52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
Size 1.7MB
Sample260930-hl48sshc87
SHA256 52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9
MD5 77f06261d2ad5b4e726445eba2b4a6c8
SHA1 e3fc6ac83a1906e27a1cc17414259c526cc72af8
SHA512 f7d833e1c1c7ecc3abf4406912fafbae86014bbf11f962e26eacd65201ce28c41988f316d1edfb38f501dac9d6800af4e951ce9b0ebe816036a7ee195c974891
SSDEEP 49152:RZivu9n2mf5SfJ4klKXn/h0PWj37y63bTgv/S2:WvYf5SfJ4kmrj37n3YS2
TLSH
T1D285F0203F829836C2B309B90B9DF271075E6D5C0A61865357F4FEABFFEC1626D20656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
1476	elevation_service.exe
3928	elevation_service.exe
1672	maintenanceservice.exe
4080	msdtc.exe
3036	OSE.EXE
1496	PerceptionSimulationService.exe
2304	perfhost.exe
1860	locator.exe
1728	SensorDataService.exe
2588	snmptrap.exe
396	spectrum.exe
2708	ssh-agent.exe
2136	TieringEngineService.exe
1868	AgentService.exe
1500	vds.exe
4484	vssvc.exe
4320	wbengine.exe
3664	WmiApSrv.exe
1224	SearchIndexer.exe
3932	alg.exe
2520	DiagnosticsHub.StandardCollector.Service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
\??\F:\	elevation_service.exe
\??\F:\	elevation_service.exe
\??\F:\	alg.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\spectrum.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\AgentService.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3b26a39250d612b.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\vssvc.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\wbengine.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2584-6-0x0000000000400000-0x00000000007CF000-memory.dmp	upx
behavioral1/memory/2584-66-0x0000000000400000-0x00000000007CF000-memory.dmp	upx
behavioral1/files/0x000100000001701b-427.dat	upx
behavioral1/files/0x0001000000017bd3-429.dat	upx
behavioral1/memory/2584-437-0x0000000000400000-0x00000000007CF000-memory.dmp	upx
behavioral1/files/0x0001000000016794-439.dat	upx
behavioral1/files/0x000100000001704b-438.dat	upx
behavioral1/files/0x0001000000017815-436.dat	upx
behavioral1/files/0x000100000000c540-435.dat	upx
behavioral1/files/0x00010000000232af-434.dat	upx
behavioral1/files/0x0001000000017430-433.dat	upx
behavioral1/files/0x0001000000017062-428.dat	upx
behavioral1/memory/3932-629-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/memory/2520-657-0x0000000140000000-0x0000000140166000-memory.dmp	upx
behavioral1/memory/3932-663-0x0000000140000000-0x0000000140167000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000944acf0aa850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd05070aa850dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c523c80aa850dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045cf8f09a850dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4f89609a850dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc35fa0aa850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ebbba09a850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003456d709a850dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe
1476	elevation_service.exe
3928	elevation_service.exe
3928	elevation_service.exe
3928	elevation_service.exe
3928	elevation_service.exe
3928	elevation_service.exe
3928	elevation_service.exe
3928	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2584	52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
Token: SeRestorePrivilege	2136	TieringEngineService.exe
Token: SeManageVolumePrivilege	2136	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1868	AgentService.exe
Token: SeBackupPrivilege	4484	vssvc.exe
Token: SeRestorePrivilege	4484	vssvc.exe
Token: SeAuditPrivilege	4484	vssvc.exe
Token: SeBackupPrivilege	4320	wbengine.exe
Token: SeRestorePrivilege	4320	wbengine.exe
Token: SeSecurityPrivilege	4320	wbengine.exe
Token: 33	1224	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeDebugPrivilege	1476	elevation_service.exe
Token: SeDebugPrivilege	3928	elevation_service.exe
Token: SeDebugPrivilege	3932	alg.exe
Token: SeDebugPrivilege	3932	alg.exe
Token: SeDebugPrivilege	3932	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2560	1224	SearchIndexer.exe	116
PID 1224 wrote to memory of 3796	1224	SearchIndexer.exe	117
PID 1224 wrote to memory of 3056	1224	SearchIndexer.exe	134
PID 1224 wrote to memory of 4880	1224	SearchIndexer.exe	135

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe
"C:\Users\Admin\AppData\Local\Temp\52a628e481e99653dd47f9f23710be18bc4005eda64f89b20b5dca66f2599ba9.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1672

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4080

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1496

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2304

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1860

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1728

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2588

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:396

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2708

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3356

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3664

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2560
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3796
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3056
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:4880

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4febcac85acc3dbd83e6e78e38416400f2de20a6475cf0b8acd42b024ff9c77a
MD5 47309964b7d2a1c32d50e5f2f1e4d080
SHA1 18ac95d23551d639363ad179aed5ef205deee63c
SHA512 4e3f456bf7f3c25b9716cae41372ea02657b1f9a0802fb6dc7889f17d1b1f8d470f91e2161095d5ec57226d77650cbed6198b68f3504da2866587d4becc66df7
SSDEEP 49152:9b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnPfJ4klKXnM:D3q6mjBYfJ4k
TLSH
T102D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ea20bfc4886578db05d377bcc0534e9a6b6b94c9831770cae90dac43b67349e1
MD5 b630cfb312c1faee42a96b54fcf0278f
SHA1 fafb996f156d779bec7580896d88ace21e8e8d03
SHA512 ee47e0c067fb835949ab5fea6daa117235790ed7747eab283383974aef5b1eca7252bb16ed5a54046fe7ce37aa2e97c99c967a6bc927eda594eb97ab6fa56899
SSDEEP 24576:hXYRUmczAcfJ4yL/tNCJPXUQrPs/eR4MiPP/+XA8GSV7y6ggxbDngv/S2:JmcZfJ4klKXnEG0PWj37y63bTgv/S2
TLSH
T1AC75126873D018F9DEA7827C8A91C102EB327C8103B4E3CB03E599655F77799297E792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 cc6729e232aa9c6975ac1817aa16fe27362d4736f421804358c31fd74bfc1e2c
MD5 7bd2c379dc51632129463ed117235c81
SHA1 1adfa4c6b1eab007b6f1522df5093a0c47e8291a
SHA512 c87905dba51c77111363189f9e6ff509d3870806a093d3576eec019fc639f3de3238b2d8c7b7e9af9afd1871fb595bc7f1717d3e5ee1f95ec96184aaf2b8ae58
SSDEEP 12288:h1XLsswWkxy2lRq2czAcfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sr:PXYfDtczAcfJ4yL/tNCJPXUQrPs
TLSH
T1A005F12973D008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 503301c696809330a8ae739b2efe11c146fd6d38afa2374813902d3668756797
MD5 b2b1e72af34b32ed6168434b34442231
SHA1 b2c55ebbef318b74e71cf860f52ce1ea0ae6dbd9
SHA512 bd04fa137d10c64e1cece7801240a96f52fdf8d44eacd8db37f9250ecd275ffa28191c7a5dcdeb7e5c8a740d6fc5f1d1e84938204eac7c07a6ee3a2ff69eedf1
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWj6q8wyuJfJ4yL/tNCJPXUQrPd:U/ezSC6vUzPv+HjyufJ4klKXn1
TLSH
T1A7756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 dc1e167f24add12538f53fe7150540c1b8184851aaa06cd1dba88d1eef29f52b
MD5 9a11a00ae114a09bec34cf630a27dc07
SHA1 c637bf2e493471798c2372e9af40d62354c779c0
SHA512 6af4b2f96b6f718a68752321d799ee45f6d979dca737640bba511bdb56be6d7461590f340a738daa906604228e65ec9128e78c41c0b4366782c00f095e2e5ce7
SSDEEP 24576:3VbqPb88hv/l+BIfJ4yL/tNCJPXUQrP4:3VO88hXl+6fJ4klKXng
TLSH
T1B6559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8897338a090e16b1eda1231e88926a8fa6f0d28452447c5388fc1cd3b11d1367
MD5 7295e1b02cca04723e2e4d0459085cd9
SHA1 9a25beaa865e449fbf776220595b5967fc4e42c3
SHA512 6e10d1606bc0142c2f736f587e9974c55bf5d7e743922491a2f768e836ff53e4edb5be0fafe9c49df5c89247a73497147bce550ce5f8df8e3e55434cd7b356f9
SSDEEP 12288:FGDfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:FGDfJ4yL/tNCJPXUQrPz
TLSH
T146C423E751849086DF6687F82A8CF001C704BEC55A2FA2F6DE42B8857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 e8f98dd51bbffa572f1dc1f6ed51ba3394a1297c7d4387c1ca3eef06e597b0c3
MD5 9aa46c62cc2303f1b5869539542a36d1
SHA1 58b92ec13c247ff13114751f585b43f0ea992b1c
SHA512 469dffdc8fcb382830c1558ad60c94daab7d24b223b6b98d0c22b07a507000caee01221f852a7badb2114d4a3f85f7224c934b52c1cdf671a4a0fb574ff4ce0b
SSDEEP 12288:NeBNUbTVO86UAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:NJIUAfJ4yL/tNCJPXUQrPB
TLSH
T1CC05C07BAE28FCD2C67A8DB85790C200D77278704B22A3CBD165C20EDE275E51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fd8b1d9b5d460671c43ef17c0b955f1ebee2f67ae8c2ca010023659e53b99c65
MD5 9121d3d9f216b20510dae8da0adb7443
SHA1 7e6b5d4126db67845f24332bd4c85afde565e19d
SHA512 02e8eaf2abd60ceab6de6399a24ac64da109ba99bbc0b0d2b99ed7750c1b56f2045445464ab3825652313acf46cb185fa96ac4069c56fd1efe888a9e8fd5dbf1
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THb:6QvGAdlCEL8c/WRNw5C5fJ4k
TLSH
T1A4266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 5d83a29526be5cf7149fdec6604866f8eb23c9d38c441804b8fbcca539190c46
MD5 7918370e52a2518d597f28b4a263ceda
SHA1 7a97276a7c87d1aef5962ef6c8b66a8cb5697505
SHA512 21ac957af500c13f395348e9dc9f1c0fb084b77d0276204ef534f798a436df56ef319b15466eaa7bd72cf8be32589242310183fc775b73b973aafc49c213881e
SSDEEP 12288:bAwSfxL/2Dc3mDLLmt0LDQewsAjKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWS:EfewsAjKfJ4yL/tNCJPXUQrPE
TLSH
T1D215E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0a9bae7778ac5720ae7c946b784fbce6bbef80c8b3e34bdc5376214b04c43f27
MD5 4d370518bfb18eeca4a9bd0ed2c8ea27
SHA1 20634758b001d0259221a361734082e0ea88e39e
SHA512 38c1e33c3dfa15aed5a144a5a2c223b5db1f497c4d09fd9718292b0c253df4c90df56bc3dd3574b0b9a8543a2adfff33cdb965009ed54589c561951c339c833c
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHyfJ4:KUEtQevvqc2W1cpV20I32y
TLSH
T1DA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3dd425c28933f7596d116816389c446dccf3db9db263d5ec01232c54c62cba60
MD5 8deeeebf492b867030987ab38189abd9
SHA1 55ceba37c033cadd802ffa3021db16bf9f5e8160
SHA512 cb192ecd9d8260e90f8e17506a262be32ceae7dc878a821b874cf132fb807fb6dd489e376b53142c6d9999b9f3902fe080f5223b78ac1e6b707f939e1b2db465
SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/zqfJ4klKXnQ:WoqtVjnmdfJ4k
TLSH
T1ABD58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 82bae43f08feeaaac980d35119dbbeff71d524e65e454621fe918db8ac9ecd3a
MD5 6aa670a1077eaef27810bc62efe0eda5
SHA1 4eef0f1f4b5f622a799fd0a47bbbb831778858d5
SHA512 4284d8ec2f1356c37b935fcdf67ac69a2d3404d14607e83e47c90b4e50e05c32f61fcaa5c08371debd822d9b6bb33a3c2789685a36096a5248d68e275cbb6127
SSDEEP 24576:jAhGL6IFoiwtA5l7S539fJ4yL/tNCJPXUQrPn:jAM5Foiq5NfJ4klKXnv
TLSH
T105359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 cbd43a56766d4b2e4f2b563e9d363e8e8168ec8f62c9b1bbc1b5c33aba61a717
MD5 b9905431727b69bb525dfa1610623a2f
SHA1 4cbcc88dc7fc316a84f6e1b3a02633108b344b65
SHA512 32f297fc3315f022dc80a7dff9f1c5276e9f2c0b19c37219f6a5d93ee201d6ae811316e945ed73a06b9984142352254f509d6a53a17510cf8cb3186034e34140
SSDEEP 12288:0mw5HEjsChNEBFgl0WDm+CpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT8:xwuROWOfJ4yL/tNCJPXUQrPI
TLSH
T19905F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 3b452e101954fddebef877243ed7cf0c693bcbcc1c47a221291980e8be937926
MD5 966594e323f75cd27be63782524e7e49
SHA1 abe71525431fdafc6c4c90804a9cf805372fcfa4
SHA512 6d8856fe790aa5397b43769a9609f8c251dbd5317808e0ec76185886222eb7b74fab7f01a049723f5263f6d8cdf4eb9a30f7f78a4d5478a49a77b90cf996ae4e
SSDEEP 12288:/yZ1Iy6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S7:6Zu/fJ4yL/tNCJPXUQrPk
TLSH
T19EE4129B32D460F9DAA782BC89D4D101D3317C92273A43CF5A51959A3FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8b67629dc1594e3e4ef8ea6a5eeff7900b932afa8000c93cd62564eede618bca
MD5 6f9c3cb5799683c507460a2bb66e1115
SHA1 090b5d5a42947c871457abf55dca9c3ac3a3050d
SHA512 099bd9a7b85f9ce8dbad05b94f6c149614f2f3199fb32512f53e7fcfc8419bf825067976b8f6642eaf0721d71625c3749b7a8399664a15d4809bac004fddf824
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Um:6QRQyi36YOcPDLvw2gAf+PN3UfJ4k
TLSH
T1C1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b3f757218c8f99ce15afc680c345dafd594d94274923ada9824f99062589b02c
MD5 827db464f0dd20ae3ca9ef7cec7e0251
SHA1 61caae9f6993578cb32ffccd9fe8a3e47822dd69
SHA512 ad3185d54b947bb66f542f5a170cf950703a88533a518adb42f456c6fc926152e0ad738bca972f42233fca414f7b25eb9840d32bca5a2385075e4e6f3ecbecf1
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U/:5QRQyi36YOcPDLvw2gAf+PN3UfJ4k
TLSH
T1CC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d1021876f02851bc081a9dc7842122c3569f00c52c768d0540d8e0cf2f3d6b88
MD5 d4085a2a692c43705d598850d466984a
SHA1 cbac35b2691a45ef1d4577891c322f26aa00fe2c
SHA512 798b34712fea5ad23dd2c1493f36e6c958acd669cb82cc609ecfde75da02918db1f877d2912f9a7c449b8f4f5a220804fe632c43810619c9f94c894ae4694fbd
SSDEEP 24576:owvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0PfJ4yL/tNCJPXUQ:u68Qg55nhkeWu7PNU3/afJ4klKXnz
TLSH
T14BB55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6ae6269d022cff334cab06751987d654e111a2c5b574eae0937efcce32251e7e
MD5 4203e9cb747268364fa729cf9bcae792
SHA1 76fb8c9b53fcf069ca3020965cba02b57acf6957
SHA512 4a312a7c833bb5f573830c99e9d92e5eeccc160b08fd82d27672fd68fe223770c91ade13457477a0303eba54ffaf3531a7542f4b6ca99b1b9f9b6a7626352c7f
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99i:0y5112gYy5azzVvU69nLKnhZDfJ4k
TLSH
T1A1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0698c4de503ab848c48c191f93e032a89b6670ff2ead550f9c2d3d1521e1dd3c
MD5 9afca1bdda5dba23ccd84b5999ed5dfb
SHA1 a43dd137cb39e6f84d4e2c4cd44e57411d170906
SHA512 5eeca3e58cc313cdb12c8d4d3b9d59850e6cfd4dc14a3037a3cd77ba86c381276d1837f7a40dbda8e0d9e38f9784b25f8d4e0d30090058bdceed28351a8ec4ed
SSDEEP 49152:HB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glsfJ4klKXn+:Ju6JmIxd2dsfJ4k
TLSH
T1B9D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 02d30f3cd54f981d8422f6929edd89e0e21299743f3eeaa1e701bd3c4eed45b3
MD5 35fd31721335a3409b43d8ad642148bb
SHA1 dae2d2f1d78ec92f97b7737359759426db17b89e
SHA512 87e60f3a20a01064695572f817d41d48b696cd8de31cb9d854499a910c2e82de782a7d2c852b16507c93ddc3202b7f4bad18815dfc59c8612867ec96fa1e06a9
SSDEEP 49152:j1hpsNoJpF1A67U44CwH7R4xgfJ4klKXnP:jmifPqRdfJ4k
TLSH
T13FB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 30a38caa2b7b8c7de68dbe8f929ae9d7d8e22a83eb826d00d818451479a59937
MD5 9f4b820811684694c77549ee19813a98
SHA1 9e3df1be0306b2a8f9230729f2ed4d09fa92ed6b
SHA512 ae85cde1dcc9901317110f1990b9b4f257ecf0f3ac5005f2970331536add02bee715b200299f728b7b174eead7d172a4182dcfef8d3596a6def658d8ae771bb8
SSDEEP 49152:3SuZQIY0Be2KkRVtOnks6NMHq/fJ4klKXn6:t5dKqi61/fJ4k
TLSH
T1B5C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 320f3e26b8e19613b8bb736689f5509014ec3b236da97c073868c28735417aa3
MD5 91e1895cf364334875c432039ff7580f
SHA1 a726cbd9f64162b0fee55a10ffc3e98aac91265d
SHA512 7335511a77b39e595ed3fb0b15df432fa784e8aa7a1daa15b34844dfb4eeb4abd4e9591b4d032c4832450a7a5bc531c79b1dcdf79046bf745be17225e61a1158
SSDEEP 49152:WhtSn8EApI0figjgiDn0AP5wcfJ4klKXnb:3X2iWphhfJ4k
TLSH
T13995BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 0129189d1f46c38afee455ddf9156ff55e169517e5a1663b265217aeecb3f28e
MD5 4cad7c16dc403750701eddf5e4479db5
SHA1 0c9296bb85a1aeded72819afee36025b622e5939
SHA512 e0ad98d18c67b5910a433add4dfb65504609fa1242f0c249230bb3087fd29744e1129c9d85d8b9096c53ab0ca63b04029bf4de51f2a3a8affb2412c76ee53a9d
SSDEEP 12288:8bfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sk:8bfJ4yL/tNCJPXUQrPP
TLSH
T1DBC423AB60C5948ADE5587F81688F001C7087EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 984cff6e99e1ef5ab8b65aa6ba1bbdd74f6694ed6af32d01c6fb5219a3094227
MD5 4cd2d8d1fdd27a6cce27e184a052504b
SHA1 f8301516a981a8e3358f31764209d51fd81dc950
SHA512 dac6367489e87182daa4dce3c6ee3014b449ef61506754313a2c3b7588888f084b26fc60ea590575369bafeea755780381ab25f6c06b46dae45a2dd8219bdd63
SSDEEP 12288:CWfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:CWfJ4yL/tNCJPXUQrPB
TLSH
T1F9C423AB60D59486DE1587F81688F001C7087EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 0123c914c8d1cbc2ff6b974bf36b1d2cb37ed4c655e4e4ffb8010a6bf9aced87
MD5 8d7a272dd2f66d197ff2ea55ead07ca8
SHA1 d2eb55e66af64416edf56a25d722d069bcfa7cd1
SHA512 64001065af25eff1522f4248ecb7043562769310f6d41838833409cb1a174d96f7dd15c364aded9eb147b52c67c3d8d7e6fb87dd1eea9ca2b482beef57afed15
SSDEEP 12288:qYfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:qYfJ4yL/tNCJPXUQrPB
TLSH
T1A0C423AB60C5948ADE5587F81648E001C7047EC6772F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d8f8b7b8e01c71dbb0198172012ac5b32c62e09dcf1ac34ca02a88ca4bb2db98
MD5 723b8bee20ad7547af6f9d53bacad37c
SHA1 bacdba9c03b6cd2aea4fd53a08aebe42da3e8d70
SHA512 d25556e8528160210bc4b5934048fb5ea3a6d439b8407f427ea64e6ef8c545f5c813d85fa222a48cd90fd7d6f99bd97c2b6c4b591a928c342da546ce690b08cf
SSDEEP 12288:BVdfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:5fJ4yL/tNCJPXUQrP0
TLSH
T17FD423A7219480C6DD66C3F84A44E001D324BDC6673BA3EFDF4268863FF9659297C7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 599b8eb706297e7dbc6841de07b3647ac892f5b5a7bbcab138e0f1f7e5ee12a4
MD5 d4d20f2430268a70d51ba522853df61d
SHA1 e6ef9be554f39cb89b2a3b3ce0f5ecd37b1f0c47
SHA512 2df81420f5fc9be0542f62a03a598154dd5b792046023c0643d60799d035bba6209543c6ca82c71d1fa71cce5e9de7b4454ec0c67ac7a788df471bea6d4fd4ab
SSDEEP 12288:BFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:BFfJ4yL/tNCJPXUQrPb
TLSH
T1A7C423AB60D5948ADE1587F81648E001C7087EC6772F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 4424ca02246fdf314848c7fa64419c1487876cd3c93d9a93df1741c3bb60c43e
MD5 6690b0e59c9421c3914ab5b5184c8561
SHA1 01ac5ca105b8e548ffd7a93254c7a1966be245d9
SHA512 9c889e83763552aa4d583420c6e73370f4595977f238d3d93a544c8491c248fb4fb76564370156b327cdc45b030810f0d51cb20eb9b6498c40c4355f4c28501f
SSDEEP 12288:5ifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:5ifJ4yL/tNCJPXUQrPN
TLSH
T1EEC423AB60D5948ADE1587F81648F001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 9337b9133c4fb140b772182a0b3b61a061f437646ef8ab1faa23fa90fce4f29a
MD5 4e8332fea0b6b71d3f3a0ef841270388
SHA1 906e5f868f6e8f1508ced69e47ec3346b8c7fc13
SHA512 bc774a7bfed357ef9ca6ea0396f5664896b3e958718da1ccc6d2b5b4ef4c8c9bad7480cdf4669089c385610b687ae1077ebabc083ab9aa067cf98cd488afce12
SSDEEP 12288:xefJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sj:xefJ4yL/tNCJPXUQrP0
TLSH
T161C423AB60D5948ADE5587F81648F000C7087EC6672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 0e60db36afa2d2464aca551be60c34a3978d65f7c0ce97653525a39dab612267
MD5 83a7f0c6684bf2323a7955a62f1cbe03
SHA1 df2e21a3d38397e869dd1887a047947b1baa744b
SHA512 b6b71b7dcac7b542ee9ab85327f1268a0bb385cb1e8d12b9e587826d8389fab4b4946bbb197928091262a2462a3214da5663c2a8730d352d52e46cf2f37ff661
SSDEEP 12288:BiZwbDzzFEoS2cPvy2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SR:EZM3zFVSO2fJ4yL/tNCJPXUQrPC
TLSH
T1C50501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 28ae949a645e0817a80d2193a5972bca6da02c286dfb265cbecf5c43ce8d8744
MD5 c7a1893657a5c687f385cd9b11bf09f4
SHA1 6a8f5ccb58f7b357f7096671b2cc54485d8adfe0
SHA512 03a77d1368536de68d747d8d5fce97257ad3b193beef8652dae30519a6a28dacb99af02149c63641092690a93aae46fd9f78ca9dc2f50d61e5df36551e01878b
SSDEEP 12288:jvfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:jvfJ4yL/tNCJPXUQrPQ
TLSH
T179C423AB6095948ADE1587F81648E000C7087ECA772F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a4c36d52f971055ca9730556bd79bdf2efa4e2104587ee7b53e19a5d0279c9ab
MD5 6e6ee3625c3878992a5efb29596ea9ba
SHA1 a876e39dc5d938ae9e4f3bc72f4913abfce98928
SHA512 1e7b7b735dcc1b97fd931fd52dff9dbec90dcd89f8b2d14c4c440e35dfe6f550c40f0a1c1ccefc924d7790a534e9048c0f6c6281f5eba41651b1464f37f7d81a
SSDEEP 12288:szfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:szfJ4yL/tNCJPXUQrPd
TLSH
T11EC423AB60D5948ADE1587F81748E001C7087EC6772F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 95dc5b45c0bd0a820db1f87b346b80352611fadc789cccbacc277047492a21e0
MD5 b45be61427a3db18afe68e3b5971d686
SHA1 5b94996b8a4411e93731b4bc1f1686e072f7175d
SHA512 4aebc212580fd37c653c4200a50cab78404c7d27f5d89137c2db4800aa0107dca970afab14ef1de0000ead5f76f8e73e8763bfd013674757f025fc5f85625736
SSDEEP 12288:HyPz5L86fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:qzy6fJ4yL/tNCJPXUQrPx
TLSH
T192F4125732A130F9D53682788990A502F331BCB2073587EF5B9056B63FBB6A15E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 4c2624151f0fe927ff204dca0246fc2698f905243715de3cd5b1d41fdc5af591
MD5 cc2b0dffef260359bb7b19fa8f892495
SHA1 933c5d99cf0c98edbb8013fc237a4eb3bd6500ce
SHA512 77082207232b8123b45659d12384a87cf32697b92eb0df2f6dfda912a7216f9283201c45cb8483674c6e9ec28aaf79d7316a3b4e6b27890fb7d79b641c9cefdd
SSDEEP 12288:4vfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:4vfJ4yL/tNCJPXUQrPL
TLSH
T1B5C423AB60D5948ADE5587F81748E000C7087EC6772F62E7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 0667964cab7ee66a4b8def9c528286173ef7a4238ff0f1b6106e507a459671b5
MD5 953942de9b2e1b195235a0ef4e36aa7e
SHA1 e0cb0c1604381c8c4fe08cefd8fe77d5f61bba6d
SHA512 730c596301ab89d8579ef152ca36b2b5ac03ce1d6cf4e3497b46e7d974bfffbec9d820d831f9c0dc139f57c0eddfdac790e2af94c2bb287455a06a9716b51016
SSDEEP 12288:ZvfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:ZvfJ4yL/tNCJPXUQrP+
TLSH
T1E5C423EB6085948ADE5587F81748E001C7087EC6772F62E7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 9371ae009b3140ae1a81c8529e6c87429d6a72dff6067bcf4aaf50fcfea7d94d
MD5 97ee1cf585b5054835fa6c12d362a711
SHA1 3c2d928001bddae15b0572634d3c3284e03f4f1d
SHA512 d968f1994796fa578d7dadd6545f60631b3d464ca1fab284153808292aa86135778096412351abae8ca0b081971ee7d8dfe4a3cb47cf439542ee386fe5571f1c
SSDEEP 12288:nyPz5L86fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:Kzy6fJ4yL/tNCJPXUQrP4
TLSH
T16BF4125732A130F9D53682788990A502F331BCB2073587EF5B9056B63FBB6A15E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 0ff96e8824adbe3c5232e1e151c13fc9ffbb7a52662a0ad7932171b343acc9eb
MD5 246590653e2713fce8b4cf06ed8c561a
SHA1 0f142a019d725070a5ba5d2f85bc6234280cdad3
SHA512 a1d87941bd4d0b3aa1e75184f15780d8947952f3c7a566bff91747a8fe062af0559a2a6d60b28926bf5701213326f6d2b056e35e727900e1f1aeefb2fd72a096
SSDEEP 12288:ICd91WYoaLHF3z0z04PDvhofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTt:RT8aLl3z0zDofJ4yL/tNCJPXUQrPx
TLSH
T1D30501A5B39018F8EC67827DC9549502D3B27C9A0B70C26F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 111ffece398aec4b8e7c66fa99a8dc634ba66991decdfe9e38e9a38462f82234
MD5 7600478fa5c4a513e567e7b3271190a9
SHA1 10ea0f31f42597045811754ce04338d35a56a3d9
SHA512 cfca14119c9b48b75635bcedc127937cdca6820f8f77d05c8968c783dc9ad49159678f10a60ad8a31ad88cb47fd26af8618b12a05bd9ca2504ad2be0c12638b9
SSDEEP 12288:wi4e7+RdTfgwCHKy7GLbbdIvRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGJ:w3rd9CHKy7GZ0fJ4yL/tNCJPXUQrPm
TLSH
T11825CF91F3E410E8F0B7CA798D659501DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 cb0924a5e86a9b1dc0e2c27ae324062f7390180b1b1cd8597ceb8c5c0256fcb6
MD5 abb9e05c33259eb545331e6014fa8e91
SHA1 36f09b40cfc57c9a43e10ece1b600f0d5eab9fe4
SHA512 e3152467fada9d807691ea5bc6fa564a97f8c03749b263f14abe0a5247c7bcf52b5b8f69ce5407252dd42a0a04b0743c2fa49469d6fd324fda9000a9d3341ae3
SSDEEP 12288:q4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SP:q4fJ4yL/tNCJPXUQrPc
TLSH
T1B9C423AB60D5948ADE1587F81648F001C7087EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 42ded95b90585020169dc5ead3e226f908fc1da811dfd162056c0cadc9b31c37
MD5 174d5543f996ab2c7ebf56d94e895467
SHA1 39f35aaf67a59fdb5c5c87f31fde6fdb0e51b17d
SHA512 f84568f2ce22bb89b618681216709eb51197032769b643fe6636c1bce7d5631324a810337d45c44fe97dea57da8752adb2b0d75750467f77ef1193d0661dd98b
SSDEEP 49152:hP4m4IpOO6708K5fJ4klKXn8A0PWj37y63bTgv/S2:3ppOO1DfJ4kUrj37n3YS2
TLSH
T19FB5E02DA7DC0096D0BB817886658A4AFAB1742A1F3286CB1160937C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 5e65c27f7fb6f13206c51708537d39b866387efba13364c31774781bcd95c27b
MD5 be129c0d2b02f578ffc738b8501030b0
SHA1 2889e9c192a4d3956b2c55820e2bd870925eda96
SHA512 6ea7c35daaa93c4e530b211a3964af7a7a6d27be3852a6c85a6fa52b43ec5586d6e71e34ca41b46d30e51a11abe783ccabf29ac0d60652b974091273fa643728
SSDEEP 12288:tpsf/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:e/fJ4yL/tNCJPXUQrPh
TLSH
T1FDE4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 182c91ad6d1f931904c97861ae03c1c072ab8c90cdcf25998796345602e42cd1
MD5 233071339ee657a7ce7b6a9e47cb3c4c
SHA1 1f94742b6cb075a237a789bd10f9d04d8a5ff1b5
SHA512 75892470db1f68302bb851705df18bf15952bab06663ca11e06de4d9c224fc172eeb533e8f6225802d8ecb4b5f4d957450bf3b6e54d132f5395319ad2d213cae
SSDEEP 12288:KffJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SA:KffJ4yL/tNCJPXUQrP3
TLSH
T10BD423AB61D8D44ADE7687F81648E00093097ED56F2BA2E7EE42B4853FFC9161D6C313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ab1c5110de98fdf86f9b5533a83ae75a0a0f5fbe4e77bb1cd903b0fe67c04c17
MD5 5c91e7f103527c90e79c3a6185bf5b85
SHA1 b6d197e954207d53d16bd86c1dc8e35c98a02f9a
SHA512 559e6666648ad2f6172bc411e80217e0dfb361e997111025c7b6a77ccc9e01f432180a73f0ec783c8395b4ae5d00da619ba84ee0d21a12e97c112ae861db9add
SSDEEP 49152:Wa0h2GEkuAe73q3pp46zwwQFfJ4klKXnL:Wa0hNYG4JwyfJ4k
TLSH
T18C859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 436f766e94ade73b17fc8ebbe450b51925ecc9845f39526c8c53d0cff3900327
MD5 89045904cf0bd540c59ea56d1bf96a10
SHA1 1956092ca571f4f49afc842680ff7d1d1b01ddc4
SHA512 ce6f7084af687e47f1a5ae739aa8c5cabff3567b9bec75b30b9c6e724162776f120a44b39de950482601a8e505192434f9a85b79ba8ea1522858ae98e0a8e999
SSDEEP 12288:VjfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:VjfJ4yL/tNCJPXUQrP4
TLSH
T10FC423AB6084948ADE6587F81648E001D3047FC5272F63E7ED82B8857FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 0c3fd9cc9350770f11b3c2c6f39cbdcb4ca48abb125a61ced372bebe0766cf69
MD5 0af646bb52d35a34b525f6ad7d3a3642
SHA1 d07ce1ba1d5b32f4391dd27515b0df51d0d11ca0
SHA512 e065d653ea5856c2820879256327112248d94a96d9eef44db1dc85699af0c2147c12a341dd6b745ee5eb87fb21ab08ffdc702e3e1abf82ea24f0b36167bea85e
SSDEEP 12288:2ObIA4LWOsvAYFTcfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:fAL3UTcfJ4yL/tNCJPXUQrP9
TLSH
T17A25F155F69400F9ED6BC23C89A6D512D372B89D0324E3EF07A88A552F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 2340d7a6a6e647888e87a1ad9fd6c7611abb57fce6097ae04ba1b90c19ee21bb
MD5 621aba323105ff37cbe76b48c0c429c2
SHA1 248e4704d2445f1c7aeecfe5566aa4139eb3b2fb
SHA512 f64ad91de7a304a02c08fc06127b92ef422d5c0ae195e65cc98de1e6fa870ea0a329c7013c91125856548de03312b79b6e3d2b6cdadccc9498d3903c5590cb43
SSDEEP 12288:CpFtvOgfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:2OgfJ4yL/tNCJPXUQrPq
TLSH
T1EDE4026A32DC10E5D576927C4A85D209D331BCA6172653EF46C080AE2FF7EE86C3D762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 35ec89a133ede038eb5b2476cf2dcf9cb5373778e892816d05efc3c0e2e70db5
MD5 d07628a3b0d3300692df5c7d6ff73340
SHA1 554cd72fc8537d733ec57f8b1a99ab6219c2c05e
SHA512 f5d92db32f0fa21ee3199c758888bfbc0c1f00c94e3ac93ab86349ce972421c03b9b9fd3ac1e9561fb0885e95bcc58d7ac95c01948b2818a80e98e44e68eb920
SSDEEP 24576:A7NM9YqZqmWMUkPjZM48Mv6bEhsvfJ4yL/tNCJPXUQrPM:A7cBWMpPjN8DbEhGfJ4klKXnU
TLSH
T1FF65AE2E6BEC81E5D477D13DC9A28205F6B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 18663a8e579aebcb7adc6fc12d57b403de860c24f06ba59bd80cec8603b3dd0e
MD5 63a176e7e430900096b7bebcfd04e3f1
SHA1 3bf2e1330b3a94bb4a7787465a666b00f92c190d
SHA512 9ec1e0dc5dd8b403ba6d1c4463ef173f7ab7788a9fbad37296acb97d69b57143ff6f2b13c10fb9c027e7a655f53b802274db0f874aadcfcec0132ee1566c0e67
SSDEEP 24576:WW6BApg2YuyuNDYTabvcdvNYf8km1xfJ4yL/tNCJPXUQrPi:WF2YuHNETovAvNYf8kmPfJ4klKXna
TLSH
T17E858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 05f243b9e5e248347525009e1f12733d3f0567e0a1707b8601febeeacd5b9ddc
MD5 ae6f8b7905bd60bbcb67be4f60990f5d
SHA1 9962e918f8499b8381db765ec376e0da531737e2
SHA512 597abbfb5541d67a09da727e118fc72afc1b906c66e89d241a5b608765c02c3930eae8a5209d56d78f048a232d9c9350ab5340adededeedec8b8e2b38a478995
SSDEEP 24576:sAFs06+Omlf8NXEbTo0fJ4yL/tNCJPXUQrP/:BFs060loXulfJ4klKXn3
TLSH
T18465AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 145c6ecdb5ab82b8e386f80132405b111815cc26028c4e8f8c33e253e095ae6d
MD5 557f46257e8fe0f422a3fbc0af319317
SHA1 e40021420c6c3478bd92e959209dbc2898e0108e
SHA512 0b5ef3ae0bb91c6b1b5d63ee73d39bca64ebaf4911d699e341a68ef489ea4568c0213eb7ae64baa769b01886fff8331bef69128bb29d6f8abf68739748867815
SSDEEP 12288:5CJnJ5D3VkrDzxPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:QJnJ5D3WXlfJ4yL/tNCJPXUQrPg
TLSH
T1DF15D02DD2A810E8D4B7C3B482496746FF72386D2F226AC768B4D4353F16EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 14d24f41c10da14cc9b259f8960e3dfe368e4dbf0d1ea03c3486beea5b01f5b8
MD5 11453d0e490097409b717fcf0c745181
SHA1 62b7ed34eb653de3c04236f60ff39b54cb142c36
SHA512 0444c33308c4e5a865366677f41b80d7376c25ad8afe684ad4ba458f84e13f0e59e01dad90f7e23c251f0d884fa8d2db9de5d8a9827f60bdc6194befd2a507a7
SSDEEP 24576:EEPghm6/7IIXdwcXrif7qQncjlP65i3VuOfJ4yL/tNCJPXUQrPN:Lg06DIKdwc+eQnSt65aVbfJ4klKXn1
TLSH
T1D2955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 3afe275575435a68c92edc08f15df14dc35594fa1a4560a695fe6713c7d1a5ef
MD5 b156e268cc742d07ce013411cae12ed6
SHA1 b5bfef19709c3b819d39e045778752ce65a21cd3
SHA512 f04707c43cc0034525a83676b213e507b6aa6a8b0169c61ddf7c038e08c8a3007356469bb6eb58064b77f9b1304a67746f9e4dce1d9fb1744b7e54e0538743c3
SSDEEP 12288:GEP3Ri5KH6KcgtY7MiSEnP6Ipf8fs+AXspUQhdV71O1PigGYPKtEkbk2niZv/bm2:Fi5eR4MiPP/+XA8GSV7y6ggxbDngv/S2
TLSH
T1F70512AC679C34E9C6B6543D12918242D7B2F06017A267DF13E6C27D8F27BE63C39A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 7d3a2cdf9404a71d7d083bd92e1282bff709ced975a29c7811c25476f7a899d0
MD5 a0eaae1df6d5843e12f7a49f5e7f8221
SHA1 d4ddc2bf529fa2dc74a470feb8ea6630295b3d8d
SHA512 b9e414ec2d8c68a9e5b4204acc7542cc075234b3b8e7867487d1501c0293d21a615824ffc9edca241f26f0f3629b60dd508ee22e4903f8254555369be80bcfbf
SSDEEP 12288:tjkyWfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:tIyWfJ4yL/tNCJPXUQrPT
TLSH
T19CF4224A23D4A085DAB647BC5A55D140CB34BCA02F2693EF9580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 adda77584b49a12c11bb5921446e3ed92b465fd7a8e1cff26b7db5a89a436ddd
MD5 344b3110ea889dce186b6bda86aa7a50
SHA1 25181f26f9a396bb6f43a31ba90d709fdf759e9a
SHA512 313d9cdf7551225b60b7f31c25bece509d0bc7c9fe54835b7eba42e8209c56eb2ce0efb7f5cfe6ec4a8aeb8e0b987a2c55b150553944ae32813fa1c82a3c2e2d
SSDEEP 12288:myQfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:PQfJ4yL/tNCJPXUQrPt
TLSH
T1B2D423AF2095A089DE2587FC1648E000C3147ED52B2B62FB9DC2F4A17FFD99A15BC791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 aef54801f8401e0db61164936eee646a3cef59baf043351cf54e36d760f8cf3a
MD5 61c6655d9e43b36b1ef24eb326a3843f
SHA1 c2193db6e9e6585914ebffa2cc4e48a3aeabf9e6
SHA512 db9a934f220cab56a9aab501f5bfc9dcd0e47002e4347e0b50646af334d7dc65499ecd32874ea0134542d6a569ffb661ad36b1c6c3ba56f4e4c47939d08f5621
SSDEEP 24576:kQ9MxZKdcz9dw3HfJ4yL/tNCJPXUQrPT:kVKZHfJ4klKXnb
TLSH
T18C558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 2c709f4e0158703585177748d4657000965c9607a52d1ca2b269dff2726220b1
MD5 eea19f7ed051c6e1f2e69ed499b33635
SHA1 d3f7228bfd56c0560e11151515e2b46074505b26
SHA512 178d8c1a3a0c31605e99948001027495f71c775052f9976c316a84aca638040720becd9a1107c5a2fbf9cda79d75ffb0286fa7bb46f7afaa214f88c0db524557
SSDEEP 12288:iyoKo2JRple9pKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:iyocDApKfJ4yL/tNCJPXUQrPk
TLSH
T1E5F4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3f0c64703db10819fd3c2fc5ba506485c24120153947884bde683cdbc2abca5f
MD5 3f1d37d3f336c815aa272b86badf5936
SHA1 dddb57a99e912759d37653cae6f6b6576e7a84f1
SHA512 192f131f24b0606585aa635489d6b6466685a77a73bc81a92d470be206d2aec5e92528ef7ffa0a3218d63ecfcdd8588a112cce08af57baf86dfa872142035d36
SSDEEP 49152:BWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKKfJ4klKXnA:50zuNIcfJ4k
TLSH
T1ADA57B3DA2F800A8D9AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 11eb7eeb4ec69fd5e7b72ca4edb7d645bc8aa5223d61c8f5e690bd592d271804
MD5 5f17970c5950f172d0e2535335631779
SHA1 7b8f9197dfbce378e6015f898252f247c8d929e7
SHA512 a0e8b1e3f03ea354c4db73cae49eedc7b6c108aa09842facd4fb8215dbb6857fd647e631173d53c34685fe3e8285dff137bc18917275e7e8d70120764bc3fa2e
SSDEEP 49152:Na0h2GEkuAe73q3ppj6zwwQFfJ4klKXnLv0PWj37y63bTgv/S2:Na0hNYGjJwyfJ4kYrj37n3YS2
TLSH
T1F0C5C01E66DC82B5D0BAD278C9A6814BE7B2B4260B3156CF1151853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 4abf2ebe65fae534caecccd38b68d7b11e12574ec33ba6ee473435a3c9835c88
MD5 84ad2ea6459f0abbf9604a7f9aab7b68
SHA1 988d04135ce7b14a1458a5d119b6a0c0fd9ba08d
SHA512 a4f50d670d3186d3de76c418aacaf7ff555c0944f6cb09c0d9b9e4d4c694836755cf9785b184b7abffff6bdd6000f14aed8ba61fb9d0ece071c767d118d0205d
SSDEEP 24576:x1QT7EcpfxR+N5AWAz3ooiYhjMqb4eR4MiPP/+XA8GSV7y6ggxbDngv/S2:UTDxR+N5YzTTjMK0PWj37y63bTgv/S2
TLSH
T12375C02EA7E815E9D1BE85799B238502FB727851033193CB43A0C17E0F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 848KB
SHA256 ad40eb4eba60108c5286e97aa3dba76f9f5688238b257cee863ff05a0cc9d1a8
MD5 a510f5c25b054343b01185c73a2c0af4
SHA1 b3bee036875f292e51a2e997772795a066635e20
SHA512 25a89c197a24629a78f09a8cab84dced9377079b9245860d7f3860f9616ae55d8cb5149b5589f30e4331a9798800979b6e3c7ac9dfef27456ed2df78d6effbab
SSDEEP 24576:hhbHjP2eR4MiPP/+XA8GSV7y6ggxbDngv/S2:hhbHj/0PWj37y63bTgv/S2
TLSH
T1BC0512BC26AC34E8D6B1997D12868202C771BC5507A193DF23D782BD4F27BE52C75B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 54d056db60a9347df8faa256dc4bdcb65b494bda79c53938092e2d5e8a4f8cd5
MD5 ba8d578a3e472e98ac3d2d08910db691
SHA1 3bdb1610e726c9f3927ecc97fd93d396b6c6339d
SHA512 e9dc2ce24b8d634d0379a08d4cbfe7d3177978e48e9edd5549a16f72a978bae2981395cdb1fd44f036b188b988e3182766a2dcbb3fa7e5484d601a254b076b3c
SSDEEP 49152:a0K+7mSLdfJ4klKXnGh0PWj37y63bTgv/S2:BtfJ4kzrj37n3YS2
TLSH
T15E75127EA39D24E5D97AC27C9642C506E77238A10322A6D707D1C0B92F9BFE4397DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.4MB
SHA256 265c67f77f3bbcaf707f6b300130810ef98188d83d421c4058a5324c12db51c9
MD5 24734e1682e3c2ed715b45d66aa364cf
SHA1 c90cc3788ef119c0aa6c03fe0cf867afd35906fd
SHA512 1cbdedcba5618cb184b648fb1e625cc19565b6d87bcfa8e0598c68bd574632829d85db21862aaaa3870f546d53ac5e406ef6a424e3a00b97d98a624bde9f7ac8
SSDEEP 24576:9iognJcRTk4yti+R5dUR/heR4MiPP/+XA8GSV7y6ggxbDngv/S2:9pgnaTk46pUR/o0PWj37y63bTgv/S2
TLSH
T1F165C02DF3B910B9C8A6D536450147B5BB71782D1F209ACB0274C538AF0AFE85E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 25d987432d48676e9f072a0368ad8d09933bbca854ce41de3e2355ff1017821d
MD5 e1c05bc7bbea530f3f7ac5baa9c32e2a
SHA1 7835dba60f543578896874c31a7671dda66ad1a8
SHA512 34a8a7a6d04f016d5dc05707eccb2f1cac1a8f4d62999cba6b8e3f277fe71f23374749536e3a4d53597e923c81dcb30544b41a10f15eba5a03dd772f2b18e166
SSDEEP 24576:XcfJ4yL/tNCJPXUQrPqceR4MiPP/+XA8GSV7y6ggxbDngv/S2:XcfJ4klKXnSF0PWj37y63bTgv/S2
TLSH
T10C65239C62C438D5CAB24AB81758C10287307DD513BA62FF27D3D4B98F7ABD660B8752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-134-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/396-126-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/396-367-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/396-132-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1224-180-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1224-482-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1224-175-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1224-196-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1224-216-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1476-41-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1476-40-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1476-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1476-33-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1476-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1496-161-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1496-90-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/1496-97-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1496-91-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1500-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1500-478-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1672-68-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1672-58-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1672-70-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1672-67-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1672-72-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1728-476-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1728-174-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1728-118-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1860-115-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1860-169-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1868-155-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1868-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2136-149-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2136-475-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2304-106-0x0000000000680000-0x00000000006E7000-memory.dmp

Download

memory/2304-101-0x0000000000680000-0x00000000006E7000-memory.dmp

Download

memory/2304-108-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2304-165-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2520-657-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/2584-7-0x0000000002550000-0x00000000025D5000-memory.dmp

Download

memory/2584-0-0x0000000002550000-0x00000000025D5000-memory.dmp

Download

memory/2584-66-0x0000000000400000-0x00000000007CF000-memory.dmp

Download

memory/2584-13-0x0000000003410000-0x0000000003477000-memory.dmp

Download

memory/2584-437-0x0000000000400000-0x00000000007CF000-memory.dmp

Download

memory/2584-6-0x0000000000400000-0x00000000007CF000-memory.dmp

Download

memory/2584-20-0x0000000003410000-0x0000000003477000-memory.dmp

Download

memory/2588-123-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2588-323-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2708-146-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2708-144-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2708-138-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2708-394-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3036-157-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3036-88-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3036-85-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3036-79-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3664-481-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3664-170-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3796-497-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-499-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-524-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-525-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-526-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-523-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-522-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-517-0x000002866CDB0000-0x000002866D02E000-memory.dmp

Download

memory/3796-521-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-483-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-484-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-485-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-514-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-513-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-512-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-511-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-510-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-509-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-508-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-507-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-506-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-505-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-504-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-503-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-502-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-501-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-500-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-520-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-498-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-519-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-495-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-496-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-494-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-493-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-492-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-491-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-490-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-489-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-488-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-487-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-486-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-515-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-516-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3796-518-0x000002866C330000-0x000002866C340000-memory.dmp

Download

memory/3928-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3928-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3928-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3928-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3932-629-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/3932-663-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4080-152-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4080-75-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4320-166-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4320-480-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4484-479-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4484-162-0x0000000140000000-0x00000001401FC000-memory.dmp

Download