3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
Size 12.3MB
Sample260930-kf1pjasfpg
SHA256 3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc
MD5 78e9f77f442575408d7227f4bad51a00
SHA1 a6a923e82a911ab2cd5f11d19093406a2678aafe
SHA512 c40878bc3659832e7b2aadd9a6b3fcaa7942693a6f9f44ab42c0533939fd3fc795f325cb86b2aa8d5c61057b065eed151b697ae826ee8cc96b7b19fafb7aaa7e
SSDEEP 196608:C1YK/XkarAIR/WzyUzldGgLZsF+Iejgv3wSH9xTsDMOyoKfNkp8HLNemRJXzfJ4d:CuWkIE1Ox+iHfsQOJ2HLNeqz4
TLSH
T188D67C327751D53BC6035873552D96BF0168BB708BB588CBEB481A2C6BB46D2E235F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3940	DiagnosticsHub.StandardCollector.Service.exe
5032	fxssvc.exe
4888	elevation_service.exe
980	elevation_service.exe
1768	maintenanceservice.exe
4832	msdtc.exe
2900	OSE.EXE
4192	PerceptionSimulationService.exe
4976	locator.exe
4968	snmptrap.exe
4616	spectrum.exe
2256	ssh-agent.exe
3264	TieringEngineService.exe
4144	AgentService.exe
4596	alg.exe
2524	perfhost.exe
1796	SensorDataService.exe
648	vds.exe
5060	vssvc.exe
2688	wbengine.exe
632	WmiApSrv.exe
4484	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	alg.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\System32\alg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\vssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	alg.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\33d26624c665fbf6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017010-179.dat	upx
behavioral1/files/0x000100000000fa67-187.dat	upx
behavioral1/files/0x00010000000177ef-188.dat	upx
behavioral1/files/0x000100000000c538-186.dat	upx
behavioral1/files/0x0001000000023463-182.dat	upx
behavioral1/files/0x0001000000017430-181.dat	upx
behavioral1/files/0x0001000000017066-180.dat	upx
behavioral1/memory/4596-357-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/files/0x0001000000017010-356.dat	upx
behavioral1/files/0x000100000000fa67-370.dat	upx
behavioral1/memory/2524-378-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/1796-400-0x0000000140000000-0x0000000140294000-memory.dmp	upx
behavioral1/files/0x00010000000177ef-399.dat	upx
behavioral1/memory/4596-483-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/memory/2524-486-0x0000000000400000-0x0000000000554000-memory.dmp	upx
behavioral1/memory/1796-487-0x0000000140000000-0x0000000140294000-memory.dmp	upx
behavioral1/memory/1796-491-0x0000000140000000-0x0000000140294000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\SelectConfirm.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd4051a7b650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2ce1ca7b650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009997a5a6b650dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cacb8a6b650dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000143649a8b650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3940	DiagnosticsHub.StandardCollector.Service.exe
3940	DiagnosticsHub.StandardCollector.Service.exe
3940	DiagnosticsHub.StandardCollector.Service.exe
3940	DiagnosticsHub.StandardCollector.Service.exe
3940	DiagnosticsHub.StandardCollector.Service.exe
3940	DiagnosticsHub.StandardCollector.Service.exe
3940	DiagnosticsHub.StandardCollector.Service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3972	3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
Token: SeAuditPrivilege	5032	fxssvc.exe
Token: SeRestorePrivilege	3264	TieringEngineService.exe
Token: SeManageVolumePrivilege	3264	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4144	AgentService.exe
Token: SeDebugPrivilege	3940	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4888	elevation_service.exe
Token: SeBackupPrivilege	5060	vssvc.exe
Token: SeRestorePrivilege	5060	vssvc.exe
Token: SeAuditPrivilege	5060	vssvc.exe
Token: SeBackupPrivilege	2688	wbengine.exe
Token: SeRestorePrivilege	2688	wbengine.exe
Token: SeSecurityPrivilege	2688	wbengine.exe
Token: 33	4484	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4484	SearchIndexer.exe
Token: SeDebugPrivilege	4888	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 1680	4484	SearchIndexer.exe	132
PID 4484 wrote to memory of 2464	4484	SearchIndexer.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe
"C:\Users\Admin\AppData\Local\Temp\3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3800

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:980

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1768

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4832

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2900

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4192

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4968

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4616

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2256

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2864

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4596

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2524

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1796

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:632

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1680
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5ab69011fcad72c384354a56e14144fef1dc6afd6f5037e9d387081f7a351dfc
MD5 e9f68985b0625b34f0352e252299767f
SHA1 912e82ee2c9444eb640f25231b48108998b4cab8
SHA512 9a5208eefbfbe730b9fd63c4d73f096f6a7b4e2fe111d682d369eecefa8907030c32941553b330121b2197cd95963051c81f0d741cf53428f3cbd2d3391038cc
SSDEEP 49152:Qb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnlfJ4klKXnw:63q6mjBafJ4k
TLSH
T189D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ae4d7c9ca566c74d2bd8aa72b0be18bfb609e6f99821ff8df9a6c00aea190f7c
MD5 8d0cc9e19973b1d59cc9e708d643899f
SHA1 3f444cf9a2a90230920e0731051176041aacce25
SHA512 7bfacc8f924acf56b99a43c9a6c3eda384ac536197448e4ea476a614da7f3ce9abe1221dab5700a71073a8b63bce8528d0221c1cf929b49a8956ec686553e7c0
SSDEEP 24576:6XY7DvczAmfJ4yL/tNCJPXUQrPIdMTBt3byAUHWreGf+jY+JqRp5fl9NJn:Jvc7fJ4klKXnAiltLyvH88YzRp5/NJn
TLSH
T16A75126963E004F9EC6B823C8DA1C101EA32BC854BB5E79B07E095656F733C92E3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 0bfb18c8f4b5b4cc643ad0a2a28e72a7c8921223fca7f56c498000f1a896dedd
MD5 fc59bbdd42597e3a466b16548b4fdc6d
SHA1 ed8bd1190e45b7413d4be0dab2349782387825bc
SHA512 d029e6d34e05dce9216d73411d1ed47782c24a1322ff1eef0dee3a15970c9948c773211117bb471f2a66bca80c2fe526614bf721092bea5c10c1bccc2ccd9256
SSDEEP 24576:KXYfDtczAmfJ4yL/tNCJPXUQrPIdMTBt3byAUHWreGf+jY+JqRp5fl9NJn:Rtc7fJ4klKXnAiltLyvH88YzRp5/NJn
TLSH
T1AA75126963E004F9ED6B823C89A1C101EA32BC854BB5E7DB07E095656F733C92E3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 1217b39da6a4e0e79469bb638725e4fc56eead8a185f74e31e4b014c15305218
MD5 1ab43ded149a069464e88511d8f470bc
SHA1 ed222ba0211fb14fa58963be7a00b076e0b5ab92
SHA512 c4f5ff6aa840c3f019878250df9f8102495af2f85504b7c3627fad8ed6a9d34554ab9ca4bfaecf8ff870137590ec7aec7bda210a6178d1e8600007e46825744f
SSDEEP 24576:b0Le5ji0hmxhrMAfJ4yL/tNCJPXUQrPR:bPji0AzVfJ4klKXn5
TLSH
T1D235AE26F5748335D073C0B9C5D2A68AEA71308657308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 074511a3e549bb9c75863ebcc93110cb8f2b9a969119ea39797e00d5cb9f78d3
MD5 110ae479a8e021623bbb4a6f91650e2f
SHA1 88d84177921d2978128b6253ebb5a0d4813aadc1
SHA512 c992b52d01c8d2bdb2d4516e862bcaab60c67ecfcbfde557a59ce16647ace8f96cc34e7868f6a04bf798fa4be799f90a445bbfca9ff18dd4479d5ff2add29242
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWj6q8wyuOfJ4yL/tNCJPXUQrPn:e/ezSC6vUzPv+HjypfJ4klKXn/
TLSH
T1FC756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2de4e7eda6d4e346eefe0e77c4ad947c493da69cacd816032e36f96a850d20af
MD5 d84d6f481262bd93f2c190e5cc4eba05
SHA1 4275b4342a09c108a8f0f6c26dc6f0768133f3cf
SHA512 9cbc1d5b9fb06f92e357a18c8c851ebaeed10eed421a5e9e186efd944658dbe95b84b17617136c20f66198c7050a26760f307e7ea7e2082157d17843d5ac0bca
SSDEEP 24576:OVbqPb88hv/l+B/fJ4yL/tNCJPXUQrPW:OVO88hXl+1fJ4klKXn+
TLSH
T17F559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 5200d999c735ea5d6aac818fecf18ba05abdbaf2cd809c1e2bcc6632e776c1ed
MD5 3b9180640b1a75f7eb22d4b74daa20c1
SHA1 c9487764488a8de6c070a5a3682463e50b8584ca
SHA512 59b90dc170f972a9667d61544f87074196867d4f584abfff7f2cff07404a3c237d669c8fd4133d8b188320dc4c526ffc8859d3490944b65d3a1c22abc8ee7a6f
SSDEEP 12288:2GsfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sb:2GsfJ4yL/tNCJPXUQrPY
TLSH
T1ACC423E751849086DF6687F82A8CF001C704BEC5562FA2E6DE42B8867FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 d126ea2ac868798de5c206daf3acba4734d5ef6151fc2af9ea152264b05a43e0
MD5 4ae0a4eef9317b36c795a4f4f1bd29e6
SHA1 b4bedc7f59d6218f314820157b3c4b429465b7b0
SHA512 c0d280aec673f1b6b1d81fff8a3da32527daa61960dd08d346757d8002193790124e9777644b7ed672d4f8ef7e7a1073375322d73a1a314a56d302c73d2ae437
SSDEEP 12288:6eBNUbTVO86U3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:6JIU3fJ4yL/tNCJPXUQrPf
TLSH
T1B405C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 12507e18081cad6fa4c63eb03a3ad76e6b9cf7da7aad09093f44c293f100d91f
MD5 91dda33097b08b38bd8ff1086f273fff
SHA1 18ce5eb8408591563955d78f36cc7be07dffa989
SHA512 b55c53085c3f34520e84ae9a3776ae09d78d6f632a6ea6c1d1eec7ab57d0eb9376515073d4754a35fa64df118020540a93440278725f89aea929b7337d309539
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH/:cQvGAdlCEL8c/WRNw5C+fJ4k
TLSH
T13F266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 48c563f8cf516d92853bc444681e6232326cc4d7c6686a51a8e16343460582b5
MD5 91df01703508d495093de6421ca56180
SHA1 6a13af4356d863eec553f2d5273b2d3110df7a50
SHA512 5cbbb7af65e63c168af641ce3f9a41acc981f94b519d0f517c10ef2d81087882954a6beb0980adf58c35ebb0740e015640d466b0bd773182464a17ea63d8da7d
SSDEEP 12288:EAwSfxL/2Dc3mDLLmt0LDQewsAjFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW7:ZfewsAjFfJ4yL/tNCJPXUQrP9
TLSH
T1F615E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 56c1ac22df454f0f6ad2dd813b4fe3045212254d67318e4b35d4b579fdce02e7
MD5 f28581487bb79046bfd5678f6a6bc3b7
SHA1 bc2d6c5e7560dd29f703d1e3effa435644797598
SHA512 8985e78b83bd634eb14ae9be7c76eeafe9ed2096965e5c2c8c2567afd36f1e9bda18dea7e893ba4437b0e91161dd2741e46b503ab4d7eb751f820af11c9f25ca
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHtfJ4:dUEtQevvqc2W1cpV20I32t
TLSH
T10C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 3.4MB
SHA256 fcb0b849395453fad0f1cca7a7b9f466938fd2ae8badf68bb620cd5acc8ba506
MD5 1851e7f9c1aeda711f3064e9b6934d70
SHA1 d97de982f92353d274d8bd7eaa59548d7424c54e
SHA512 ef722a9e09c207d2f21be514351af967d68bfbbeb9bbcfb4cedc31e288677d9218ac9d2438d97ce25729a6b2076cf8d611fa1cdd1525d50e40610c86742d467b
SSDEEP 49152:dCbRquA/m2yL5zQfFiV+XenmE3/zlfJ4klKXn4HltLyvH88YzRp5/NJn:aoqtVjnmCfJ4kjrGvwb5/rn
TLSH
T1D0F5AE0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33BE58A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 eabac564e0ae477b9a96dd30140f1face1bb17cab3483d76bae250d638af0bac
MD5 a26348608dbc5b935b5089326bad2db6
SHA1 a014f54a37784dcdddf0439586700349c77e5f1e
SHA512 89d2e9c1ce0ede49c392c31d84e82485262c9739f6ecc4176db06a931c32f7b2c616af908f50358726e3eac7b2d03e3e4719ee0b7f11cf79f15d6adf029dd714
SSDEEP 24576:tAhGL6IFoiwtA5l7S53ifJ4yL/tNCJPXUQrPS:tAM5Foiq5yfJ4klKXnq
TLSH
T144359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 5061611c7630ec19afcf538f450843ffcc141eb179249fa1bc79997ea28943f1
MD5 d5d86589a4a705b13d9e29f1602bdabb
SHA1 d1eae1fb901af776e9b4b7630f771b4731a68509
SHA512 a2e96ede11baa6c8d978a2733cd28c451b20ce8bb0ceb95c5362509ef874b2ce9a8182cbeec0353aa62eb4c7e155fcd8e282a013fec088dda51b34d4aacafa6f
SSDEEP 12288:Lmw5HEjsChNEBFgl0WDm+CLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT+:KwuROWEfJ4yL/tNCJPXUQrPS
TLSH
T11A05F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 fd55a612eaf90bb1b28f892d0334d9909888ae2d1cb0d1a7f80bc948b14d6b07
MD5 8eaec8a6f672c41fdb2037ce0e9769d7
SHA1 f811a83f65510b498fcfbf2ac6c97dee2f7ff623
SHA512 e6ca1faff086fbc541aba6a2839f7284fdeca13ca951e8b99ed23e3e10146fccb01a5b4943a17867c16c61f1a1e3c47ccc3d0adf4e97c1cba19968677eeafc37
SSDEEP 12288:0yZ1Iy1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Ss:JZu4fJ4yL/tNCJPXUQrPb
TLSH
T14DE4129B32D460F9DAA382BC89D4D101D3317C92273A93CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e02141cc0f25ac0fbe636ed3bc4c1232f0ee941106d31411f19bd61383002b12
MD5 33475d365814559b778aac7a90d1cd4b
SHA1 891428c2c0427f20349affba4691fb22817a164e
SHA512 33eafeba4471d4ef9d96deaa5192036cbedd78974900e45e00d74db9497c58933bd4acf2278e4e943250388afd477971a083860382d8db79a72b107e3b9e1009
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UP:JQRQyi36YOcPDLvw2gAf+PN3bfJ4k
TLSH
T1FC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2f96558210149d3e667b6da31dec5c53940c27c2990126fe222efee1c1e3d555
MD5 e6b5ccd5d6126f1c68ef2971234ef0d9
SHA1 3fb332b1b3ab40a314b6f78c5998de62eb0b3f16
SHA512 785df8b6bdf9fc50ce7efa6e242838d0d4bab7df00ea283fd06bd8fa34b0eb11d32ce034188e76d1584c2cce95a2cb4e1d74d64caeaca82ffd428c6daf1eaaca
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UB:NQRQyi36YOcPDLvw2gAf+PN3bfJ4k
TLSH
T168667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f1840a71c50ca75549df7c9a9d80132325df3295263c2967a97920f4311e840b
MD5 ab9d6ae6d8d2c5443c4be9e6f47f9537
SHA1 143c76cb3695d4e918e741d0f0ee615e293c40d7
SHA512 58bb735ed894cd654a40ef6d79633a940bfda44d971057af1aab5e73e24c8ffda0b6cbaea358c4ca0e26cbc95756fe9f496c5248e1ba17ddfd439bee4a1a767e
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0IfJ4yL/tNCJPXUx:568Qg55nhkeWu7PNU3/VfJ4klKXn6
TLSH
T159B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 250df9a3256091e9690edb81b1176c442fc0c98f6804e80fc90be1689b007ec8
MD5 85c678e8f091aa2fb279465ac8b3cab2
SHA1 1c81ee46fae70c1ccc77ad07b7e34d36d71dc08e
SHA512 6339319e424df68f1daf423311def89eccebe0d33e60583ebd7dc85b5c5f8edc3e0fd490f9b1a9300f5509e5271cc8f9e54388b5133c844a7327ec96e022ca13
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99Z:5y5112gYy5azzVvU69nLKnhZsfJ4k
TLSH
T193167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 26d71eec4c5f87219a3a5d1a79ab1254210be4f4d39b6adf7933c8b65a725af0
MD5 e48b9818f0323a03cafe5ebe226f4368
SHA1 dfeefa25b339d653ae83acd18256f09a16bc04cc
SHA512 ce711a5203bb19b6e8205eaabea158e08b6a9ef2be7ea6f6e250bcb0cca38f1c8c20aa328b685119810a16a2b4b74c66371ee2dcc5f07d9e2c818730ac7a7f60
SSDEEP 49152:xB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl2fJ4klKXnn:nu6JmIxd2d2fJ4k
TLSH
T16FD59D13F1D901E8D06ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 79670bdd23fe5b620e626758c984abdb72a0ccff7541271a898bfbccbb505ea6
MD5 1058359f94376a34b16f7e21a22f6f40
SHA1 bb2f1ba5ade8d0615cc64d9d0590a0307ae83968
SHA512 2582c921f2d80764650853836b66d81f52018a08c8826bc3263a7c51dd4d10689c2d5ba41d91c96116dccaf68fb1e6458d74a5019d4bc7ea187b5d2f1664611d
SSDEEP 49152:a1hpsNoJpF1A67U44CwH7R4xXfJ4klKXnv:amifPqRCfJ4k
TLSH
T1FCB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2e60a9abfa4d37a1150f9d1dc9826b803ec35dab6e95aa5372ce0762584058c6
MD5 0155839e20dcdfdef8888205ca73b410
SHA1 9d99046f05ad732070347e03887ba862745a3dde
SHA512 48c53d12c35190dbdab17bf7de6de6432b5ec25a7614f6cbd9b0af062004b45abe72637073534bac172da04fbebda7b620aa23344717bdab91f662460fc7d021
SSDEEP 49152:oSuZQIY0Be2KkRVtOnks6NMHq4fJ4klKXn/:y5dKqi614fJ4k
TLSH
T151C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1b370da1d9ee590b893ee8c30b291b0510f2a63d2d0e2a203c3f45b64fabc846
MD5 e467701eea7359969eec0136b9970286
SHA1 2e5ead2b006cae97cb71aa9a3eb664188c3700a9
SHA512 26d03a43751cdc1052c79ccba5082092127ea62cb4d535bc850611543eaa8a42ca3b6d66c07a6e49a4787e57a90ea5ca250be9e7bb763e02ded91b8843f7e48d
SSDEEP 49152:phtSn8EApI0figjgiDn0AP5wjfJ4klKXng:YX2iWphmfJ4k
TLSH
T10C95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 dbc9d1d9f8ba65955e69047b6505723178fcb418a49e0ed3a7a2fceb5837cbcd
MD5 5d2b3af4efb46c20f65f09e47bc9de74
SHA1 4269381e5672e2a16c9baafa6d2677a39ee3d9ab
SHA512 1f55ef9f342c572c308281bd0b549de998d978770880ce73dbe2d4ae0fcf6a763cbe512f6118264e12adf8bcb2930d451fa1a4cca7ed3a05b93938419a6f3dcf
SSDEEP 12288:skfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:skfJ4yL/tNCJPXUQrPg
TLSH
T1BAC423AB60D5948ADE5587F81688F001C3047EC6672F62F7EF42B4427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 4ad6f2dc77832c7fc88b79c520198da0fb6182fce8293d958202faa51bf7661f
MD5 eedeba0ca21d7839bae9a306b10ed4db
SHA1 7820e7b5328f89e528a4d2dc89ac2259e4a8f46c
SHA512 13fb603bcde3a1692e528fb32d7099ac9846de7e351f1c1a391026f4b71d0a343243b3d81653dd8756953cacd40a6a15256fe5011b93516d7beb4aba85893b9d
SSDEEP 12288:1RfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:1RfJ4yL/tNCJPXUQrPg
TLSH
T15EC423AB60D59486DE1587F81788E001C7047EC6672F62F7EF42B8827FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3514e87447468d42e09aa627adbf61a12787d537339461b55cbf2c5013170a0f
MD5 abec5c5ffa8a47f2e0a6a371d646db86
SHA1 f3af4cd1a4ec91c02f76d8e3ec13bb2315cca826
SHA512 1f748ba1d6ca254de6b770016267ad5bae11768dfc53fc6e5432e7f98a7f6a2246889ba65bc8d8f1ab3057a888dcb91cfc6af52201c3f40655280608b3fdc009
SSDEEP 12288:gPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:gPfJ4yL/tNCJPXUQrPg
TLSH
T194C423AB20D5948ADE5587F81788E001C7047EC6672F62E7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ebc20dd91439a20b0306b27a643b568b3a8d88e8c8e934cd02eb67493e3d8ee9
MD5 e298f6024508f24b63458866440df90c
SHA1 6a6c33ccf3ada455e34d5fe28210dca90392f415
SHA512 9e4430c8433bd1b17d8cd27973cc98951c0b2d5a1661db7eb03bfdbe6b5c84301029d212a1c68bc0326a8a11ef052e14eee1c2208d9249d0b6e93690278768f6
SSDEEP 12288:CVCfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SZ:5fJ4yL/tNCJPXUQrPi
TLSH
T168D42397219580C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 4cb7e6f8b3ef7d260f2382a7d4ced189d88148befa62a60c6910648684d6d616
MD5 01a635879f1417c7622e2b342d2fd44b
SHA1 814f88318b100d4c4b6a1fcaa7c80ca455a8e8da
SHA512 aedb69bfbbd2abc7c110e6db20042a80a687af7dcd7f1102b9f82e882478ab69f97b675b4590840ab15e07ed6c848e490282687bad0873fb27eb8c7a4625baa4
SSDEEP 12288:cKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:cKfJ4yL/tNCJPXUQrP5
TLSH
T1E8C423AB60D5948ADE1587F81B88E001C7047ECA672F62F7EF82B4417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6c2cde7a3a8b5f6f58db0240a12d3b7e13c3e9d066c8d02a24425dd0f1f88f22
MD5 7c1720e9b330198452b07b862644eab6
SHA1 aeb72e758d0ffc8905f0eaa38b3d1375217cc836
SHA512 aab36f1f7ff665ec3a4dd5383a369433900b7c6b241b087cf5a5c9ad1989954dff24068e1f54b72d153faa075c0be1820e3121c9c6184f18a1d8245aefb0f6df
SSDEEP 12288:4dfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:4dfJ4yL/tNCJPXUQrP5
TLSH
T178C423AB60D5948ADE1587F81B88E001C7047EC6672F62F7EF42B4427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 581868cd161d3caa55eb92a2bd6efb1f0be905361963b9ea055c2997144aee80
MD5 6696377614ca0490eeb6a0b5a72bb4b7
SHA1 be208921b5fd6affd9ad0b24e246a892cb9a83f1
SHA512 17fc9bc81a1c9faa830f786d46d2e3ae163e88b9d71a14c9b8e0bded0a1e40eea81bfddd40205849f230bcc1168c004b469816e22e1e3792e6c5e8f0727db72e
SSDEEP 12288:7ZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:7ZfJ4yL/tNCJPXUQrPo
TLSH
T13AC423AB60D5948ADE1587F81748F001C7047ECA672F62E7EF42B4817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 df4fc226982eeec5703a1222e057c3420a44c99eeb83ae7002fcccec1e8334d2
MD5 258308e10be3baf1daeef7b3b73060a1
SHA1 22febb0473daa37b8e97d8f9bb69c374ede0f58a
SHA512 bfb16d1aebbebcf8329c074d811486542373ff9a3dd732871a10113cb45584b864d4bfa9190d961232dfc1c2bacafe5d1f57bde749f08067b1e60cbb8417b5e7
SSDEEP 12288:7iZwbDzzFEoS2cPvyxfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:mZM3zFVSOxfJ4yL/tNCJPXUQrPO
TLSH
T1BA0501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 e9c57d81e303078209494341d0cadf426220bdddb4dcbff72b3825ae7c499501
MD5 faefd1fcd631f9efd824fcf1f22c4c6d
SHA1 e62e562309c2895bfec0d3f2eb8b0173296e37e2
SHA512 653ee2cae6f157d03feaec66983eba79cc1aa3056a859ab8027cdd11e3a0c703ab0f4b79cce9368cf3cf4332cca9e3fc44f7b6cd3e675cd3f756f131548139af
SSDEEP 12288:tpsf4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:e4fJ4yL/tNCJPXUQrP0
TLSH
T1D3E4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 426dbe87629ade4b063b0c2175343ae436c11ec9ab64f5e1f7d91541e6eb4dbb
MD5 8b2a07aeb5092882f397955da837cf0c
SHA1 5a968c85571dbf8f134179734eab9f2f87f33016
SHA512 50929aee32dc810a9905ed1c63cde7729137113c332fee58bb84e75a9b872eab84fa57579dafc8dc16495ffcd723d64fe8ccf514ecdc390141563720972d6e74
SSDEEP 24576:MfTBt3byAUHWreGf+jY+JqRp5fl9NJwfJ4yL/tNCJPXUQrPe:MfltLyvH88YzRp5/NJwfJ4klKXnm
TLSH
T1845533D341E44057E97AAB740B58E011AA24FDCA6F7F90EBAC81A085FEF4753266C31D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWow64\perfhost.exe
Size 777KB
SHA256 9323fc564d01bf8696f8d1355045feae4334bbb87ae74dae9b92079403ad07d1
MD5 5806c268a9205962353e39b44be97c69
SHA1 ef387c7398f1603356eb3c96b3927835527396a4
SHA512 cdddfefdac8a9e6e1ff538ede54ee6f2783f90e440e2427a8492db053c4820787821f1beba5dc7ff217d28a02189af5849ac9c2b8989dce2f3dc84baee7ee1c6
SSDEEP 12288:WnrgBC4G2ypprtDMC1jH7AFAU2CKBh1eGuc+jYRM5zqWGLTzFexFs7kMd5Zl9NHV:WfTBt3byAUHWreGf+jY+JqRp5fl9NJn
TLSH
T1C005238282F80067F5BE7B301A7552223C76F95A6EFA989F6C904249FD703D3362971D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 62ed7af588d86c24f175d723ba7e6fb2a5feb4e921de6e586d5e1438bff7ced5
MD5 254de00c819c643ba2c7a412e89a14fb
SHA1 7742fde6e10a86012b7709bf35c072c10974c0e6
SHA512 aeb1b66a600c74a6337b6f047ef160734537f82ede547a796dca09428fbb8eb7ece066067e9775652e9de8410e9d1e3ab4ddb0a03688b7804d93296416a6edb3
SSDEEP 49152:Ca0h2GEkuAe73q3pp46zwwQPfJ4klKXnD:Ca0hNYG4JwQfJ4k
TLSH
T1A5859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 517bee1f3ad8bd53133fe03fd80e915233861e06aff08acb0403b39d529bffed
MD5 efeaafc191f79775695aa88803b4d459
SHA1 c30face7cb674bd9c5de491dd32a27e02807f091
SHA512 67f6b3bcff27144ff0fdbcf77742c5ff30f079196da1a80988321a0c23dedd1663922c6343206a4b3eb7d996422345769d258faa155eeb64876bee61cb64bb18
SSDEEP 12288:shbHjfX8fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:shbHjP8fJ4yL/tNCJPXUQrPu
TLSH
T1BDE402BE22AC20D9E571D2BC4684D106C331BC951726A3EF57C2917A2F7BEE51C38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 00409774e145a92f2c8327e1d249bfc1c6e2092b43f31ba0e454f6ac649f4679
MD5 1d986b3f87b995166744e2c92f24f071
SHA1 493a0d6d23b9ace164c248bfdfdba6f210f6aa47
SHA512 9511a56c6d88ba4edb0397eeba2cc95ffd9785b9928d37149eda14a040ceccb696a08b39808d92a0d4940e48702f35125129bc3c8eac0561dd0f1b0ba1ba455d
SSDEEP 24576:g3YgnJcRTk4yti+R5dBR/EfJ4yL/tNCJPXUQrPi:gIgnaTk46pBR/EfJ4klKXnK
TLSH
T1DB45B02EF2B910B9D8A6D236450143B5FB71782D1F2196CB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 ad854ca1e077faee17e7676418bcdb7b9e01eff88d1826c191c73b52e6fc22e1
MD5 059c8562363400405ffe447b6c43bb7e
SHA1 9aab2c3f9bd4c0586cefa3af95425cd9225e3cf3
SHA512 f5e2e8cb04235bab1c3ada5b57dba90c83821eb6e6bd3e5afc98a5a79b8e0733fc6f8783b62cdafbfed47919bf0d3268802bf64508f6ea0af5570715d3981b66
SSDEEP 12288:WRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:WRfJ4yL/tNCJPXUQrP+
TLSH
T16AC423EB6084948ADE6587F81648E001D3047FC5272B62F7ED82B4867FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 fb27f672f5239cc6db38bf7bd7bb9bbe746c92602ce2a0f7d7957bab8ab795e0
MD5 8b63f490be2a678283d03461ef33dccb
SHA1 48476aa0e045eca806de17a4bd7aa0e3848ecf4d
SHA512 999b2a2d348ac2ac6e3eb405f013266246169220cffdc8c52cde42a43bb164cf3ab52fa58e24ed72ba675c8afe8eb4b90e5b802d2d726591bffa8864ffef9057
SSDEEP 12288:jObIA4LWOsvAYFTmfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:MAL3UTmfJ4yL/tNCJPXUQrPV
TLSH
T1DC250155F69400F9ED6BC23C89A6D512D372B89D0324E3EF07A88A552F637E24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 7de6d8cc2bcdc916b1172cd0b9310479d305766ff93bafbff4874e95a2ead76c
MD5 ab815e0f54c1a757f17f65a543fe937c
SHA1 5f33326c5998d611db9035e8f2a7082b5430af97
SHA512 88c955b723a2dcab7ba90ad312db915fc6d14369228ad8bf64adacca2a4432f89249c6248a4e7e04a7ed227ceda3e36ad5d1995683bf932446d8212353954a53
SSDEEP 12288:ypFtvOifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:GOifJ4yL/tNCJPXUQrPC
TLSH
T158E4026A32EC10E5D576927C4A85D209D331BCA6172753EF46D080AE2FF7EE82C39761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d93889752f6c8c9169bc65e75e6c7ae31e2735ad79700d919691ac423dbec34f
MD5 982ffc2ffa6435dbfb66f268192b7913
SHA1 0eb48486ece5837cf4e70b7a90e484f71331cb6f
SHA512 6f7a1b322aa1fb02a591a92074e5e6e54350ebce4d27be52be210ca2d8f6379b70946f420849192f344b2da4cad8d6ac356191a0867f910ff84a7edfb0b5ffbe
SSDEEP 24576:R7NM9YqZqmWMUkPjZM48Mv6bEhs4fJ4yL/tNCJPXUQrPg:R7cBWMpPjN8DbEhlfJ4klKXno
TLSH
T14565AE2E6BEC81E5D477D13DC9A28205F6B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.9MB
SHA256 7935f184e64d0af1ba5bd2cc134785d1fbceff481a1e20335a2b2281041f9058
MD5 ece7e936d1e59aa16bfacaaf9d27fe53
SHA1 23824bc68fcb211952db1763e1fe66bec261f2ba
SHA512 b8e525f23355efc89454a79d4a3ed66e761478a4d31ef6dea1a04a96cdb01b9ce33fa90a3d6c6fc731af3600a3024134bf6861ee4707b3b77f78ed3dfea83e8d
SSDEEP 49152:AF2YuHNETovIvNYf8kmYltLyvH88YzRp5/NJn:V6ZCf8kjrGvwb5/rn
TLSH
T1AB959E6A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 2.5MB
SHA256 922b193bd86b89b89c121ee457226b4bf210e5f2efc41c135e566b49f8507953
MD5 25cbbc218d212b9b4aafb83e4e4c73d7
SHA1 a0ce28409bb029192508d87b73a82a63e3378cc1
SHA512 f2b48f271894664faf99a64082d99c56ebf0e65074da762c21c35afff832f34ecd084406e2dc1ee8e8949fa300b33bc839f8e20f2ecbb2e09a87ecf3ba9f5f96
SSDEEP 49152:nF2YuHNETovivNYf8kmYltLyvH88YzRp5/NJwfJ4klKXn7:+63Cf8kjrGvwb5/rwfJ4k
TLSH
T178C5B06A27ED80A4E0BBD27D45B6D246FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 924012a2f220af55e41548da20ba9c06df86fbb91b5929282f631584fa82437a
MD5 ce0d81b2cdcc9af0b6697e401e06c745
SHA1 cbfe1821b35137756fe43743375382db9c6b873b
SHA512 bdcd31c1c1e96dfffaf8bb7ac92bea5a23567286674ddbaed5cd1186e49bbe772d3376b6ed7f276e061fded49da509aecce100f8fa4b4ac22390783ea5fe93a8
SSDEEP 24576:cAFs06+Omlf8NXEbTo+fJ4yL/tNCJPXUQrPD:xFs060loXuvfJ4klKXn7
TLSH
T10A65AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 bb6a661d0813001e31882dbec4783a12dac3e32cce03d96ce2302c330b1fef7b
MD5 65cfb0eb8d28e0ee2578eb11fd1b114f
SHA1 0accf7d837eabb4440566da1d0358c74058bce4a
SHA512 1ef345724234929a219ed909e3d8eb4a44dd77550d51cdf8a448e35e3fc3f1457ef7444d75abffc8eb841dd9a5fe97631234a9a97896d353df92cd57ce2989ce
SSDEEP 12288:7CJnJ5D3VkrDzxlfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:2JnJ5D3WXvfJ4yL/tNCJPXUQrPB
TLSH
T1DA15D02DD2A810E8D4B7C3B482596746FF72386D2F226AC768B4D4353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8469f6cb2a74e7e58c1bd90be2fb330389bb42b35ef0ecbf947cfaacff31f286
MD5 76b1c34148cf09a3386630635813d9c2
SHA1 fb58f542e661e1b11094b306b2dff7e44e9886fc
SHA512 15909069693a09d52ec5ea6fecef58365929d553c9f77bf4a534c7a84c8700a787292fd2d8a8169048805b72f1099674985a47ec78629beaee4ae5e3b40ed7fc
SSDEEP 24576:QEPghm6/7IIXdwcXrif7qQncjlP65i3VuNfJ4yL/tNCJPXUQrPl:vg06DIKdwc+eQnSt65aVkfJ4klKXn9
TLSH
T1FC955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 226212c9da299479d6db963198be214b60b4d908dba789678b09b986f735db4e
MD5 f94e3c7583b696adfb66c9c403655942
SHA1 cf00268282aec73aa922497c9e13244651c703fe
SHA512 0b8d23a41d299f6d4faaaa55c03737e8eda676faaac2127e37fb9259a789f60e32856e8695ea58dd9d3a434229ceaef7b4658d30a636d8424e15a60e5a17fb2e
SSDEEP 12288:TEP3RiirgBC4G2ypprtDMC1jH7AFAU2CKBh1eGuc+jYRM5zqWGLTzFexFs7kMd55:YiwTBt3byAUHWreGf+jY+JqRp5fl9NJn
TLSH
T15505129D13EC60E5E13AA23945A14205D7B2F0652F6627EF18E0C23D9E737D62E3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 1aea9b1ee0af50514a5ced3a4eb7e5178acf2dff399508a7ed7685872957fd0e
MD5 2178ef16efac130d897e472ef7d47862
SHA1 562df7558a5a135b4a5f690e93f316409ac6d899
SHA512 322ad7b7459209b00c3069dd2d477ae1879f20bfd919830678c83c78881a95f9f8f9bf492a059c6a77300b2de325cbabeea60f55ec1217627e379dfa3dafd8e4
SSDEEP 24576:apwTBt3byAUHWreGf+jY+JqRp5fl9NJwfJ4yL/tNCJPXUQrP6:apwltLyvH88YzRp5/NJwfJ4klKXnS
TLSH
T18865239E22EC60A6D53AA27C0690C101D771F4952B6723EF5891C17EAFB67E72E3C710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 1b100139aaa9e355229652d3b56b1693d5fc944d0770d1a6fca9d719513f6f87
MD5 2f170f1854261c98014c9da3bc71f9b5
SHA1 25ba36448326293312796ed6df6dae5409b1f2f1
SHA512 183a19d7b61c648dc8a0050be1c1828b51504a4191c378d562b14786021cc31c506d570351d34a4730796b3ec92131a3687c32d643c19507afa0bb0cd40979d3
SSDEEP 12288:RjkysfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:RIysfJ4yL/tNCJPXUQrP9
TLSH
T123F4124A23D4A085DAB643BC5A55D140CB34BCA02F2693EF9580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 e58ea6a46595bfdc8e2f146f30591276ecdca5da3bdacab33c81aeda40c271cb
MD5 c419bcfa92cfe98284db5c30e320f2df
SHA1 8a28dfe4f4ecfc518308a690bc9044dce4c7a813
SHA512 2f7d4a5a91235a9539c1c46241b117264a73a28da24b7e3b84e4b7e2f750fc6076cade66f2db95bfc26f0a52f5baa8a2d37a8a9a4222a30e1e6efbb6e2261cdc
SSDEEP 12288:aySfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:jSfJ4yL/tNCJPXUQrP7
TLSH
T119D423AF2194A089DE2687F80648E100C3147ED5272B62FB9DC2F4B17FFD99615BC791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d14d771c3c30a03ef4756818aeb5551905c406693e8364261bef4b3d21f1bfc4
MD5 9c419a520e146ae4da586a28c9c435ef
SHA1 51547c52ffc7a54f06d3bc489499fd396da0a453
SHA512 40868130a2ad873311138d3765ae164362f366ef7a3b875fcc55f7faa1edb2a53fe04003662f00417a9e49a91ef36f78e914dabcd0555999758e497d81676d02
SSDEEP 24576:1Q9MxZKdcz9dw3wfJ4yL/tNCJPXUQrPr:1VKZwfJ4klKXnj
TLSH
T19E558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 5819ace2b82482ed26420321af349528f80a4f2e9a811d756a36f40653b542c0
MD5 67cca34dbdbe00795a001a99051a7b6b
SHA1 226422b542d18176de8334f0aee1143582dea986
SHA512 29deec38e8fdff428aa5eab890def24a9e9ba1550a10ed37b9d379f1998edc590c0f0ed3ccb74ed811de2be5749e17a77160f9d3ea8c13bfc9bfae4ad4cb2d7f
SSDEEP 12288:TyoKo2JRple9pJfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:TyocDApJfJ4yL/tNCJPXUQrPF
TLSH
T10DF4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7a9288675227682740151613bada4b626de61201933704ba307c4eceb6533ef2
MD5 eed40b82bd6668681463d3bd424ea188
SHA1 004e9310684112de909a9d36c4e7baf16cc900f2
SHA512 bfe097f508e66045f0105c28fc7d4e1ebe54fc499bde74895f8a07c2e6d18a2aeb834d284d0c5cc244225bff467cef46f8e0bd17e0cf632a8d76fcd2814b047f
SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKJfJ4klKXn9:40zuNI7fJ4k
TLSH
T1B9A57B3DA2F800A8D9AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 2c092ed06952c8f5c87a3fb46d48621895952b83f59c891c6a8637e611c59b96
MD5 96185c3e1ccaa57967fd6a4e94d644d2
SHA1 b0c987e399944366b465e3599669019ff77d6d5d
SHA512 571b5519343f23a9069a76ea6bf12ba704700febfb188ececb57584fe40cbbd1e91c15d0631d13125bc2e5fc740188a8afda979c0f8e283c71c5a1921c63e21b
SSDEEP 49152:Ca0h2GEkuAe73q3ppj6zwwQPfJ4klKXnDfltLyvH88YzRp5/NJn:Ca0hNYGjJwQfJ4k+rGvwb5/rn
TLSH
T177C5D01E67EC82B5D0BAD278C9A6814BE6B2B4160B3156CF1191853D3F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 e5fe7c508d3c682b6cce87b883ab5da62615cb5c959c7c2005612e704da18ab0
MD5 7247c528a66dff0ead6114a782dcc6a9
SHA1 5f985822c705a9ffc12e74f5cc549c2e8f1e99ac
SHA512 4de89c06f71989393498e53244050b90b6a5f64853ddf8f381e36b236f5304cbd9d2f936d6752945aa1b027481dfbe5052011505db0172e5eee1106a163ab522
SSDEEP 24576:31QT7EcpfxR+N5AWAz3ooiYhjMqbBTBt3byAUHWreGf+jY+JqRp5fl9NJn:KTDxR+N5YzTTjMYltLyvH88YzRp5/NJn
TLSH
T12C75C02EA7F815E9D1BE86798B23C512FA727821073193CF42A0C17E1E675D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 9e6412f9511fe39c81bea3a723e0176afbf95febcd8f1ea9a3a6086be2391963
MD5 b5643ad9ea1f093452062921dee6ee93
SHA1 459250d12d653f061ef5e084b455fb66c2b95ad5
SHA512 ccee80a1823ac81af38832ef11a21599ac3f7802c1c1a8fe24df0652b31e4ba3fa13898392933d8640226346a51e4161b0fed99a81cd41c36e7ef78d2ae4ad1a
SSDEEP 24576:0TMdOz0FFS+UmSLHfJ4yL/tNCJPXUQrPB:80K+UmSLHfJ4klKXn5
TLSH
T19D15E17E63AD14E5E57BC27C9642D906E67238A6032266DB06D0C0793F9BFE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33d26624c665fbf6.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\33d26624c665fbf6.bin
Size 12KB
SHA256 f0fb3a6dce7755f28778a6f0e73514cdaa1d622fe8d09e6418cf6d7936e3a5d3
MD5 5d613c59f702d5971299c77ad3d353af
SHA1 00a42c8129392d3158f569ed6a1b74159f250d73
SHA512 686c56a2fa2499ad6e6a46ca7c4a9d8fd731e71e7b36daca6cad09ee41eb47726778972530ebbb87d64c1cbbc6644d70b56d1daeb65692fe9252e5f24df69b8d
SSDEEP 384:0pe9PxfWibBlGz9rRNQ5VkhWu4MMHzPywo8JPx/:0pIfW2BU9rRS5Vksu4M4P3R
TLSH
T11142BF0B17512C5021B6EECC8B5D189FB28DDEFE3152B3F3068805B495E9356E606CBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.9MB
SHA256 f08d8bb9f0f4a6454f878e3a7a7ec01f5be1f608176d05addb35d7d08e0dd9bc
MD5 811be5cd97591c4cbf9f94d074fb410b
SHA1 a47b6dfb431dbe25872904c933897023e206d7ca
SHA512 1bf0f5e0b1d875e7cfebfb22310cba1adc7851e48fb98dba792efb0f932e91081b5db22fe0157a6b13d0d73f49ac9d2de4e50afc9437c7b8af3b49e9ee41d873
SSDEEP 49152:aygnaTk46pSR/EfJ4klKXnK5ltLyvH88YzRp5/NJn:aRffJ4kHrGvwb5/rn
TLSH
T10A95E12EF2B910B9D8AAD236450143B5FB71782D1F2196CB0170C538AF1AEE95E39F1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 5565b5338b40272f0295b8b014d4d5d74f70f100c482477ed7f3e4b72ab08853
MD5 d59c234694a4a6ec180a3c6e0b0d3072
SHA1 a4c1e26b890dd3ba5c988b61194f5cddd47777df
SHA512 4e13199de0a0de59142ea56769afcba091c8107d915aabb1c9bda65331ba6b85bca720d1f2aa2c8ff098e168edef1e1d41e63b4859e6d3e49682c3559f179f89
SSDEEP 24576:GmfJ4yL/tNCJPXUQrPgJTBt3byAUHWreGf+jY+JqRp5fl9NJn:GmfJ4klKXnYJltLyvH88YzRp5/NJn
TLSH
T1F365239A12E82095E876A7780B649101C630FC962B3A62FF2CD0D47AFFB67C7253C715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/632-494-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/632-419-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/648-488-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/648-406-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/980-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/980-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/980-85-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1768-83-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1768-65-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1768-81-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1768-71-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1796-489-0x0000000000690000-0x0000000000713000-memory.dmp

Download

memory/1796-396-0x0000000000690000-0x0000000000713000-memory.dmp

Download

memory/1796-491-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/1796-390-0x0000000000690000-0x0000000000713000-memory.dmp

Download

memory/1796-487-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/1796-400-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2256-348-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2256-170-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2256-168-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2256-162-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2464-516-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-500-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-507-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-506-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-502-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-520-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-521-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-519-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-510-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-518-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-503-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-515-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-522-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-517-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-514-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-523-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-505-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-512-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-501-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-513-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-524-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-528-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-530-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-508-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-525-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-504-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-526-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-527-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-529-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-511-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2464-509-0x0000019277580000-0x0000019277590000-memory.dmp

Download

memory/2524-486-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2524-371-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/2524-384-0x0000000001420000-0x00000000014A5000-memory.dmp

Download

memory/2524-379-0x0000000001420000-0x00000000014A5000-memory.dmp

Download

memory/2524-376-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/2524-378-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2688-493-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2688-415-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2900-316-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2900-100-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2900-109-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2900-103-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3264-349-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3264-174-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3940-27-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3940-36-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3940-35-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3972-84-0x0000000000400000-0x000000000278B000-memory.dmp

Download

memory/3972-20-0x00000000057C0000-0x0000000005827000-memory.dmp

Download

memory/3972-193-0x0000000000400000-0x000000000278B000-memory.dmp

Download

memory/3972-0-0x00000000047F0000-0x00000000049A0000-memory.dmp

Download

memory/3972-6-0x00000000046F0000-0x0000000004775000-memory.dmp

Download

memory/3972-8-0x0000000000400000-0x000000000278B000-memory.dmp

Download

memory/3972-13-0x00000000057C0000-0x0000000005827000-memory.dmp

Download

memory/3972-1-0x00000000046F0000-0x0000000004775000-memory.dmp

Download

memory/4144-196-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4144-195-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4192-117-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4192-332-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4192-127-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4192-118-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4484-495-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4484-449-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4484-496-0x000000000CD80000-0x000000000CD88000-memory.dmp

Download

memory/4484-424-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4484-465-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4484-481-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4596-357-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4596-364-0x0000000000670000-0x00000000006F3000-memory.dmp

Download

memory/4596-483-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4596-358-0x0000000000670000-0x00000000006F3000-memory.dmp

Download

memory/4616-150-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4616-157-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4616-156-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4616-347-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4832-90-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4832-315-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4888-44-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4888-173-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4888-45-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4888-51-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4968-147-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4968-346-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4976-143-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4976-345-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/5032-40-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5032-41-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5060-492-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5060-412-0x0000000140000000-0x00000001401FC000-memory.dmp

Download