a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 08:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
Size 1.8MB
Sample261002-j8tk9adf92
SHA256 a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c
MD5 888196ca73a1bd8b1f019d6d8bf8443f
SHA1 82ddeceec36f07625890793a704d86e044dd4643
SHA512 d2df3f86fd2d461a7620ab48f8e6e4a8cc0a67e5af42f44ad6113ec28c042b074ad09b1d1e4166718228c796e49e9254b7cb8b398344741cc4a4a1fa9c1d31b5
SSDEEP 24576:1el3++0DvfeUYqcZQCGm4YagXe4i7ojhsP5Lgrk1TWb4AN5:E3ovfe41Yde30jaNf1TWbdz
TLSH
T19485E111F840E432D19201B0E6A5CBF3592CADA1EB1558C7F3D0BDB67A349E1A73DB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1344	alg.exe
5108	DiagnosticsHub.StandardCollector.Service.exe
6008	fxssvc.exe
5760	elevation_service.exe
5464	elevation_service.exe
5456	maintenanceservice.exe
3128	msdtc.exe
3152	OSE.EXE
5260	PerceptionSimulationService.exe
2236	perfhost.exe
6068	locator.exe
2692	SensorDataService.exe
4600	snmptrap.exe
1964	spectrum.exe
896	ssh-agent.exe
5480	TieringEngineService.exe
2412	AgentService.exe
660	vds.exe
1208	vssvc.exe
6088	wbengine.exe
412	WmiApSrv.exe
2116	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\locator.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\System32\vds.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\AgentService.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\dllhost.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5f1859a6227ba850.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\vssvc.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107609\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107609\java.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107609\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048736b0c4752dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a36dc80c4752dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ccfe90c4752dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b81db0c4752dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006fdc780d4752dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c920d0d4752dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7ea610c4752dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5108	DiagnosticsHub.StandardCollector.Service.exe
5108	DiagnosticsHub.StandardCollector.Service.exe
5108	DiagnosticsHub.StandardCollector.Service.exe
5108	DiagnosticsHub.StandardCollector.Service.exe
5108	DiagnosticsHub.StandardCollector.Service.exe
5108	DiagnosticsHub.StandardCollector.Service.exe
5108	DiagnosticsHub.StandardCollector.Service.exe
5760	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3204	a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
Token: SeAuditPrivilege	6008	fxssvc.exe
Token: SeRestorePrivilege	5480	TieringEngineService.exe
Token: SeManageVolumePrivilege	5480	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2412	AgentService.exe
Token: SeBackupPrivilege	1208	vssvc.exe
Token: SeRestorePrivilege	1208	vssvc.exe
Token: SeAuditPrivilege	1208	vssvc.exe
Token: SeBackupPrivilege	6088	wbengine.exe
Token: SeRestorePrivilege	6088	wbengine.exe
Token: SeSecurityPrivilege	6088	wbengine.exe
Token: 33	2116	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2116	SearchIndexer.exe
Token: SeDebugPrivilege	5108	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	5760	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2916	2116	SearchIndexer.exe	119
PID 2116 wrote to memory of 6064	2116	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe
"C:\Users\Admin\AppData\Local\Temp\a98e85092e98a5a9d9119406106d665fc9aa31582c4df0503eacf6ca19ba378c.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1344

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1484

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5464

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5456

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3128

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3152

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5260

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2236

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6068

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2692

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4600

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1964

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:896

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4732

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:660

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6088

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:412

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2916
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0c739d245bb6783e7d323bb21c4449ee9370a425b078c4bdf31983fe80761668
MD5 25961413358727cb3395e0939c05906e
SHA1 deae7abc2b03360ceeff6eb9d0ae52c6f45f3166
SHA512 c95da5b5a51882dfc646e64082f3b7eba5e9c8bc86b0325acad1a093c0111d95fa18c8ab5437552d1f6662143af6857c3c188a7c5c3968fe57c8c46bf583b6c9
SSDEEP 49152:9b+632BuPkFKRrdE6ohrstBhuXjfS4LWxnWe30jaNf1TWbdz:D3q60jB3U023W
TLSH
T100D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 bf051eaa3f284544fd6b98d2acbe65d6dd22f1abcc09c1687e21b3a400faec1b
MD5 7bcaddb761ce3840fd476e9f46c93891
SHA1 884beadbea79ed7855e6fbf15e378b8495c9fa15
SHA512 bf3b2a0f25dcc1123cedb2392c153b3a95efb71a411903f64ed81c974ad238b211c401f2066d27f20e40a026d23c17660beaf3bc981e56db76e37874265c8816
SSDEEP 24576:BXYfDtczAkgXe4i7ojhsP5Lgrk1TWb4AN5:EtcYe30jaNf1TWbdz
TLSH
T10285F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 30f0b71ef7fedef6e6578a5e6ed52da183ae55828b840f7f4910f6d195409911
MD5 70b897b8c8ae1e6e749a8f052b2673c3
SHA1 e2a016a8519ea179e08810969c8b6f1e0bb97537
SHA512 e7063513cfce0c38b02a672cbc2d1b63c82ece97e4adfd4f6aab0ea0d28b10d379f6724d9d999edb1a959b3c7985a18634f6c948b75c974dcb8a0d15bf6c9da4
SSDEEP 24576:j0Le5ji0hmxnrMHgXe4i7ojhsP5Lgrk1TWb4AN5:jPji0AxRe30jaNf1TWbdz
TLSH
T15B95AE26F6748775D073C0B9C5D2A78AED71308257308ACB4286D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6da0aeb812eda9a4cc59251dac24a67120166b636c7803dd8831fea9e0a6447b
MD5 78057cfb571cbc480052debbc6482ae9
SHA1 10e5387cdad3151635e1e387a63af5fab22d1039
SHA512 1dcb1de02269757157d55ba0f76b6d7bd89680332d16bf23704ef066fdaf408cb915d0b25a0a8d6bec14977dea6d70b6a9227c5ceb4e31b976d14dc2c3ef4a26
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWr6q8wyutgXe4i7ojhsP5Lgrk1TWb4AN5:2/ezSC6vUzPviHjy1e30jaNf1TWbdz
TLSH
T181756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7f2e8e860766f79794bbcd6fc3acc437e6e749c28ba3045c668041c8159413a4
MD5 c92735dcd7ac723f8e64b59d8a4cff17
SHA1 742484adfea5c484efe21fd94f9c7cb5441ec2a8
SHA512 c6713708049a25b9552b2545a150d027650d54c4d08bef715e50dfc3be75b3560c0586ec54945eb97daea826a740b8ccdfb12f1533143f95206b8987edbebd78
SSDEEP 24576:JVbqPb88hv/l+bAgXe4i7ojhsP5Lgrk1TWb4AN5:JVO88hXl+Te30jaNf1TWbdz
TLSH
T13E559E66F5748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 adb74549b414eb9c87998342ea12e46936c2e47d28d98bf69475998df5a52fa9
MD5 30ed8fe4fe792e6f39336f2ac7e8823f
SHA1 383c321871bbcff5a2a656863167b7ee8316606b
SHA512 9a71f514bf7d5f2e8ea91ea81a9d0f94fc2eee667788f4589cbf8ac880cf11a056287b928ada4fd311b15ddbc22951976c12f23af6c415786575b3f8c7031e25
SSDEEP 12288:exa0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:exzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1416523A29F5449C6F38BC3F0A0F7CB91E5A11EC171444E6B47E0FE9318BC899DAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 560a049d2ea876cb82f51e5837f64143e651dc2622d3a213fad61347d86226c4
MD5 41ce4ea1e751c30f028a6770048eb7b1
SHA1 0750a5d8e170fd153b5c0d116752e132ebab3191
SHA512 d97e3c51b5c91bc0a1cf9ab533a8f3b76c5696292fbf9d41b06081f1911b4b65950f5002f10580fc65caccfbf6082018f60333fee83ef0bf574a93192f2727bb
SSDEEP 12288:veBNUbTVO86UL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vJIUogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D685CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fbb6fd1dc8a0e4b11ba273a9dd52eebf4a991e41a00d2ad15f230298b4430919
MD5 c1f963a1b0c849b44afe7fb221a9f671
SHA1 3c80e44ac90ceec9ec205326b3c813682bf2209c
SHA512 ae88f9e6d5d36370e13dd886ee276b27799ca45c756297096ae59a474782a478131c25cab991bddd505ae168d1dbd3db63ab088d6c6c84931ad653618e7f2278
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THx:NQvGAdlCEL8c/RRNw5C4U023W
TLSH
T1E1267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 63405c210275e193b6db0d9aa68cd08636f9af668477e73de20751568d699f34
MD5 4a0cbd9526dc1461ddc4c06e62b8b4cd
SHA1 cdd8d7c74bed8093b01fd184dde5b969c83431f6
SHA512 a92f3c0fd15553424464706bdad70387f3f863fc47c1af6383cb4699ffc72064fd33f757d9ba1be8f8ecf3f841d39f151e430395c4076684c69cf17c819dba84
SSDEEP 24576:NoewsAjugXe4i7ojhsP5Lgrk1TWb4AN5:yljhe30jaNf1TWbdz
TLSH
T1C685E031FE74E032C3BB0DB21B76C706587C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a209f51cac19ae27300f6d4dc9a26bcee49a29a38d21349af17241cff8b90fd7
MD5 fc95f73048fd454e5108889f239b3695
SHA1 d958b7569eba0c372ceb8795ab2198b2d0a7eddc
SHA512 d6f859a202d6c723cc10abea29dca91ce9940637e1902834ff18bf5a0a3f02472cc7e6d5b1338ab9d141ba3b957b70be992032fe4e176d4a49a6694098f27b6a
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHpp4W:6UEtQevvqc2W1cpV2RI3274W
TLSH
T1A8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cb684a48fa05caff6e42850f48ae4869eb84d49cb9495e4012954c0f0aadcfd7
MD5 1e4a12fc2d496cdd9f1e88990707b0cf
SHA1 5479c3e90add5d1ff9ae1abfa4fc585d4eb4c24e
SHA512 736dfd8258a45a0d9eb0c3c6965cfaad768dcc77d372651548786de4e32ee8dcd5f6e30e8f90c1bbd944cd0456858cb08b6c2fc68d4c3fffd685cf12999e032b
SSDEEP 49152:oCbRquA/m2yL5zQfFiV+XenmE3/zBe30jaNf1TWbdz:BoqtVjnmsU023W
TLSH
T176D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b835d57dd5cfdb4b7ab7f0d7859fb7423c7d9d4ac6c9eea05dd416b0c35f9170
MD5 9f16a0e2e491b24fc82881da9b4e83e5
SHA1 0fb46c021fdba35c067f99549917103fbf7bcc8f
SHA512 6ab8e63161c546c99028035b42f64fd6cf87cea604ac26052525fa6616ac7955edc7988affc9d81bd0365835c2ccad4abaa2f9973b18a5b6d12018238f94ff6f
SSDEEP 24576:8AhGL2IFoiwtA5l7S53xgXe4i7ojhsP5Lgrk1TWb4AN5:8AM1Foiq58e30jaNf1TWbdz
TLSH
T14A359D81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 559420443ab97df0b797ee058ae5ae10b3e89e162ee64bad02c99dec8d2d809a
MD5 c8268b86c1bf9af141a61be4b8bebf8d
SHA1 c7816545545a5ff0878cf67644568faadefa922c
SHA512 a8accf7bde8807814869ba9882e04e96142e0b3a133ef75ef78121e65439d7e4288a1013bd0a22208944960b140b2135e9bd83d5ffde37243adac6f501c7ea3c
SSDEEP 12288:5mw5HEjsChNUBFgl0WDm+Cs0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:UwulOWCgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10885F14676A40CF9E5A78278C597C636F7F2BC412A21CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 6c682247f403e9065b63447e45de8073703b871c756f749f0056ec68c6fdb295
MD5 867d42d01b0af8eac707ad5aa82616cb
SHA1 552d7d44947b7e986367d08fab99b0e8a305f353
SHA512 7a8467dcc866c28f2257c39cd8caa2a9e243bd95cfd28bfd875e14565b427f17983e301b2dca6681ded89768fd05d848d409c58cd70ae6a927946cbe3e4027b0
SSDEEP 12288:DJZ1IyR0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FZuvgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F375129637D420F9E2978278D4F68741E7B23C82237147CF02A096A61F76ED65E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2ba3a3cc4f703e5c5b6cea9457391b17720335d72614d3826ef55e7f0f559b04
MD5 e7192aef7ffa3fe09ade88068771156b
SHA1 9b2a721c1adbc2de912b38d825cf25c68c8b5001
SHA512 37d89488211aba8ea956e6e75aa917492597bf0fb06b8e9cf03760a95a9fda314a19c7f5db95e016024e2789cce1db46564c6d83d608ecbecddeb4736defe4be
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UN:AQRQyi36YOcPhLvw2gAf+PN3jU023W
TLSH
T179667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bc4cb793bfb3b3fe65c6f162dd1d3f85b7d71d5d841fdefcbc067c373586585c
MD5 33b1b5a3e98aeecbb15f0255c23aa9a5
SHA1 b0ff0e36589f0fe30c33a7384480da9bcb6e1dbc
SHA512 8b70402bb673e73f63540fa5ef2e6e2da82d80d0a8bded15e708f265fd1c270197737e010f313e24f51fcd4fd3735e3b9fb4b3d535026b57bbfe8271cdc8bd63
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UN:WQRQyi36YOcPhLvw2gAf+PN3jU023W
TLSH
T146667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2165f137118721788fda17d99bfa494a360a24abb3e8eeb00e91ecc975351d9b
MD5 b45be94a1169aaeeb67a403129c406c9
SHA1 f3302724d26ab0de563b0d2721f576c798f6d53e
SHA512 7d23abd52de8a036e8e46c0bbc560f3a9c14e1ccaf7e7c6e750548d53ab2bf18cd336499dc7f353cd518b829d7780053463ad3c86a4a72a8887b2451d769773d
SSDEEP 49152:268Qg55nhceWu7PNU3/Re30jaNf1TWbdz:UthLRc/RU023W
TLSH
T1D5B54933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f82195969c65e3919603cae5a3771e98caa53e755f0c685484b838e12ed464c9
MD5 5a69774e40a8960b5015af93b3185b46
SHA1 abb0045628aaad48f0fd27def9bda9501f7deeaf
SHA512 9d2a283b6fc120298bad964b5cb41695468840f3261202e334cd3a24acffc8bcecbca2a1ba3a299bf79a70cd83f6143db2f7b422f0143f67d79fea99a1f9ec6a
SSDEEP 49152:l3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk997:Ey5112gYy5azzVva69nLKnhZKU023W
TLSH
T139168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e0f02917b22941646d82d4b4837e27a6718b23858e9e7e6569fcbf85a739fb82
MD5 296e95763d56abbb3a78a378896e6143
SHA1 6ce3f66a844f1f70e4a9cd0a584a29e90380851a
SHA512 472ee615d2e3507bd3023a4e01068ffc70b4534782187224176ef7f79b31a96024f632fc0e4ab2df0087514b65ea5cb79f2357f4bbd5b6b7bbe1a5d4a8e79079
SSDEEP 49152:aB+taZ3usBWOBr4tEG20bqx0z+n217aau1gl7e30jaNf1TWbdz:Iu6JmUxd2d7U023W
TLSH
T138D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 716ecbe7b24dc86de5923562b6826090f5023572729b814721b4aa941de26f32
MD5 7f50d216fc2738f810eb8a791baad176
SHA1 c674e67e19596d7b5d480d7f06cc329beab6ffbe
SHA512 0877adaa7b29b5f4cb4840ddafd55639495571f43f4a4050c0ed5d823f1317f6d621a013bdcc771fa0f2063da8aa8563404898a8f5fbedad52d6e7dcb8d7f36c
SSDEEP 49152:41hpsNoJpF1A6BU44CwH7R4x/e30jaNf1TWbdz:4mifPkRsU023W
TLSH
T1F6B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 39296af18655cede0c0ebd317d6b7725c5219461837b6355eae575b51e78535a
MD5 291cea07de639b902a9e52f9c4fbaae4
SHA1 ebdbd710f16b25f435da0c682b3c75e5dd3cbdaa
SHA512 3f18f9bc9c0b9912a5cbdc2d9ba1e06c6b2499ed77b062514aa63fae2c383d330634c87286f4ef680d04dd6a466260646070e714a128ba96f9b3eeb9885921d8
SSDEEP 49152:kSuZQIY0Be2KNRVtOnks6NMHqme30jaNf1TWbdz:25dKvi61mU023W
TLSH
T180C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3810e72daa28dd1731e5b0f9d8f765176084f1e798b0fb538c1d8d132b9e06e7
MD5 66f72027cc9d9990d3421a1aeecac82b
SHA1 ee59ddbfd2222c5d27a0dc916442f04a1010eca9
SHA512 b489398e7742b5bd2bac6d1f22dc4ed5bf69ea0e7ed8c03344ad47b804fd246866213cfc450ae59ee669fc663c8a3514787fc2ea05ebe310974d4261819020b1
SSDEEP 49152:hhtSn8EApI0figXgiDn0AP5wLe30jaNf1TWbdz:wX2iyphgU023W
TLSH
T13395BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d11234ede1d397eea79efeb13b2a81bde61d2290d983f2ec46ad96fd85802bdc
MD5 3ebbee7f3ae6b14c1e21ac18f25bed22
SHA1 f7c088949b62cd452af9eda8e242f54241aef0fe
SHA512 dfa0ca8a25004e053da11769a26718aa1004582166ef444f7f66b715cd0f4d24d04dc4cbddf750941663a3273511f6dcb4043bdc5835e2310ce0e6ea50ddca5d
SSDEEP 12288:xC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C9652392AE5549C6E34BC3F0D0F787C1E5E11FC672444D6B17E0BA531DBCCAA6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 c6fdaf2395b21c8416c87691d73c8767d3adb082f90a3ae327c70722fa2f5c38
MD5 9c65b290d94f928728a8dd3e84c9a8c9
SHA1 675433ea4655d4643fe036489e009514f483f756
SHA512 a9acec4400f0d6d7a7bbe4d644465eeb628c426760596211085d5ee8671892325d03fd90c17cd97d3af4b28fad69b2730434c858232145d5664e8011bc235a9e
SSDEEP 12288:lN0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:lagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1196523A2AE5549C6E34BC3F0D0F7C7D1E5E11FC672404E6B17E0F95319BCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 1d58437d2909edfb27c2a58dae1875df2fe3736eaabcc68eb27b2e8b1a273ce2
MD5 af39e440c6e2987498e13950a5a6e898
SHA1 bc1ea278ef4e1f47e68c33ea088950154eda6970
SHA512 eb80d6bcfb487df142cbddec9e284f928da91a9d32ed20e31807e2bc16f2065a2fc971dff74ff259975a5c59358f46710aca18092c6c5280271c66b95ccb58aa
SSDEEP 12288:/T0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/QgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16A652391AE5549C6E34BC3F0D0F787C1E9E11EC272404D6B57E0F95319BCCAA6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 9c9638a556092a7fb0b8bf10eb613e4806b56acb9a2399d347eec2a495500bf4
MD5 e9518a874bf085693e269f5993c3598d
SHA1 6835de0a12b217f2d83ae1d153822bad6815481b
SHA512 d230c46de3d5500fa94c86f26e1ea192877d3ee983ed9ea7e4cc6461033cde5f427405ac3701e6c2cb6c141410413c09de9ee8a42e4dc35b201c31ce75ae7df8
SSDEEP 12288:sVw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B16523926F5505C6E28BC3F4C0F38791E6F13DC173114BAF47D06A530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 c2cdcfd2fa0bc1f4ee2de6a970d296c38a910cdfbfab71a7a18c715e6bf09cf5
MD5 781c5c0c4e510429ecbf8d3fe454fc13
SHA1 935a53065ec9f245a47dce498518ce7f14f6f163
SHA512 44cca01758487cb0e72b47c2419c110b06b22f77404b73c29a56a56d6d41a27eac5560fa038f2f8c7fa4c93364748fe74edeccd18d7286ed346e322939677b42
SSDEEP 12288:Yo0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T133652392AE5549C6E34BC3F0D0F787C1E9E11FC672404D6F57E0B9531DBCCAA6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 b310362dca6c3eb12b8f3096863a23928c086e93e041c70ab6b1745c29286559
MD5 94d7fc6f73f5a06be7452c8c388c329a
SHA1 1021218fac63c8d2f363c8cceed5fd87e7682cd8
SHA512 080747e060fb76abc4a1260cf1984acb91e2ac2cbb9432743abc761bfed9096775c2acbd56a3816a9e73f37a91dc716d8c74ec550c0b2fec2035a1777b458a8b
SSDEEP 12288:JJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11D652392AE5549C6E34BC3F0D0F787C1E5A11FC672404E6F17E0F95319BCCAA6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 ef42a7f8caba72fcc9fbe17c52059270bdfe2dccbaf5231448a0cff7fd4236cd
MD5 e9d58500acdb7b2c6a672a27f96fc959
SHA1 71ca26bd30fd64254c488f0f3dc35788c8b01195
SHA512 f1681bfe59c006916e47bbea638924ea878c4ded8dd3fb8aa507e5a48fd9b542c990e819312436e6ff2fc41f37c4309a7ea907b814fd5f8f800614c2eae00837
SSDEEP 12288:Ql0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:QSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B16523A2AE5549C6E34BC3F0D0E7C7D0E5E11FC672404E6B57E0F95319FCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 ad61185eb3a1f45b24c5649353e3551ba51b8e55c611dc41edba3d911ec46e91
MD5 4e51478616d218e447795aa7f48cb4bf
SHA1 2b05a6fd446b3abaa5a20b9f2f2bdf81d7402384
SHA512 ccf4661f2f60dd2c2dbb5ead65b8e69abd62145a1101de9c706df7acc6055c8719204a1a443fb945d70953c21746ae8856880848ab2521d190621b786eb047ea
SSDEEP 24576:aZMGzFVSO6gXe4i7ojhsP5Lgrk1TWb4AN5:aZMGzfJe30jaNf1TWbdz
TLSH
T13D850295B3900CF8ED67827DC8A68A06D6B27C561760CA1F03F436671F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 5cc8100d033437fdf98ab997cff6aba409e496bc364070645e50ed531a933739
MD5 ddf8ada45f9edc634ffe926dd48cc182
SHA1 2221b4f6d7950f0b43ac3f785ce36789e36bbc3a
SHA512 992a2e4a18f38b81d126e79a849279b82264d73f5821448afb53f39fc4f428b0ddd324c243890fdbadf3a51ee126801a0042d7f55849b5a1c00e4ab8562b890d
SSDEEP 12288:5G0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5fgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T182652392AE5549C6E34BC3F4D0F7C7C1E9E11FC672404E6B47E0B9531DBCCAA5A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 4399bc62b7cfb6c7d219716cf040b70be559caca1f0f95488f8cd860bba3ab40
MD5 af0508182bbe1ce877db265c16f76c2c
SHA1 5065fd10b1c04cf1a27e3af29920c46014e3dc7a
SHA512 4ce3adf78e8699862aa3ed9616c1ea0566411d8f136cc2c54af5af4cdc9f90737470d78732c1ec7550467f738ca8637b028ffb5ce8c88fb2de807ed681e7b5fe
SSDEEP 12288:Cq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CjgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CE652392AE5549C6E34BC3F0D0E7C7C1E5E11FC672404E6B47E0F95319BCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 abcb10f9e3606e2c0fc5fb58d6e753116da20b350b3b2047f78d742577af4955
MD5 449228f884c691cf89bd44561b073dc8
SHA1 f1f1d4946857326fa7588bb2a0166975e786616a
SHA512 92141f330c5f843314de2c68aef82b0cb4ded2fa7051babe42fd51b879021430a7cc398e4231e07e99bddc46358320aea365ec3aa0c38a8e44727de7a64b90d2
SSDEEP 12288:WyPz5L8R0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rzyegXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12875025777A120E9D1678278C4E24B42F7B27C7217108EAF03A057732E776E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 121fa2576b5e831096d3b732a2c8139852f6ae3d6e11476998ef925a98a4cbee
MD5 6f8910184562e0ad5b787c073184a415
SHA1 e70954b8cb2cfc1143b5d99024adafafd9a48811
SHA512 b9c6d6c3b81aa3c41866c217adfee815d25371ebe2cc2d4af13158957b4f78c2392066ce17c444aeaaef2c56e8af04d19871146de67a620300daa38e4e27c837
SSDEEP 12288:WG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T121652392AE5549C6E34BC3F4D0F787C1E9E11FC672404E6B47E0F9531DBCC9A6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 aa17f2a586249efaee211acfb6bdff55150844ec94a271b5c57d6dd3ac5d9089
MD5 67941a0f7fd58d8efd41d581e25ef705
SHA1 55bf5632ac545650ce20ca7aeab95253e4eb340f
SHA512 e7bcce876b5d4e44be6b36e32af14b63cfef99ca7911d9ca04c674360091691379c869b1e50ecf618806335fbd5d3bb2d64e32b392f5ca7ce1069cab7f942671
SSDEEP 12288:WG0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WfgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16C652392AE5549C6E34BC3F4D0E787C1E9E11FC672404E6B47E0F9531DBCC9A6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 fa45712fcfbee1bf2ecd2ad9ba4cdb27e6836a0672f2d803dac11c0243ad5cfc
MD5 ab5988d8c7b1946642d4fa0065bd9f2a
SHA1 703000eb92159bf4dfadf2e6e6aec0d001be43df
SHA512 c11d2ae11fd4c4f6f96469c4be88537dc98845a1b20a83e6e0c5132c20a55add0a8d82e927c4b6290317bea9bb43434798a7c0e27cb1f65d51eec2d9288a69ac
SSDEEP 12288:UyPz5L8R0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NzyegXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DD75025777A120E9D1678278C4E24B41F7B27C7217208EAF03A057732E776E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 8c05fbf310efe220719294f11d38f3a9c431e74f5961eb1180c4aec0f984992f
MD5 3993d2f0bdc44fcdb6e729c935a5524e
SHA1 807920ac7ef34e02b75b5fade08a2d252ceeae15
SHA512 faab718f652c5fe6bfebea7fd274625c94cd27dc169e936e18e883858d8605f82c4ff05d02d1a04f94e168950bdc5824fcfd20bf23359de992677a7ec0e73b27
SSDEEP 24576:rcP4mcvIjkGOxhKP2l71nNKbrh/8KBXgXe4i7ojhsP5Lgrk1TWb4AN5:AP4m4IpOO67W8K4e30jaNf1TWbdz
TLSH
T15465AE2DABDC0096D0BB917485A58A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 4f6e91afecd8ba6cfa6d9b1b16d744c77e0b4fd59226bfd677c27e7c35749cb7
MD5 82bd8b3c084aa88eb5c57b912f035f01
SHA1 2d772744b07376be07f93f8bdfc2bbc2d43e6aa4
SHA512 bd682bb5d6bc41a539990813d7d50605a97452e6833055e3377ad457b94fd27b979c9c7a5082bf2cec5e5e904f4efc91e3067b300f17d04cd554c46406c4d7e3
SSDEEP 12288:YAsf20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6vgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13875F05AD29802D8D05E92B4C3968A41F3733C9593E1C7CB13D0F93E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VentoyPlugson.log

Path C:\Users\Admin\AppData\Local\Temp\VentoyPlugson.log
Size 357B
SHA256 c02087fdc38ecddca9e6ddb70fa0e8bfa283bac3322347fa84696c089090bfc8
MD5 05b5063562bd1de8cbb255720735b87c
SHA1 7565892327a2312430097c39b8221ef000c35ef3
SHA512 ddd7362312813e8bdfbfbac0c2349d9408ec5f4c849ad83a49835846aab4cc86cf81a19282a5ea3e66c064ad9d2a312471a4e2f54fde2561c804e6c830c43bdb
TLSH
T1A1E0CDA098DCBBFB4629411A07893D889671549F5B0E2B59B7C583057E48F04DBA23C5
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 b4677d9b05d8833f815045c133cf37df22a09f1a3db47e4022ebd1b1235ccbc5
MD5 99216d56db5ff6364dc09a95a8bd0c8f
SHA1 55877bba28a0025503e75a0959f7e929af52b938
SHA512 ca7f02bcafb3d48eb669d96073325f1f61834bebe66ee9f6d31730d8dd95573fcd03eb28c2d877fae6d3257e1c019f9155df79c5eb9a4889bc202ae91d15bad9
SSDEEP 12288:fW0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fPgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1596523629F584DC6F29BC3F090F7C760F5662FC13B00899B52D0BA5319B8CEA9EA451D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 66b3981e29acff273f587c50468f0ba48c3b441556c39076a1bb24cb79b98b61
MD5 a961e067f3dadb14d075ab3fb7149ec1
SHA1 24be27223a00402cd6feb3210865716838166556
SHA512 f62a3650e52f8edd9dd1db48e8e0a12bec40ad161c3fd367e39fc91c4232fbd3e48b84c15a748e5efa4ee495c69170a852adf04a348916fb68264c38639e60c2
SSDEEP 49152:ra0h2GEkuAe73q3pp46zwwQ0e30jaNf1TWbdz:ra0hNYG4JwpU023W
TLSH
T11F85AF1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 abfb7b9f6e6bf2d017d172420ea743ed522f9b53b7ed801009cbc5f8a758c97f
MD5 f21478ab64607cb0536cdb41efaa8e56
SHA1 7ccf645488e6328813ac81b3830c352cba12873a
SHA512 42bdddd566a39fad38717780e9339ab9d87e449088385723bb39f9b1d7a2e2b1ffbbdcbd5c44f35604f031a3f0369594ce86d56f8fc14c26147f13588210490d
SSDEEP 12288:shbHjfX90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:shbHjPqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C575027E2AAC10C9F276D2BC91E28646D371BC55271187EF13D0927A0F3AEE85D38E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0730622831cc31f469901ae498c3af796bdaeeb960392d27329237d34e22eeef
MD5 73b034cf740fd1775f1a9e60c087058f
SHA1 cba0e53eaddb89f6ae84e0071683688b3a20a4e5
SHA512 1d3f8c9f6e03af8c321bce2003f15f50e2cfdb3990e2e1e6d2e3e4291db617c16b30a5f5a706f527d726c3e02d6513c74475e9596e7bdeb9dc1a9538df87772a
SSDEEP 24576:73YgnJcRTk4yti+R5dBR/CgXe4i7ojhsP5Lgrk1TWb4AN5:7IgnaTk46pBR/Ve30jaNf1TWbdz
TLSH
T1AC45BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 49c2780369c4127bdec81f31fa3c8c6b5abed8b5750f3af3efd87ec65742cb32
MD5 9276adf0702fbb7c229e53243d070519
SHA1 d6c1a24848cf09f03cd921247aabef279e6a401a
SHA512 b4255484c63a5b7d301ed8a3cfee01d5cb2d70f8eadf7fc2178ebc3a935961809073c66c520bbeccab16e727bc503a82d423828baa578bcc9775c7d4213d280d
SSDEEP 12288:260DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2TgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1686523919E554DC6E24BC3F490E7C791E5A11FC133014EEB16E0FA531ABCCEA6EB8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 0f2d8883c359daccd5219a282636bac8aaf899e9765f67cc12092a3e45f4c29c
MD5 2195ec4ae5fcd5303b815d6c677c8e0c
SHA1 057fb13cf20d52d8e7404f01f73fc249939550b1
SHA512 6882f74b9b9871dba265d1a3d21233e5625753a0dd23e31026bf5bd580caedb59ebf04cb7d0e5a482667b7ff4ed9a44b4125eec8f665f608a9878ec086012724
SSDEEP 12288:7ObtA4LWOsvAYFT30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:EZL3UTkgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11595F155F79400F9E96BC17CC4A28A12E2B2789D1364E7DF03A84B661F637E64E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 51c7b5b07a12d5619734ae5733760937155fdc113cebb2317c7d06e2efa89f34
MD5 217aec24e3d46a24509fa3655b1c46bc
SHA1 e9b9755bd2cb1be87bd8cf55cbcf1f1f36730765
SHA512 a856f0e5cdd859c6d47131ab1e4a5843596224513f0c27fd1b7736017538f5b6d664e31a88edb39d374e86b4abb33ce0bec520288bf4e6f3f672c9b303ec96f8
SSDEEP 12288:+pFtqOr0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DOIgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C175026A3BEC10D5E16A927C85D38349D3B17892171147EF02E081BE1FB7EF86C79A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b303bf3d02b317a7267dec7a7e1c75ca70e03dae34c00c64e8bcb86c89dc7868
MD5 10069805369ef66d78160cf955ad0f76
SHA1 4942269e3319a283c75b27378bdc744bfffb3b13
SHA512 012a1990553d114ca40fd508b80f7c0d0597c85e8c4c698807b9c153e2c1db46d5c51b9356492549226911352a8c21df4c9db4ab3caf91b09d22636e0b83fb12
SSDEEP 24576:i7NM9YqZqmWMUkPjZM48Mv6bEhsfgXe4i7ojhsP5Lgrk1TWb4AN5:i7cBWMpPjN8DbEhte30jaNf1TWbdz
TLSH
T138659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 dd7e5ed467acdeb552a4d727100db72b5a376cc2fca23fa8b2e54bb2406329d1
MD5 467b91f9855b43101bcdfbbbf92e8704
SHA1 756e159364a781abe312a4fd44ac0f12bb516c4b
SHA512 84cbe6afda55608ea634632f4fcdaea536ab81017f607caa772d04f0d868da35d2cf253df3650fee31676775bda0e0628a3c43ca09ca68b862eb48351afdcb8c
SSDEEP 49152:kF2YuHNETovAvNYf8kmWe30jaNf1TWbdz:x6BCf8k/U023W
TLSH
T1A7857E6927ED80A4E0BBD27D45F6D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 df2576fc18267ca6ffbe8914766f80ae5fd377de86fc7d0572608d3a3272421e
MD5 1e1f0c51ef42e86547f224092b7a7c6a
SHA1 8661ca1fbbbf10070261d0e6efa53990deb6ae95
SHA512 e9ac4b7a40e585b51902a58007d18abb740da3971c3fb2ab70fd324d2c9daf0b00626c0aee36a0041de22d654462425e8ba2c5db8aefd4d0464f8156a456af11
SSDEEP 24576:MAFs06+OmlfQNXEbToMgXe4i7ojhsP5Lgrk1TWb4AN5:hFs060lcXuUe30jaNf1TWbdz
TLSH
T1D965BE2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 12bb7d980ad0882fe40e49933ed6b349ce5d222cb057d580935037d3ff096792
MD5 69e1aead71ff5588fb89ce58fb87ca64
SHA1 3df59e8ea9e9f7436144435f7f27b2b1d9b35d20
SHA512 2f00c33e2810adcbd66f77ab724ced7590b059325ad848c0804dd0a01d738ed85887b85ef5e0e0f41296609dd4b78a9fce86ab1e9c41a1d85c7e9fb6b959cdc3
SSDEEP 24576:9JnJ5D3WhpgXe4i7ojhsP5Lgrk1TWb4AN5:9JnJ5DGhUe30jaNf1TWbdz
TLSH
T15D85D02DD2A810E8D0B7C3B4819A5796FF72386D2B226ECB14B4D5353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 fc3c7cf91001aa0ca13f408520fd6b38bf43a39a95c18ee4440bd082872acf6a
MD5 5e4477ec885277bba3a23d05b9617c94
SHA1 c0b541d1b2535096e1790fe3640dc9a7f7c69da9
SHA512 89d6ddb5923494caf589aadf126d2e7321f46c768487a265ffe488ecaa8e9adb38be20d340b888d525bb8be773069ca0a37e3e5ca2b7d4336f235c41d629d836
SSDEEP 49152:Lg06DIKdwc+eQnSt65aVCe30jaNf1TWbdz:EwU023W
TLSH
T172955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 deefe820e2dad64a2878f7f8bd84f85ce1178db5f7f2f9fda428e95111ea82a5
MD5 295be477751f1decc17b98782dc54d49
SHA1 e261397573dd32a7aa5fbc3c5c7bc68ddf12e20d
SHA512 32409e2cce21215fbcc4997b4356e97c7703e88707147523c40f1d22d41046e009e57fdb858a99557d50b0155c97438f96a8954ddb5ebfdf043fa1fac6a96137
SSDEEP 12288:7EP3RFs0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:AFNgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15775126D6B9C60D9D16BD17C90E28745D3B2F4A127421BEF02E0D27E4E779E92E3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 89ac54a3649a7ab4a7414b5b9f3622791f5f9d10bd68e4ef9125fd67ac840138
MD5 5076682e0de1b7dffbbf4375db5e80ff
SHA1 309ef0a21a0f51d68b87717d4012654ae1e6eb2c
SHA512 63c9bc6c2ed206de070b533eebefedc532eb9f27a8b5d944f19a3ec701794ad079303ddbaa01724f0cd4e7d8cc9ffd046a29ee34e608a1e5a36179223be98f5e
SSDEEP 12288:ZjkyN0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZIyagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17E751205679854C5E2AB8278D5F38390DA71BC602B1087EF51D0FA3F2F7AAE4AD34B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 dd7c5722010df45558c28746c945b510865d43270433627d1d65a2f5c104c6f8
MD5 f84417fb08657dcaddc70b2dfa685253
SHA1 ec7c15af88e0fc929a1932b1a464086c3850de29
SHA512 cfd50b7c7904a31ee3076d06dac11d61733b7b3012c934f60df54cba8451a7582559dcd5aa36d59514955671b53692af7c38264009f07a3b65c9212a58d0fb22
SSDEEP 12288:lQ70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1256523595A5559CAE24BC2F490F78B91E5B13ED137000DFF02E0FA734EB88DA6AB4858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5105aabd303db46430b6f9e031eb4d30ea5eaa23b5a7f629016757e0907ab920
MD5 6de44b3b5b57aa89dffcc7543e19669a
SHA1 2b044d40ca2568d4a7854d6a8f06e6da88be65c9
SHA512 6f7f15f9be0d56ec290b731bb5412617f4805e91f4beff115ca9aa4e9bfb1d0f22e22144bd28df2e5360439a9d18b5bfb389f608cad4fa41dcbeba8727d53bd5
SSDEEP 24576:EQ9MxZKdcz9dw3ngXe4i7ojhsP5Lgrk1TWb4AN5:EVKZOe30jaNf1TWbdz
TLSH
T132557C2DABE909CAE177D27595A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 6d9ef4e4daadc85a0927abe597ce56165c4e1c07245715dc6c685ba68819c74d
MD5 9a983a1a44f00813bec16b873ba55b25
SHA1 a8054f5d4e2f25b43f902fe66f38f8c0154ea2a3
SHA512 d63e77822de15dd224e337d63de9194cc4249bbd76c825de2949c33270abe89bfa562064d557501be8e837d889f281b9b53ebbc5f71bd016706aded435b51a8f
SSDEEP 24576:eyoc9ApugXe4i7ojhsP5Lgrk1TWb4AN5:joc9Aphe30jaNf1TWbdz
TLSH
T18185E01FBB6940E2E166823C88868741E7B3B4702B5257DB52D1C33E4E779E9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 29ba792e72a1a9bb07799d8269bb83da89429ff0ff7dae921a56b2d5640c4477
MD5 f65f13433fc9a35408517807f371cbd0
SHA1 d60a0691b6e5492ecc79e214b9b47f309ceea2a6
SHA512 4448e5aa0f4e7137c13329f9aebf009e955679126344ec935d54ed0edd30d227ea97f11a09e1bb987a24b2d5a891df6ed70d9b3cbb27e6ff288c19d397f02e91
SSDEEP 49152:eWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKhe30jaNf1TWbdz:40zuNILU023W
TLSH
T103A57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 02cc7ac1876b37e3c643f9932f742a463701b9e08c5d0116d4c42beebbadb2f7
MD5 c123d9c54e27dfc3844de89c4c338436
SHA1 c2b723607d08a8ad85071b93ee9d975994928835
SHA512 6ad2db2cb319bfbfbaf2c6836f6750c77d7679977be48650408f784ab3883a0da041daca01ed8f11b385bd08684c513480057b62a8f941ff6222f6fc2a9d00e4
SSDEEP 24576:F1QT7EcpfxR+N5AWAz3ooiYsjMqbNgXe4i7ojhsP5Lgrk1TWb4AN5:gTDxR+N5YzTujMfe30jaNf1TWbdz
TLSH
T17F55B02EA7F815E9D1BEC5789A23C512FA727851033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 14d33fc35fa0f8b45e420281a742f4ef614b7491f3586985dfbcb53796cabdca
MD5 8466c0596db55d41ecb27d094c612312
SHA1 7e6150f6fbfa5b1f73c8dfe3b8c945af60822489
SHA512 76e9c6c00b73af27d9c5f0d56ebcfb7a36de117311ba5906aed748354eeaa267a6caed1b3dcdd548c18973b2360e2e014ab6313e97ab5afce1ff1c1907703a66
SSDEEP 24576:wTMdOz0FFS+PmSLRgXe4i7ojhsP5Lgrk1TWb4AN5:40K+PmSLse30jaNf1TWbdz
TLSH
T13A85F17EA76D14E5E17BC27CD693CA06E672386103116ADB06D0C17A2F6BEE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 3b5944c7558a280202dfc1b42c58e96b7db0089696def07f50562e8abc3e931c
MD5 e2394611d4d105736e1c3b989d31511f
SHA1 4e43e23a86d833f36db7826f901eac2bb8fb0e17
SHA512 9e89f66c15cc9e1df2df076b61244b5231217f74842c2b5a83837a773a2109e49df72be3b468b635a3f86cce14ba942719dc85442fe68117912d61b9c51a775e
SSDEEP 12288:74030DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xkgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BA75125967E824C5F167C2B4D1F78341D6707CA223104AFF26E0EA7B0F7A9D89978B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/412-397-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/412-173-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/660-368-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/660-161-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/896-149-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/896-338-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/896-145-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/896-139-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1208-369-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1208-164-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1344-112-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/1344-16-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/1964-135-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1964-326-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1964-126-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1964-132-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2116-420-0x000000000D430000-0x000000000D438000-memory.dmp

Download

memory/2116-177-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2116-416-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2116-208-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2116-237-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2116-192-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2236-168-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2236-109-0x00000000006A0000-0x0000000000707000-memory.dmp

Download

memory/2236-104-0x00000000006A0000-0x0000000000707000-memory.dmp

Download

memory/2236-114-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2412-155-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2412-157-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2692-176-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2692-315-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2692-120-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3128-154-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3128-74-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3152-160-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3152-78-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3152-85-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3152-86-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3204-1-0x0000000000760000-0x00000000007C7000-memory.dmp

Download

memory/3204-12-0x0000000000760000-0x00000000007C7000-memory.dmp

Download

memory/3204-0-0x0000000000400000-0x00000000005D5000-memory.dmp

Download

memory/3204-84-0x0000000000400000-0x00000000005D5000-memory.dmp

Download

memory/3204-375-0x0000000000400000-0x00000000005D5000-memory.dmp

Download

memory/4600-124-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4600-293-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5108-20-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5108-28-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/5108-29-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5108-113-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/5260-93-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5260-163-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/5260-100-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/5260-99-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/5456-71-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5456-64-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/5456-69-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/5456-67-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5456-59-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/5464-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5464-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5464-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5464-148-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5480-353-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/5480-152-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/5760-42-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5760-36-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5760-45-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5760-134-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6008-72-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/6008-33-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/6064-429-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-443-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-461-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-462-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-422-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-423-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-424-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-427-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-425-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-426-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-428-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-435-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-434-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-433-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-432-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-431-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-430-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-460-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-437-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-436-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-438-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-439-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-440-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-454-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-442-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-441-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-444-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-453-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-452-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-451-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-450-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-449-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-448-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-445-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-447-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-446-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-459-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-458-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-457-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-456-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6064-455-0x0000023AFED20000-0x0000023AFED30000-memory.dmp

Download

memory/6068-172-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/6068-117-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/6088-371-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/6088-169-0x0000000140000000-0x0000000140216000-memory.dmp

Download