c357d5cccd48e6fc12edeb4880f1c0
SSDEEP 49152:MSuZQIY0Be2KcRVtOnks6NMHqMJZhbww6z776rP:u5dKii61Mtfd
TLSH
T15CC5BF03F2E941E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d864ee469dab0ba49142b3cf6b62dfc34d8794761547c5528205708842920640
MD5 17c86de3e487016bef8130a00a64876e
SHA1 bb76ca9ecdc7000f6177c53afcbb3e03b6b7204b
SHA512 933642b82a9e8c5dc071496c221e7aed56e4aa968d2200980c82c0b394f139fca3f10c324cf11dd66d92a98283be64b558ce7b489b4e962a5390a7fb6689a7e6
SSDEEP 49152:7htSn8EApI0fig3giDn0AP5wFJZhbww6z776rP:aX2imph6tfd
TLSH
T1D595BE13F2D900E8D05ED178C7568632E962BC160B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d271c91b6bd2e4536e4cf50e1fddffc30c15fcc71b7e912d8e6bf3c3735d51c1
MD5 277df7c60688e082bbdf4dafedf92073
SHA1 53e0212f6715a36a84a0f06f61f4f5a6005651cd
SHA512 b306d98e6f5cc87d1a05e6339a0b7f0b4c84ec7b802ec3f5e3f2dab403c048efdbc8acfbac517aa4095c04d2ae9b5527ddb8aef9c06884922f67861271884d76
SSDEEP 12288:eLZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZE:eVhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1A6C4235DAA9CFDC2C31FD27C656681B9B072DECBF1C5306A6690362417BCB66A21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 1caf25cb340dc9cb05eee01f3763e1ba5a0e6458734e3074f6b3d41962113e55
MD5 e56d94498858190c0e84ecccfc3d4875
SHA1 d78944d068d412457edd697479df3f38507c038f
SHA512 a43b09ee257719fb7e2a199f0d06658e45589b614c83f1756f59016b4229011aaf7c771d18f83f44ff442065515644f3295363b0e89b627623e728b122be3652
SSDEEP 12288:vQZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZk:vGhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1DCC4235DAA9CFCC2C31FD17C652681B9B072DECBF5C5306A66A0366417BCB66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b57919b394719b8c427f0a3e1263870bb6617f5bf7216a3ab97a55c4ff60887b
MD5 886bc7a9af0a04238d7105077747b166
SHA1 d1bdd451065cc9867fca626806e41256f8947d3b
SHA512 2e0079d0956db82405e3240656563807ee24b66a3631438324d83987d154fbcff13c0bd1da27977166fd496e13dbda64392f172ec888d3bb0fe3c75146d87885
SSDEEP 12288:b+ZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZk:bwhkJZXYGbwinaJK5mlz776UfiP
TLSH
T195C4235DAA9CFCC2C31FD17D652681B9B072DECBF5C5306AA690362417BCB66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ae33e8b139e4bb806de5a1a0bdd792fa4ad31df9ab3c49a6cf82dc64d873c33d
MD5 f05892721b642a107332131bc215f724
SHA1 36d83551f16eb0cb7afe2f46e048a5b0b3964c92
SHA512 48fa48ac53e97a7391c8b0c9230b18d5e8176f276ca337d58c77ad03857c8d45f12a27fdc84d373804b64e2584ff85c81fc2fe6a03a756241293b49fe4a62fe1
SSDEEP 12288:dVRZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ3:fhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1FED423096B9CB8C2C52FD27C98328165F0B2FDC6F2A531AF96503A650FB47A5E138671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ce9cdc98773208b10f7f132cf4ccce81aadeab102c146908eec4c84d8e3609b7
MD5 87248c4cb131e3a201bdc03cb7d5eb04
SHA1 87c0d29cf4b9cfe865272ff2832b68650ed2d08a
SHA512 7f50565bcf92cfd03421e607f7a773a019a4e94d1d7047c43b35eca134ba4fb9221e7c6244df239a9cf42a26dd253ff2ca7fcabb1515aa9fd3d35fbc00dab12a
SSDEEP 12288:/5ZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZC:/PhkJZXYGbwinaJK5mlz776UfiP
TLSH
T134C4235DAA9CFCC2C31FD17D652681B9B072DECBF5C5306A669036241BBCB66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 f45fb47938c852a709423cea4d1e52664107031a0e88af504cdc9f2fdc5970cf
MD5 5ca537b294818a84e8627ea55ee187ca
SHA1 cb0bcb8d96a8d340a51e8c7726911e5e1f748d51
SHA512 731d0c3c0affaa79e813c23bff83dc3985df131b5267bd27fe1d79ec1c0d3e7fc1da32b983908a1349ef3762057916a9a2c553134e8c17e1cb77b288c3cad29d
SSDEEP 12288:P8ZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZC:P6hkJZXYGbwinaJK5mlz776UfiP
TLSH
T106C4235DAA9CFCC2C31FD17C692681B9B072DECBF5C5306A6690366417BCB66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 09325d80f1fac94c9e77dd8b01cb4d24687fa5cbaf32f2718a43c6e828c311f3
MD5 d9362c8b35311951e8d3067bcb946499
SHA1 726c02a6bdba47da5772cd814c1a5570829218d9
SHA512 17c1f9f0a3e5001cfc8be2a992068ac98d88fd393e04e0b326d838e5df9b9ed9e85af0c947ff8c16fe57ed73dd9278ba0abee39e68152042c48bbfaa44f5bd3f
SSDEEP 12288:p4ZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZR:pOhkJZXYGbwinaJK5mlz776UfiP
TLSH
T113C4235DAA9CFDC2C31FD17C652681B9B072DFCBF5C5306A66A0366417BCA26E11C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 c4836e4e5aff5a48b28aa02eadddbb0466fbcd66dafb3073536603119b5d0239
MD5 0ac1b99a1bcd40e1e2e64747b99a5a94
SHA1 bdcc62bae300e035cb37b2ac9784e04ba7ec7325
SHA512 0cac806a483de9f81bc7edf5c004ed366e97bbd938bc9c85750bbd143fa9999bf161c372eb52a03cfdde0dca390cf7a4c91cc16cf1145983cb13e5a338728405
SSDEEP 24576:dZMRzFVSOmhkJZXYGbwinaJK5mlz776UfiP:dZMRzf/JZhbww6z776rP
TLSH
T1EF050199B3945CF0DC67813EC9258916E2B2BC9A17A0C61F03F436661F333A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b77527b3dd2b273fbb4c9669f3c1b72a68360b61a4208f2474ced126672ec14d
MD5 c21920435ee697a58a3ac4e0a82a8e85
SHA1 49773c2647c9052315b397267d7b919a357c2282
SHA512 c9f55f7a46f1f086e881a71a76cde6b03b1ac4b23c71331bd62af5119f1d6b601119fde331b2f15acc00976197475917b1c6f96fa7fc08e7737789e95ba85660
SSDEEP 12288:H/ZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZr:HxhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1C1C4235DAA9CFCC2C31FD17C652681B9B076DECBF1C5306AA690366417BCB66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 4d5147453c0f864f8be7f59d4ac47a24bed7a7e481f907884d6a2b49150892e7
MD5 a1838455ebdd5e569ad6bd13b2ec2b29
SHA1 e320a0f895051eef880195f99d7e81f3f90deb65
SHA512 a5f36ffc9cf2d4a9139845a62a36b4103b2b473f8e40bc9329abb6d566417f042d6869d4ea5d396a633b775775f194e9d67cac369cdec07960be5751cf2a9b5f
SSDEEP 12288:xDZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZr:xNhkJZXYGbwinaJK5mlz776UfiP
TLSH
T150C4235DAA9CFCC2C31FD17C692681B9B076DFCBF1C5306A6690366417BCB66A20C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 184c27154ce6316ab9ec252f665754635d88b1c8bbbb215902ab775309bb94e1
MD5 33078fdfd420318f063d809aaf10836e
SHA1 19376358fe6112a491d512b44f57126cb016af3d
SHA512 8184458fc5dcc12a0b5b83dbe2f2ba5f069ba46da450035963765568d1d9863ff589fb5a59c7c1efcbb00c9d72fecc55e4805a97eea32a6f40a963f84276e458
SSDEEP 12288:OyPz5L8UZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ1:TzyShkJZXYGbwinaJK5mlz776UfiP
TLSH
T1ECF4020B77A870F5C13B923888620615F372BCB657649AAF13A017761F376A19E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 77bb5e08e794df4877837c6d3df0f24e453c3cf4e976fd11d1da839a83f98973
MD5 bcc5cf831579cccca9bff60c910912dd
SHA1 d51a3b2de92a17d5b8904d3fca98e17eca38b68d
SHA512 e1747f124cfd3c40bdb9d23410173c40245d9a5b08737e551a59739e17de32d0a551b3a1be800f1d7ac58ae4408b344a394e52f17fa888551688a35ff751fb59
SSDEEP 12288:b/ZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZb:bxhkJZXYGbwinaJK5mlz776UfiP
TLSH
T169C4235DAA9CFCC2C31FD17C652681B9B076DECBF1C5306AA690366417BCB66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 4a965e9491535531f8db15eee0cc594d5b7ee104b8676585fc3a66da93e5414a
MD5 a3257391675043003989a20705466c06
SHA1 66b2343ce3a1628e2c982b056620febc9939ab7d
SHA512 860a8233f0e14b346087a82fb0964dc15ee346bc4d331d90122a34877c1c5c5ea303dcdf6f43f85e265d5a0fb91d30b9b8067e30544a8f6c22f9a4189b9c1df1
SSDEEP 12288:C/ZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZM:CxhkJZXYGbwinaJK5mlz776UfiP
TLSH
T128C4235DAA9CFCC2C31FD17C652681B9B076DFCBF1C5306AA690366417BCA66E21C0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 fb1380f0b3a4faff88a4a0091cfcc3aa80449b6a606f3f2e3e1fe1619871e3cb
MD5 791fcaab99a7c8f8db898185ba252101
SHA1 ad53d35e714ba25dacbd11883ae23098a76628f7
SHA512 f546bee302c1cd46ac84a73e9dfcf637b41fa67b05a8097de92a6f25f51ad892331b9eecf55b5d2f5a0435c3f2f5f2b1abcfc45316ec54f10b2aa1e8644c49fc
SSDEEP 12288:fyPz5L8UZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ6:SzyShkJZXYGbwinaJK5mlz776UfiP
TLSH
T14BF4020B77A870F5C13B923888620615F372BCB657649AAF13A017761F376A19E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 97d5bfb46d5c57f254560a03c910191c461ab4e0c5f5adec7c3e7f6461c870fa
MD5 5b38ec598092263a3521b4281f25e419
SHA1 14ad84715409988002212da6ed038282c4820810
SHA512 25200faad62116e182b2e74624667eb2901e7d3a982726340d0a58d12e84859e04092ae370559a412ea80a6bb879eb35e616db3436f7c2c09aaecc9958efd6a3
SSDEEP 24576:sTDaLl3z0zDghkJZXYGbwinaJK5mlz776UfiP:sTuLljSJZhbww6z776rP
TLSH
T1DC050198B3946CF4DD6B813ECC258516D2B2BC9A17A0C61F03E436661F333A15D2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 abcfc60adba77d0ed4899f240969c5ef8db77bb26a4f2f4685bb26f773810c1a
MD5 01e952d29d347b28eb4daca73b55e105
SHA1 8b9fa30f6c7700d858e28eecc336b3fd74f3ecef
SHA512 4545bd4be27742fb166ce958bfd68af3935084ed689d61cf9a8d40292fbd559851384913be21e03361b0d4d3802f588e74c3a5109e5bcdf2c050d691884011ac
SSDEEP 24576:NcP4mcvIjkGOxhKP2l71nNKbrh/8KBZhkJZXYGbwinaJK5mlz776UfiP:yP4m4IpOO67W8KiJZhbww6z776rP
TLSH
T1CB65AE2DABDC0096D0BB917885658A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 12adc4bd2541f7d7f5e2215f860260705bd11443d7283a4465eb553839c9fe03
MD5 98b89e4109cbe97740a2eed208185324
SHA1 03da26f9393ed40c342f11205163981c53d36cc2
SHA512 cbffe6300798e1f40b046a00004db5199537617b1259156fcbfa87671411a8cce2b4bcfeb510e3f4c9d62fb98261186703da22742eec0db622fd39cfa6195d0c
SSDEEP 12288:BbsfPZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ/:chhkJZXYGbwinaJK5mlz776UfiP
TLSH
T151E4010AD29C52D4C12EA279CB568641F3337CA5A3E1E3CB52D0F53E0F79690ADE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f0703268c7d78e7afc89e0672a9f7d4aae6e1e44d63f256155f539fad6099a0e
MD5 e697582fc131b8d7d75fe1112d2baae9
SHA1 f4cc002c7e9cb2a6dfcec9b36f6033a7f939a78d
SHA512 cb14a05adc05990a90b2ca3d41225e4cef5b22296ce596610b1fa62f400fef7ac18fe5e3fe1d7c580de936759fbafdfed9efe3198588b3cd58b47e1b29563147
SSDEEP 12288:gvZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZy:gBhkJZXYGbwinaJK5mlz776UfiP
TLSH
T124D4231AA79CFC82D23FE6782436C1797037FFD5BAC4606BA55037641678E62E528123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8caff798404c29d1fe2b5fa05dc91440ffafdc0a2dcedac04b78dec30d0141c1
MD5 84e16fcddba093ea118d52b38572f480
SHA1 181c981722754c4eb5dd0e20bfa10a3413718ac6
SHA512 929f7004383325cb75b741f2a08b7652a3ddb897343e8f54f6ba95eb786b0edc29c852bbe8e22ff39088cf42d9e322e23ef6361458a6a7bb86ca40a2f5097a2a
SSDEEP 49152:ea0h2GEkuAe73q3pp46zwwQOJZhbww6z776rP:ea0hNYG4Jwftfd
TLSH
T14285AF1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 45a9fa5a069d484f0b748b46637b16d65fd26cda74c6bc4601998fab84b89f8d
MD5 e6ce810687433f40eff18fcfb30f59f8
SHA1 0022df69ffd9203092bee16fb7cd06198b58d55a
SHA512 25568f9e8cedeb6da7e407e1d8f9a3bc518ef0fbf862115f45891ef34a2e5de1abaa43085246b7d31de22fd01384fe17fcccca1a5822c1b8c7e2c945f4a8a571
SSDEEP 12288:ihbHjfXgZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZS:ihbHjP2hkJZXYGbwinaJK5mlz776UfiP
TLSH
T17AE4127E27AC34C1E23AE17C9552814AD332FCA6275163EF22D052790F3BEE55D38A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9c41c3059a604c0e5c6a2e5472e641f9f4660ab358a83fd06c19c5a264c871c9
MD5 3b3e8cc11485d48c93402cadf90d92f9
SHA1 eb294351ddd246a4f665603de304a598181f7a63
SHA512 802be829b0a5af4e3b3857ad4c2f5bc30f617a7a78d518d3e343540817160106f76189b29ab06926c99b5396efdbf1a50c4a427a5abf07178644d2b2504e804d
SSDEEP 24576:X3YgnJcRTk4yti+R5dBR/ehkJZXYGbwinaJK5mlz776UfiP:XIgnaTk46pBR/LJZhbww6z776rP
TLSH
T12245AF2DF2B910B9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 a309050f479b99ca17807059dfe6a9afd7dbdd04102f66aada91e74c5657aa70
MD5 604238175d65ec5974b023afac9ac458
SHA1 d81c0d8a0b7283eccddce307298dc15c809b3cc1
SHA512 279594a1ed278d6eaf2412966d5ba0539450ed8d10ed6d76e35c92d06daf1b6d67eed30e9fbeaa435735905462b5e3261b617619a27c46698922fd52ccd24ec9
SSDEEP 12288:OzZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZo:OdhkJZXYGbwinaJK5mlz776UfiP
TLSH
T1A7C4235DA68CFCC2C62FE27C652681797072DFC6B7C530EB6490366517BCAE6E138062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 ec0951b38b73010bd0ab20c4140ea787a2457dc71d96c47174d70b083e6868b7
MD5 7e9f454d19536103ca88d08df62b5ab8
SHA1 1fc95e27a9335b92f1fc899a4360923136e13beb
SHA512 3714b7b7a1a7022d3f59a9d80c4a455497606c89f41dbe48b325ceff3d92db0bdd85808eda991a741b3f2e82472518647d05a1ec137642cb5b11c8823c234abb
SSDEEP 24576:fbL3UTchkJZXYGbwinaJK5mlz776UfiP:fbL3UZJZhbww6z776rP
TLSH
T16625F115E79854F5D93BD13CC8628626E272B89D1364E7DF03A84B651F237E28E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 f3692f688a226bfa3ca6d4d5765584e4aeab2a24502e30b49dfe2104b736f4a6
MD5 d5881ae00b06a022678277749f59b4f9
SHA1 2cdae270a86ffebe3558cf4f52f4cdc3fe324e0e
SHA512 06e83e6d211067611356e6e17b3daec4b9cc869501908eca15a7aaf84fd4b1ae08c276c2786b06b43c19648fb149236815dec81f51655538aee31cb0eda548b9
SSDEEP 12288:WpFtIOGZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZY:dO4hkJZXYGbwinaJK5mlz776UfiP
TLSH
T135E4021D36DC24E1D13AA13C8952825DE372BCA6175263EF02D0517E1FA7FF8AC39A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 99846934e3dea50c4d07a7deb8c5bca6c41a5fff9fa7d27d8bef34db2844af60
MD5 fac5adab09476a0deaf9074bd827c8a3
SHA1 6ed14ebce9560edfe3e6ce38a7c6c0b4bae7955a
SHA512 f9540197aabe26a3344137da8fecbf7e1f12601335a685b3f417c10782849fe5cd5c6eba541000fd247f28f496b631fa5774f6fb704ba1c2d791888568e069b0
SSDEEP 24576:O7NM9YqZqmWMUkPjZM48Mv6bEhsxhkJZXYGbwinaJK5mlz776UfiP:O7cBWMpPjN8DbEhzJZhbww6z776rP
TLSH
T10565AE2E6BEC81D5D577D13DC9A28205F2B2B8611B318ACF1162833E6F37AE45E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1dfe9e6ba0d9b370abf12e0d906a170dc43e426ea0415539dcae58bcabf46838
MD5 042bc637ff91960dfbb3aeb09a4abb61
SHA1 3f9c0350701ca3443730e6cd023ed4a42587d4c3
SHA512 1b15e31d2c5427f0498d5ecb2c45461ea63c60a64d487506994edcb316919ad122bd453a58c022b93f0aa4457195a11de5a2ad5cedf71e3941f5852f59d9e81d
SSDEEP 49152:VF2YuHNETovAvNYf8km8JZhbww6z776rP:w6BCf8k5tfd
TLSH
T1B4857D6A27ED80A4E0BBD27D45B6D246FAB2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f7af65fd02c1abfb7e27324b79da13efa995c850cc9b80e3c5a8ac7ee5b5181c
MD5 efeb3cdeb268e74b9006c3138b49c1d6
SHA1 35d6154c4b33b16142538cf76ff406f5451c6891
SHA512 e03f6996f8aa519569a343a4fd99e47642fc2183e2c1665fd9d918943901331ad6b1df82e75641ad8ad162f9bcb540710c210cedc0c27ce7ce794771f56a94aa
SSDEEP 24576:WAFs06+OmlfkNXEbTo0hkJZXYGbwinaJK5mlz776UfiP:/Fs060lwXuuJZhbww6z776rP
TLSH
T18865BF2F66EC00D5D07ED17D8997C91AF2B1746307256ACB0260867E3F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 5660e5e233cfb1a41c880f83902f4efc2b99f9588abf2ca2073284060e61c3ba
MD5 999f7a72a11626071b4a2dcd25cc3e8c
SHA1 6071e18bffbefd781b0d6b80a0ff512171c8c67b
SHA512 77405751cabf95939bbf2f696149322f041aef866ee440ac5e9956d955ef25ec6e0324959e858f6910251a371de19a86b84c031f4b7d0e6abcfba35a2bfe2f1b
SSDEEP 24576:RJnJ5D3WXvhkJZXYGbwinaJK5mlz776UfiP:RJnJ5DGXuJZhbww6z776rP
TLSH
T11F15D02DD2A810E4D4B7C274815A1796FE72387D2F2269CB28B4D5353F12FE0AA79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 884af5819ca29865b9b35ebabf142d3d4de9afc618b26f60cd9dc9f5f482160e
MD5 f2b8777c9a133efdd23f2c88785c91fc
SHA1 9238a06c596e9c19ddafdc71db682fe137acc532
SHA512 101998945fac8f56d6f0e801a4a6dc6faeef72d11ba8318078c2696c909b3e997db53cbd0c8b598e71ff5cb57612653f445c9d6e8fa5db9b1c353945ff28a23b
SSDEEP 49152:Zg06DIKdwc+eQnSt65aVIJZhbww6z776rP:CKtfd
TLSH
T167956C16B7EA5294E9B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 5868b2d99807abd136ee41ef99aeb4e25054eeece094cfe89e5baec1e3f89f0d
MD5 5f0298398a2a25c36df51aadac9bb148
SHA1 b90e661f8749939d3735eea05ae691da0c49f26c
SHA512 ca4cdf7f8eceea9c4eb154c612d289b9216d42013734da8c011896ed966c84454936d08cbe6b9e2c6eedd5fd6c1e6d352e230a22c1cd55df8ab5894ab611941d
SSDEEP 12288:IEP3Rn9ZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ+:jnrhkJZXYGbwinaJK5mlz776UfiP
TLSH
T18CE4126D279CB0D1C12BE13C95618255E372F8A1779223EF12D0923D0F7BAE96E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 9dd8335e1147291bec0f5119c6d1a8c7741b1bb47243b094f488b91f8516c268
MD5 de1c0cb1adaa7effe1cf5916799d4f3d
SHA1 b742e855c314183c4b44b22e8e5de50adf157fe9
SHA512 be3cc449bd8e339187addc040077188b5b8813d9224dff0bec1580587ad6fcb8200666c4c0619f533a296c8a9b5c2abcb3818056b13684683323c991fc8c017f
SSDEEP 12288:7jkyQZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZt:7IyGhkJZXYGbwinaJK5mlz776UfiP
TLSH
T132F4120863DCB8C1D67E923C997381A4A531FCA1AB5162EF50D0B73E1F79BD4A534B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 43c98280b0ec804dd2327e327a7eed91efc98275205961e8e813d3fb8a5ac710
MD5 b75facd6980b5c7ff9a2ac32b1676ab9
SHA1 eb0181cf96462dcfabc02b5f4e2dca7752fdd893
SHA512 8d397433cd4c5470623c44f60d5e26761199a4a35d0e4973282f0e11626d8f1240e8c72efd98ec72190f389c0c93625d3ec68e2cace99619b29cdec8cb0ff3ce
SSDEEP 12288:/y2ZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZu:KIhkJZXYGbwinaJK5mlz776UfiP
TLSH
T114D4231D669CFCC2C62FD27C553682A5A072BEE6B7C530FF64E076740BB8AD2A138451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 fab02dd71a7dbbe5548d5af19f098cc3151c80ec041ae225c1da67794be268ba
MD5 0f7a26746583ff6f70377e92de1ed007
SHA1 aff9e0a1bf9687704f1d333fa8a0fa1920bfc488
SHA512 f821795a0c0d4ab88480e8c86cbd0967267abe5638d0c9287acb1eb8208308c13105bcb65fce5fb49aa847da3819490cea302e59be3492b5adb31380a6f0960e
SSDEEP 24576:zQ9MxZKdcz9dw3JhkJZXYGbwinaJK5mlz776UfiP:zVKZEJZhbww6z776rP
TLSH
T184558D2DABE919CAE177D27595B240C3A673B4311B31D6CF2448D03D0D7AEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 ab49e40d7593d40e4b20ea252b0bdd52f22a246624e24b81a06a9270d6fae4ca
MD5 7704a87c6f2991f4d55045cba637964b
SHA1 9882117bbf649f62e40be10a4d631329e913f78a
SHA512 d077a0581943fadaa147efb709b4178f13ab59d5d53bf81f7d9ba81346c8d1c77b33d202fb2c07ecd509394eebe0b7fb3b142a3e505bcf367a732c0515e9f60e
SSDEEP 24576:9yocDApChkJZXYGbwinaJK5mlz776UfiP:AocDApnJZhbww6z776rP
TLSH
T136F4E01FBBAD40E2D136813C89858245E773B4706B6263DB6590C33D4F67AE9BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 edba877d7f11cee22838be148bd7522a1b777e8bb9ec9c49c5bd1bb8a40e7d04
MD5 662734ba511e44d134119ad719daa734
SHA1 060db48d2a53b6c59ebcbb6686bd58804887495b
SHA512 3a35effe71df6acb46b66b6c16a1617112e84ee9c4228fc25de33d0934fbb97848b8c65f7aa2f78eb1eb98d0c5bd30652110ce420af706bea35e5bc036e6cce5
SSDEEP 49152:xWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKnJZhbww6z776rP:p0zuNIFtfd
TLSH
T15FA57B3DA2BC00A8D9AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0f43dd72c63b455f76eca39894da087e4fee0a6a250e989242be8b8bf6c67a74
MD5 0209d10d12a75185fe617b7c9d135898
SHA1 944095706183066448d38062c1694d36c6dbc23a
SHA512 0da51c7e506697305fbf108e3af6a80d0539c4a5e16a40faa5b90a8bde8f49f1ab7a173c96333eefd3c4301daf0aab905f0e3d92be6a411a91fd73ab3897e947
SSDEEP 24576:w1QT7EcpfxR+N5AWAz3ooiYujMqbrhkJZXYGbwinaJK5mlz776UfiP:NTDxR+N5YzT4jMZJZhbww6z776rP
TLSH
T12255B02EA7FC55E5D1BEC5789A23C512FA727861033193CB42A0C17E0E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 4fa24e45d37efbfa2709856f0dcb1a999e8e530cb69c91d8399f8cb1bde029cf
MD5 34eda68c5252a3c70c37d7d59e246b59
SHA1 42b02d3d12451368ab929a86af58ede2265bf618
SHA512 f748728af7daef69338c378d91aef7f9683fbd87c7f09541acdd24c3188bb4244cd24bb944e42a572c3b9da483251f78300cb1fa0b97f3dfcfe37ba2ac13469f
SSDEEP 24576:TTMdOz0FFS+bmSLHhkJZXYGbwinaJK5mlz776UfiP:R0K+bmSL2JZhbww6z776rP
TLSH
T11015E13EA3AD18E5E53FC27C96538906F57278A2032266DB0690C1792F5BFE4793DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 e4a3b90aa80ded3416d9b9f4ee23b66ba43bb550df7daef385fd565260efc78d
MD5 8e6af844c9d2f4d715df82d856cf9f90
SHA1 d386d788ad910c1f7a761f33b20c87daa1166321
SHA512 7c63778b63e5ab4cd316e9e362a420a62631283830fb40402bcf84e891d83d3bb6f00db02dbd1c8209b75bdf91515935e738764cafb7ff374b5fafdcb5d15cb8
SSDEEP 12288:t4KCZHx/vAfIEZPgafw5Ebw7Wnacl8HE2WS6f190U5mQSjz77Y/UfiPZ3:pchkJZXYGbwinaJK5mlz776UfiP
TLSH
T196D4121D63EC78C1E53BE2389A3641659131FCA6235525FF35E0E67A0F3AAD4D138B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-162-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/548-387-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/880-72-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/880-152-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/940-413-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/940-166-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1660-226-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1660-121-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1672-117-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1672-174-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1672-414-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2108-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2108-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2108-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2108-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2128-78-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2128-84-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2128-157-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2128-77-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2272-57-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2272-69-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2272-67-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/2272-64-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/2272-58-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/2304-432-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2304-195-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2304-176-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2304-179-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2304-366-0x000000000CEA0000-0x000000000CEA8000-memory.dmp

Download

memory/2304-216-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2408-165-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2408-103-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2408-109-0x0000000000580000-0x00000000005E7000-memory.dmp

Download

memory/2408-104-0x0000000000580000-0x00000000005E7000-memory.dmp

Download

memory/2744-98-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2744-88-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2744-93-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/2744-161-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2936-415-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2936-171-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3664-24-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3664-18-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3664-113-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3664-26-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3664-25-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3752-154-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3752-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3820-368-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3820-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4424-0-0x0000000000400000-0x0000000000499000-memory.dmp

Download

memory/4424-8-0x00000000021C0000-0x0000000002227000-memory.dmp

Download

memory/4424-76-0x0000000000400000-0x0000000000499000-memory.dmp

Download

memory/4424-1-0x00000000021C0000-0x0000000002227000-memory.dmp

Download

memory/4424-371-0x0000000000400000-0x0000000000499000-memory.dmp

Download

memory/4520-149-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4520-350-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/4544-34-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4544-40-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4544-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4544-124-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4564-418-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-454-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-441-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-442-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-443-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-444-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-445-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-446-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-447-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-448-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-449-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-450-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-417-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-431-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-430-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-429-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-428-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-427-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-426-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-425-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-424-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-423-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-422-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-421-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-420-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-419-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-451-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-416-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-452-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-453-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-433-0x000001104C820000-0x000001104C864000-memory.dmp

Download

memory/4564-434-0x000001104C9C0000-0x000001104CB69000-memory.dmp

Download

memory/4564-435-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-436-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-437-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-440-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-438-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-439-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-456-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4564-455-0x000001104C870000-0x000001104C880000-memory.dmp

Download

memory/4652-147-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4652-335-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4652-143-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4652-137-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4824-54-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4824-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4992-114-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4992-169-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5004-14-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5004-102-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5044-290-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5044-126-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5044-132-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/5044-125-0x0000000140000000-0x0000000140169000-memory.dmp

Download