a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
Size 1.9MB
Sample261011-hebb5sdc49
SHA256 a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309
MD5 88f9bddd01b7620663b0086c368535e1
SHA1 e92263976d2c1a934f91630437ff922953b3e388
SHA512 e5d0ae5e6da89b1ae3c0fc08539901120bfc7699a157d24bb25dcf9a3b22c90bf4fdf013501866a1800541afda2698a2588a89e8c11a3cc60fc994aa978cc8c3
SSDEEP 49152:yVpCDxstsR+ft983Dl3gEe8xA+GGbHNvPZumqUIWPLXFKo:yVpCDxsOR+l9EDl3VxA+GSumqU1LVKo
TLSH
T1F795E0F06640F55FF2C099736FD88BB21939F92DC9CA915766802FAA59310F26732633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3508	elevation_service.exe
3260	elevation_service.exe
32	maintenanceservice.exe
936	msdtc.exe
2132	OSE.EXE
656	PerceptionSimulationService.exe
3296	perfhost.exe
4748	locator.exe
4416	SensorDataService.exe
1844	snmptrap.exe
4640	spectrum.exe
3892	ssh-agent.exe
2284	TieringEngineService.exe
4428	AgentService.exe
2716	vds.exe
3364	vssvc.exe
4260	wbengine.exe
2844	WmiApSrv.exe
3784	SearchIndexer.exe
3628	alg.exe
5876	DiagnosticsHub.StandardCollector.Service.exe
5568	fxssvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\System32\vds.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\System32\msdtc.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\vssvc.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7ed5b4d7a26b1277.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\wbengine.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\spectrum.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\AgentService.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1712-6-0x0000000000400000-0x0000000000836000-memory.dmp	upx
behavioral1/memory/1712-115-0x0000000000400000-0x0000000000836000-memory.dmp	upx
behavioral1/files/0x0001000000017816-499.dat	upx
behavioral1/files/0x000100000001700e-578.dat	upx
behavioral1/files/0x0001000000017431-581.dat	upx
behavioral1/files/0x0001000000016795-588.dat	upx
behavioral1/files/0x0001000000017039-587.dat	upx
behavioral1/files/0x000100000000c534-584.dat	upx
behavioral1/files/0x0001000000023365-583.dat	upx
behavioral1/memory/1712-582-0x0000000000400000-0x0000000000836000-memory.dmp	upx
behavioral1/files/0x0001000000017bd4-580.dat	upx
behavioral1/files/0x000100000001704d-579.dat	upx
behavioral1/memory/3628-705-0x0000000140000000-0x0000000140168000-memory.dmp	upx
behavioral1/memory/5876-741-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/memory/5568-761-0x0000000140000000-0x00000001401F3000-memory.dmp	upx
behavioral1/memory/5568-770-0x0000000140000000-0x00000001401F3000-memory.dmp	upx
behavioral1/memory/3628-772-0x0000000140000000-0x0000000140168000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6f1ed3a4b59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008addda3a4b59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aba2df3a4b59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ec224334b59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c67fb93a4b59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2b7b43a4b59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8fcf5394b59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6645d394b59dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000961b983a4b59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2feb7394b59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014a347344b59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe
3260	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1712	a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
Token: SeRestorePrivilege	2284	TieringEngineService.exe
Token: SeManageVolumePrivilege	2284	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4428	AgentService.exe
Token: SeBackupPrivilege	3364	vssvc.exe
Token: SeRestorePrivilege	3364	vssvc.exe
Token: SeAuditPrivilege	3364	vssvc.exe
Token: SeBackupPrivilege	4260	wbengine.exe
Token: SeRestorePrivilege	4260	wbengine.exe
Token: SeSecurityPrivilege	4260	wbengine.exe
Token: 33	3784	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3784	SearchIndexer.exe
Token: SeDebugPrivilege	3508	elevation_service.exe
Token: SeAuditPrivilege	5568	fxssvc.exe
Token: SeDebugPrivilege	3260	elevation_service.exe
Token: SeDebugPrivilege	3628	alg.exe
Token: SeDebugPrivilege	3628	alg.exe
Token: SeDebugPrivilege	3628	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 3172	3784	SearchIndexer.exe	120
PID 3784 wrote to memory of 4900	3784	SearchIndexer.exe	121
PID 3784 wrote to memory of 2504	3784	SearchIndexer.exe	138
PID 3784 wrote to memory of 208	3784	SearchIndexer.exe	139

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe
"C:\Users\Admin\AppData\Local\Temp\a5796b721c999964470b91e50f90180fa9aea3b6379e37f7363647d9da0df309.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:32

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:936

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2132

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:656

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3296

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4748

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4416

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1844

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4640

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3892

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1520

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2844

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3172
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4900
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2504
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  PID:208

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3628

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5604

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d7da370f11d1fe0fe2d63921bd34e523047c1d19931c1713c4c13016d93147a4
MD5 ea9e464163489740c6e43456ede34317
SHA1 09f93a800278b81227ba20578b2767b5bb6dc53d
SHA512 e9ddf5b8ac7be12539cef77ab0dddd600a38bbc52105aa40655784639a484287ae1b1fca5e9405fc39c24a950887017b7259f042f21df8f3cabd68373ecd3890
SSDEEP 49152:5b+632BuPkFKRrdE6ohrstBhuXjfS4LWxn4R+ft983Dl3gEe8xA+:P3q60jBLR+l9EDl3VxA+
TLSH
T170D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4c4e4abc8aa3792f1762b60fb9efc7a6b518103f76c59491300cb0a98743d7be
MD5 12e064dac8830f2923c6e0b9565fdadc
SHA1 a200e0d6e6084bf732fafbe082787808c972b1b7
SHA512 9b865dc381a2af2e965bd41fe6013a48a724123f9383ff5858e27ba7e974c7d1e6183a3c7eda3f281cc9930697e8b4221f2d1f479b0f8019516d89e2d7a28957
SSDEEP 24576:VXYfDtczA3RPWxNs298r3OCDIjG3gE9ow+8xA+:AtcWR+ft983Dl3gEe8xA+
TLSH
T17705F12877D408F5ED6B827DC9A28512E633BC4547A0E7DB03A089665F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 61d33f9780e29a58f1d56d229f264abd6984787fa06d51e964915ce507e01cdf
MD5 f4baf6425ce452c25cfed7cbe80ce441
SHA1 269bda0a407b1de1b9288d5e2e8f73e9a609450d
SHA512 6754a3ad07f123e496bfb5ce3f7b41448e860d1e86b0d54f625e37d2e93fd2a9caf98155c794fdec3e1b01157e11a90f4f79f5f0e8c0598467c9666a77e20772
SSDEEP 49152:EfcWR+ft983Dl3gEe8xA+d8bHNvPZumqUIWPLXFKo:ElR+l9EDl3VxA+dgumqU1LVKo
TLSH
T1A57512247B9909F5EC6B81BDCDA2C512E633784907E0E75703B04A665F2339C1D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 8e0622b385fa7b3f662d2fda614fe7c0dd3cd3532fd9ef76258486431518ed94
MD5 283abd5c20450cfedcb506f2cc31286e
SHA1 aa2adb8453413d1c1880fb009ec832d1160e19f1
SHA512 c6f8406648cd93bce5a42b81c85d7a567219cbf558351bd4394ceb0aba0813967e27932168afa7c709a232fb1e9ca2b31471bfcba21da7a339231113f9dc1afe
SSDEEP 24576:GSewsAjxRPWxNs298r3OCDIjG3gE9ow+8xA+:hljxR+ft983Dl3gEe8xA+
TLSH
T1A115E030FE74E032C77F0DB61B26D716543D79204BA119C3E3A88E9E59342D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8e117de754f6d3736ae2c886ee3f2e0295621180ff97b1bb09cb6918e4abf978
MD5 bbe13828c40a81c14533df9d2166db43
SHA1 609b3be934906eede258b9a6f5ea438d17ee9270
SHA512 e9a3819c54da38497664e071c0868cb792d46e96a473d3c4957b1e4792e46aaa67e8f4d7d599bf17f0c9af728623ee9b86642cc696ab4654ebb5dcf3fe100b9a
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHJ4sDlF:fUEtQevvqc2W1cpV2RI32R
TLSH
T1CF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b43b9ff20848e74352e0ccc62dfc983e561acb17e96d48279ad1a5b117b547bf
MD5 4a17ccadef351d369a6a4324cf8183ac
SHA1 b6a2a4f720987747bad249dd1399032be0c9b282
SHA512 47266c4b8e4770c81e01e78da26f3f4e08ad4c58b108de945e4d9ec7ed72e1a3f12041ba18a5c2e258cc80f1fa051b2a79188bfbdf661a14c7deaa3e9a39a3a9
SSDEEP 24576:fAhGL2IFoiwtA5l7S53yRPWxNs298r3OCDIjG3gE9ow+8xA+:fAM1Foiq5iR+ft983Dl3gEe8xA+
TLSH
T12135AE80EBF955D4F5B3AAB899B69171EA76BCAA5E31C20F2150C11F1E33E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 cd2cf6b85763361fadb66e20cfb67a759256465b38ee8ead070b93a630f52482
MD5 c14652797b5e352c7af1660df8b196af
SHA1 69b82eb0847dd686b79848082565e236add970ca
SHA512 9390d113e17843b9c2c18705d49e284ef6fe2729a98c472e46aa9e9d9ddff69aad28f378b0753f104630b34b4105e42904921e80104a0f763e9b4b155b932f0f
SSDEEP 24576:NwuXOWNRPWxNs298r3OCDIjG3gE9ow+8xA+:NwsOOR+ft983Dl3gEe8xA+
TLSH
T12A05F14536981CF5E96B82788687D132F7B3BC022A75DB2F4760C65B6F37321AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 66a2a32c9051e46425b9194a0c6d2d142d9fde83963318ad39e97efa595884c0
MD5 7a3a94e3ac820308c7c52a9945efc021
SHA1 f0f193188d70eb9747b1c56dc1862ba4ad821d93
SHA512 16c08049b254dd910afa352c42eb94a05b55709330664a5a02dbd49d89e57c3cbfda3d64e173261f394be82dcce48064830a2b0d6bccb3fbf07e380752eaf62a
SSDEEP 12288:C/Z1IyBRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:mZuIRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1ADE412493A9C30F2D66B82BCCDE59141E332784627B513DF542186A66F37ACA9E35333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c321b6bb4057842866358489ab3a7a6ec5cfe6dda8e0fc60ceac004d558384a1
MD5 23e275a4693b4cdc98eb934e8178aa7c
SHA1 5630030dc46a4f82d1e74e67676595add0a8a69d
SHA512 28b936e5e7f70a2c30801e1ac04ff1f9eadf02ad46235c3e69593823125be5e9c9ee47180b3f44bd5b0d8db33cc1bb6d2ccb890129a8969bc6203f0c7772b9d0
SSDEEP 98304:8QRQyi36YOcPhLvw2gAf+PN3fR+l9EDl3VxA+:jQyiKahX+PNP4sDlF
TLSH
T1F5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ba587007b8754b3e7468a51e813748824c028d15f11846f68b1e1b272a356590
MD5 96d1484ce9dedfa4c82fed2027d274da
SHA1 92775fe1aa644cebb992e6ada44094dd0a9c3c90
SHA512 33e06f2bfbbb086f1397945893f48caecdcad89fe879777ed2651c6610c7156c79287c4c19e4e7e55b39c3ed7c2d85ef31158879f518cc3817d50f7e3319706b
SSDEEP 98304:kQRQyi36YOcPhLvw2gAf+PN3fR+l9EDl3VxA+:rQyiKahX+PNP4sDlF
TLSH
T101667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d8af7a80b8c6589cb42f49dc7a84a8fa127ff152a22a8ad7d4bcb2447f180f63
MD5 89e720a0b98010d6fe350ad80b05d4e6
SHA1 4472118dcb8c3a10ac18822c20884eb73bdf0e4d
SHA512 9901ada35eafbb91722032d83d84014f8aa652c4c6330236d7c65aaedf056e618c00ad6309458706b1598c209d461e5383efd73a2cebc301647b06fd8dc1c8d7
SSDEEP 49152:i68Qg55nhceWu7PNU3/hR+ft983Dl3gEe8xA+:gthLRc/hR+l9EDl3VxA+
TLSH
T1A5B55933B2F600A9C44DE1769F4A973196D27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c29ccd305a81695e05b3db26adacc69c942588525a844769722034f2a62f2087
MD5 5f9b44760c0cf74c64bf490375a1f38e
SHA1 cc1fe01e0870eeea6cdb2e24d34a9dbb6255d895
SHA512 78b7749e086f72c8ece3c896e6921094ece25b8d73f9a42b1a76892d1ae33b74d682cc0d143cac0efd4adba6998c80aee348c128baf9824c6f21d0bcc0248a1d
SSDEEP 98304:Ny5112gYy5azzVva69nLKnhZ0R+l9EDl3VxA+:wLIHjWhK4sDlF
TLSH
T130167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5924ba66987f960a7d3937de593b6e2c0984f393302eb926943d06e696738412
MD5 3e7ca1ac73ec0e016f1c206630e0affb
SHA1 8143345d520e491a25d4e4f1a92464016c1cd122
SHA512 0bf8007762bd6e54a532c2b9897da6bd8eb8477b1df51d2fe60043bd1a93bae33687ea43c3907b78e40ececae580f1658858661dd30ff3786d22a858786480c4
SSDEEP 49152:TB+taZ3usBWOBr4tEG20bqx0z+n217aau1glnR+ft983Dl3gEe8xA+:lu6JmUxd2dnR+l9EDl3VxA+
TLSH
T1FED59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c4b6707646cca9728da8fe62e63a3fabd5067dce445f4afa7df767b383607569
MD5 d6b8edc21f48c88890b26d269ceebdb5
SHA1 8bfbbe7d4f7738dfaebff94c38e12f1b306df859
SHA512 8d504238764b4d9e907e80cdd92393d416261b7b23ae430c242532f3679a3dba727ebd6c6558fbe4b4fce2080ccaee425cb615ef7911f25aa1d9050115ea5401
SSDEEP 49152:61hpsNoJpF1A6BU44CwH7R4xjR+ft983Dl3gEe8xA+:6mifPkRSR+l9EDl3VxA+
TLSH
T1B7B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8dc55e81da0797b4bc469f92d793f3f9f462bfe6236a9ed5da08d354d27d7081
MD5 a38e5c15bb9d9a7c88b5586b4d9499a6
SHA1 d03a87fe683401bd63069e7c5cbe087e4826cd11
SHA512 4e9432822b619f718bcc5ce97861dc2ef9b5fb82690af739a499a86d11e5c47f63492aadd295c2bf6564c2c6c23309a63628282c2ffa57394aca44dd572a8f3c
SSDEEP 49152:1SuZQIY0Be2KNRVtOnks6NMHqIR+ft983Dl3gEe8xA+:b5dKvi61IR+l9EDl3VxA+
TLSH
T116C5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a1bdba20aff4053a9ee5d283e55fca212bc885a36423a6db1d38ba259ed06011
MD5 17f13d440f8082e6931f2327a393ad5c
SHA1 c1579800a11f652b0fa81bc497e40ea36d84b882
SHA512 db2a59051549350db9c7de15e18dcc7dbd9e2602de386b63560ee85ada8942fafc396ec6ba9899a896e2f7b7430a9989fab41642038cc7ca22958410c24c53b0
SSDEEP 49152:whtSn8EApI0figXgiDn0AP5w3R+ft983Dl3gEe8xA+:hX2iyphuR+l9EDl3VxA+
TLSH
T19495BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 9e51770ea3d720e3648c2446e598602b6113aa66ab5bf7b37b624d2b9b89ef5a
MD5 3fc84c1b96a84590634755337e478be9
SHA1 15de0b42dd5dd9251d93e1290d4c0cd3b2728d46
SHA512 005b97e90342ec122dde42cc3053e17d6cb663ac6993c111e4f0ceef12a270cb1b7eac541f9e7913b8343ba54beb9133ca60085bc82d6372b93d36d42773d0a7
SSDEEP 12288:g8RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:g8RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T106C423043C4D35C3DB1F81F59A86F0E1E0365D4F78F935F2E4628562AE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 9a88a67103f1b6884228a6d3fe7ba9e3b5edeff80d753b44a2baccce8f8e0494
MD5 62e1521bbf87146500af13c8a2206685
SHA1 e6a6e1fe65d6f7dd6eef890f42d4881e1276c34e
SHA512 bf9aada176f5a1a8d86e4d1f3a831bc433113b209ee3578d729335ba69dc481a2b82ee77e5d47fdc0c4a7452f03a4d0ca9ee9be0aa7d2e1f10f22c1747e318fc
SSDEEP 12288:SFRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:SFRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T187C423043C4D25C3DA1F81F59A86F0E1E0365D4F78F935F2E462C562BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 09ff49365ddfdbdfa67036a9dd7878d7abd3cad784a7ae7a68774e70e88b65be
MD5 52b8f022deb4d5984687007f02263edb
SHA1 3d8ad18d1566e295ea64af064e3176d71a7d39e1
SHA512 e3cac012a58878b892cfca1f9af627e99e187a089f404524070894ac3c5556967f805355d91f43607f237b55bd1d13e649e5560c7693c41eb8559f8e70c1e56b
SSDEEP 12288:uLRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:uLRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1BEC423043C4D35C3DA1F81F59A86F0E1E0365D4F78F935F2E4628561BE7A65EAA800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ecd6a0d417fda661822470a6ed653da77eaac579c9882444ad8fc1bea339cfd7
MD5 d9f3aecbc3c3f43f551977e53f2b592e
SHA1 5ac682a0fdd1deb6f3ed07edea6961f37024b37d
SHA512 9bbf0bc2dc7dcbe0572b80ef49becb5512e667a2901cb59f559e5f8b9a8e881185b72952f273c5e473c6eee28d89a51cf79b05bae10757dd160b03c0a15e7fff
SSDEEP 12288:TVSRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:wRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1A3D423043E4D20C2D92FC2F9CD86E0A1F133BC8E79B526FBD81149625E7639DAD60676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 7a67fe02c1259dd9ec965ddb3c92cb84df095e89ba0b862612f29a2bc8d96ed0
MD5 fd63ab81ff75b611da0d2730c174a6aa
SHA1 1f44e9be404206a9af6d4cf013d06fd1c055ef6d
SHA512 0ce5b3016dcbda6dbccb74a7dfaf9c2a5c5fbdfeb50d3ab67980d2fe7d42db8781870a00dbefb1f20a1c7c61aedb80b6a78fd4442fcc4b9c359ea40784f19cf5
SSDEEP 12288:6qRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:6qRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1F3C423043C4D35C3DA1F81F59A86F0E1E0365D4F78F935F2E4628561BE7A65EAA800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6c3e50f7d4f72d8d3de1a0678e8706e10e4b62f7d107b4fb355d0a500c77248f
MD5 873840189cdc7625aff360031798a4f9
SHA1 4d02c57266942d01948f6d7c1dd031ac4fb093a7
SHA512 ce0c289346202e524f3557a2eceba19999568243584b32150cee282df386e04f2679fa7991f46f53ca1a109aaf05e8506244c4d13ece7ef5166413897a039928
SSDEEP 12288:KZRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:KZRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1D0C423043C4D25C3DA1F81F59A86F0E1E0365D4F78F935F2E462C562BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 63c3fafa0f886b7593fa5bb62a6fe6555bd3484ff022b66b69ede94f4c736f97
MD5 10836b1c6b55cf453badfad9524b945b
SHA1 43aade9aba1a59897ff33475df5e15201080519e
SHA512 836835f967eadb32e41c8549140e99753993703438c314d0d27755fbb63fde6baeb0919eea92b1c23551222cf09c3df91ed9d463808ff8d37791c94952967bde
SSDEEP 12288:d9RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:d9RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T182C423043C4D25C3DB1F81F59A86F0E1E0366D4F78F925F2E462C561BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 958605b0f517d65b4e31a2dcfe88bb7dbc98c631efbb14f539d4cca1e4fc55f1
MD5 8b1bcdadfd4955fa1991c16fa13615eb
SHA1 4426db4ca4a88b61bcc0b8f0ca4e149a6046cfb4
SHA512 a6c27aad3c14d3c4874c289fd92825831234c86ea64eee842bae6b79315a42a335352617164a0eea83546af8e55afa335b30a9a18446ec3d7b1c44e10fcd159f
SSDEEP 24576:eZMMzFVSOlRPWxNs298r3OCDIjG3gE9ow+8xA+:eZMMzfpR+ft983Dl3gEe8xA+
TLSH
T136050194779418F0EC6B817ECD559912E2B27C4A1AB0C65F03B036675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 02e6d610f5b850efed90e283984989b7e66c099d3479fede9fe67531127ac883
MD5 46d39c68c7902381b7774f7645a12bb4
SHA1 f1f3aefab6127abbfeeb10cc9e29e05578102909
SHA512 ce52bb1e575a246f514305ca06e26794e5f0c1faf27bc6a2c7ada4e20488cd24cf9c1b9a4efd01b9f96bce277e9bf2b1bcaa5817e48fabcfe04ff0eddf6c7986
SSDEEP 12288:1YRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:1YRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T127C423043C4D35C3DB1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 fa332ad93dec50b9b0bd6c7c2b3d108271b51f3f1869ca9dd4aa9a04eec46384
MD5 7eaa9884b980a59bbeaa7baaaecd7549
SHA1 6ea81fd495044dbe1288f401e6ef50ffad4583b0
SHA512 e48648ff1e708f6ac0abb59693806f9436d147dd7d4330718a6b19a92a005c4e40ee0f825143bf66540b1893fb361e63a418861c9868f557c9d07c20dbb8e850
SSDEEP 12288:RERPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:RERPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T116C423043C4D25C3DB1F81F59A86F0E1E0365D4F78F935F2E4628562BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 14d20b1bc947854ad59c3637dd044f85253a5ad12e051cd195a5ef0ff082e1a0
MD5 04997351cbbccc773f668fea70311adc
SHA1 45c06060b3ec6ef97c5eb4087ea1d0d183e80837
SHA512 d0816f4c6154b9ef7e52da558d788c2964f6e60b1fc21df3f0c615ad6f7f5658ab9626c014debe16a6213060103fcd10051e353a40dc7fecffddf27088e4d380
SSDEEP 12288:5yPz5L8BRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:4zyBRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T117F412073A9930F5D13B8278C8925952F332BC361B749AEF526047722F372959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 73fd791d56ae6fe09ab77a0d40a26a4ddbc10474c267d960e55e2e74e4003ff7
MD5 b1bf50cd721e7458d536c5e1d4831a54
SHA1 91f107792215ead77c06db0ee327e39fe794ffd5
SHA512 2658d40d401528d90d117c7a792ffb5b1a8093b1c117f6265fb9a64d6c1f981af3fed467a2ffd0866cffe31b29f10797d96aff5c69389f7b9951c26bbb2b0b4d
SSDEEP 12288:8YRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:8YRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T17CC423043C4D35C3DB1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 72352f4aa13df2c4a7a05a230b38e947d672b8af3faba376ca48b4534ec446a3
MD5 93ba0dea431f76434c67f99e3174f911
SHA1 4cc68336ba25efda9aed84377e37c837fee81cfd
SHA512 a993ab38718b567e5f5d5dad52e426a94d7aac7f56bca93ae030c8305e344b160f9ed5786a6725181df3e2a4654f8f84873d93f55b6c78747ebf0c4d1578186d
SSDEEP 12288:xYRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:xYRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T15CC423043C4D35C3DB1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 6ad40ece5ed710a9035da887b8db493d52980bc380d857549f340a26d865c940
MD5 8169a6141c2be6f0e5f39e3add94953e
SHA1 30ec5f8b2f3fd3abc9175d2a21c9b4c6a200a3bf
SHA512 2df26572c62ce0197b0ed6671de2f890329568352d52095fbb33fa3911828f427ed93a18cd3307d271462fdae5122f2730b1f08dcf74ffdfa5f7b5d028e1e8bf
SSDEEP 12288:SyPz5L8BRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:PzyBRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1B4F412073A9930F5D13B8278C8925952F372BC361B709AEF526047722F372959E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 124edc4f2de5e334e744cfc763b9534c36392baaad337ab249391c9fd4c1e9a4
MD5 c086a722e124233437ca6334d902bef2
SHA1 36b42369a2030dd2f82a357f4a2eac6b35eec21a
SHA512 5edb0a0e578b755f0a54cb1552082d3d326f7020a848766dcc9fa90bcbed943c58fd0c73dbb6509a0d999abaacb7fde76421f5d2bece5a8b19a74c778e070e49
SSDEEP 24576:3T9aLl3z0zD7RPWxNs298r3OCDIjG3gE9ow+8xA+:3TQLljmR+ft983Dl3gEe8xA+
TLSH
T149050294779418F4EC6B817ECD569912D2B27C4A0BB0C66F03B036675F333A15C2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 de0a439fe988266fb00e899cafb019d133d57d7437044a7a7144a78651fe1ca1
MD5 d10f2b88ff926d4847d617142ce45f81
SHA1 c500c2c55c10807ec5d07d26dea0866fbdc22520
SHA512 26b0a9af6f4a5d026822214a47de656cfe21c419a6176f32c49568500791ed5019593228ea66694d9e6a8d8335e8a6edbf7a9680aae79a46a28c57cc60f466f7
SSDEEP 24576:W3td9CHKy7GZ/RPWxNs298r3OCDIjG3gE9ow+8xA+:4td9CHKyapR+ft983Dl3gEe8xA+
TLSH
T13025CF90F7E810E4F0B78A758D669512DA767C5A1B71DE8F03A4261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 bbc2f4974a2fd96bb50a8b41d814878f7339c4dc05ee7a6fed95484f92543054
MD5 bff515bac6daaf428adc4ee18cf89480
SHA1 69470d0e77a8a32ed7696d5dbdaec531c977df28
SHA512 1fcfe91dadf46582e2187e7344783f6e824790f093a1ae6e73f07d546a9ae9c489afa2d6d534f528e8e99324b10e7c0a986c31ecf3a5c52fdc7fbb39bfe453ef
SSDEEP 12288:prRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:prRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T155C423043C4D35C3DB1F81F59A86F0E1E0365D4F78F935F2E4628561BE7A65EAA800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 59456b059a7c0238ec2ecc8e13456f201ffdfed2b55c62b93a2ca2e92ffa2f44
MD5 9d3c963beb2ce1a10ff961e2099b609b
SHA1 461e0027afb3055382993805f0f0ee43e80766de
SHA512 5c5b15e51dd5b6a13ee786288b42046990ff9c8f67270cf8f50e86ccb65d55a8f116b25ca66bfc507be0fd814d8967668be9876f446ce32e614ef73257c14894
SSDEEP 12288:ehRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:ehRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1E2C423043C4D35C3DA1F81F59AC6F0E1E0366D4F78F935F2E4628562AE7A65EA98007B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 86bd9c77f5b5cefdc0a3f0f8b4be1e6192d04a80e8d3cf1835384928754d271c
MD5 1fb93e2f9dde90fc101fc77d848a591f
SHA1 712c0ac88d6afb8fb1a27ed7e1836b4b86df0c28
SHA512 11cd7c6c32d44fd0b7f3d7efe4c2e27e199400b263b90a3ca1a918f067dc35b45a6312eb393d196a142359e54fb0d4b658ab5eae62e49e29f25cab75896dd50e
SSDEEP 12288:w+RPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:w+RPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T120C423043C4D35C3DA1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 14521fee82196d94eb57c5f90b46183cb80c9f231381d7b6577abdc960dea3f4
MD5 4e951c87481d31724e18c04b9cf7eda3
SHA1 4c6bb978daa2dd510d146e42a0328f3f92cddc5b
SHA512 85f5ad1002b2ab21793098c6b73f37437628dd8e81792a8c80d69970dc8707806af7ed9c5f2b634a912e3f4932c77c7aba139169bd669830dac5a97b484ac0ae
SSDEEP 12288:FYRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:FYRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T116C423043C4D35C3DB1F81F99A86F0E1E0365D4F78F935F2E4628561BE7A65EA9800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 623fb551b559f0d7d78243f34ed8556e750e5cdcf88a0556b5a6c72c38f69e3e
MD5 7a86ccd336f6eea81829e6e0f7189142
SHA1 cc6d478fc9f9d616f6b79d2d6c928cd6b7c18ba4
SHA512 1117546ab1cea55aad04bc843c04ea238d4958b12430f50d043a2327ebd695ea2bb94e8a517ba4e7bfa8c6bf992cd5e0f48088f6a23cff38752cd634be740495
SSDEEP 12288:PrRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:PrRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1DAC423043C4D35C3DB1F81F59A86F0E1E0365D4F78F935F2E4628561BE7A65EAA800BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 1082a44b61e417bc0c339c3356b2522cdcda13c7b2af75a773368012087913ad
MD5 c505bc0975d082bf52f170342e8bcff8
SHA1 25fbb232b40266214120af7c926887285b1d2ba0
SHA512 7080db26ee3c87e4a8ca36234f406839675dd49ea7084efaba404f50e0a3e908141c252accf4a3f9db48f5ef5fcb4a9ac4e23c10ce7cbe90b0b5ffcc74d9c793
SSDEEP 12288:swRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:swRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1ADC423043C4D25C3DB1F81F59AC6F0E1E0365D4F78FA35F2E4628562AE7A65EA98007B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 a7a3639f3068135caf10e3d2f87bebea3f8b9827b80d5dac942ff570c9c2dfb3
MD5 df0053df061857bb0041445efdfdb1d0
SHA1 0ddeaca721a523813c3b09ba64dba91e739a1859
SHA512 c09101d7090ecb6edf90d16d0cd308a31a008811d8028490b449ee3a51081e2a7627e8e2229df61b1cbb3a9fc27d9ce58706f3c71d0676896a14870bcb65023a
SSDEEP 24576:YcP4mcvIjkGOxhKP2l71SNKbrh/8KBwRPWxNs298r3OCDIjG3gE9ow+8xA+:jP4m4IpOO67N8K2R+ft983Dl3gEe8xA+
TLSH
T13165AE2DABDC0096D0BB917885658A49FAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 4a6819040735974a332baabd650a27950bb509f9f6af0954b7ef661755474975
MD5 29d44bb4454a7f4aaa3a7239abe1c180
SHA1 1c0a7fffde4ac0db2cfd7ce2dd44862a70d8c57d
SHA512 9fc6e022103ec41c59b375f09f55b51b35d534091e09c63ba33b9aa21d2d86813b6587729bc4e67041a087b2f8e1c1ec04159e744d63f6e557c236ff422eee82
SSDEEP 49152:wP4m4IpOO67/8K2R+ft983Dl3gEe8xA+rbHNvPZumqUIWPLXFKo:IppOOi0R+l9EDl3VxA+numqU1LVKo
TLSH
T10AB5E02CABDC0096D0BA917886658A49FAB1742E1F3286CB1070933D7F77EE54E35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 31471628bd217eae0a4d592a2bcb40b57cb8975f5ac10ea9b38d7eca4479ed00
MD5 23f8472077383173e698748d40a9e5dd
SHA1 c15498982f0c63ff7b55e94a1e9e58acc9ef11da
SHA512 01fe169e15f4d6430835fdec9e8823b48328ba29fc9dbdb18a1769b8647217a6ae331778097ca432a1ea6eaa3fd6d16ec96f9428b9dd75b4ff38a248519b0e93
SSDEEP 12288:oGsfIRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:4IRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T116E40109D68812D1C02FA1B9CB469681F3337C1A97F1A3CB92D0F53E1F7A6949DE5613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.txt

Path C:\Users\Admin\AppData\Local\Temp\log.txt
Size 6KB
SHA256 c060539da487a2cdc4768ab4fd14c9a95c29997e60989b1aa51905e8c22465a8
MD5 5304d60becfe5711f07daa7db80c7b1e
SHA1 8e781ef270aa93e1a6e6c5bfbc6cac61e765cf02
SHA512 392810b10993856bf35e117a0e58d9f1aee1c49f305b3fce2f6c3d58a576dc8101d36f046935a7a9d7d53146948e76ae1896cf0b7e177912cfb54e455c618f2a
SSDEEP 96:oKH+y7kLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLP:aam
TLSH
T18CD114AF4E9EBB7B07252074B30D10B1660006A4DD835E282B9E751C76E8A7CF352DDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 51c6e605f85db747c976e08642837b88f6974e16823600597711df489b7c7366
MD5 da9aecc470f78e4a13c46a5363931b60
SHA1 1b349245315c9986db3c86338a3dd7e8c08eba9d
SHA512 9666e956a838a4129142eef045b4ddbd4524ad78a99de6d87fc84103706d58a90c6ee127b82f8e8591b9955e469ecc66bd6f68b3c2bd2bdc4ee14d8fe8a85647
SSDEEP 12288:UoRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:UoRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1CAD423042D4C39C3EA3F92F4598AE0B1B03B7E4E2DF465E3E4118661AD7969EDD6013B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d9c388fb58868257817e26f86c7df6efa24eee46a14cdb257981c4303e3bd079
MD5 c10ed8301fa2326755e6efb8519644e3
SHA1 e4b6dbbb8e4dfff55ad3503bff396d003beb5b45
SHA512 28a47a2622d8d89a7b3c05917770a88986b9af2dc5420db89eb79db55c0ff2ffaecfb57bc55148313eaf9b562aa9511db3f7b6e7c65bcd66b72a5fc593b4b028
SSDEEP 49152:Ma0h2GEkuAe73q3pp46zwwQqR+ft983Dl3gEe8xA+:Ma0hNYG4JwJR+l9EDl3VxA+
TLSH
T1A085AF1E67DC82B1D0BAD278C9A6814BE6B2B4261B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.5MB
SHA256 bd94a81bd82d1a7475a64089d52b317d7af558497a02c774670339d778c328f3
MD5 46c1bff3b78e779c97c5dc769d5880c4
SHA1 742c6aea85c17bfc147ef56a53854fc7c50d5b5d
SHA512 95600ac9f84d051f9f41e4dd332fe0e0a291d6ac5f6166c816f8fc1ff69c988e53627232372a7062e695cbea8253022580011b38c10d94cea57f370b7e92eea5
SSDEEP 49152:Ma0h2GEkuAe73q3ppj6zwwQqR+ft983Dl3gEe8xA+ubHNvPZumqUIWPLXFKo:Ma0hNYGjJwJR+l9EDl3VxA+qumqU1LVZ
TLSH
T1EEC5D01D67DC82B1D0BAD278C9A6854BE6B2B4260B3156CF1150853D7F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 13ccb506a79ed2f62d3b1f41550c38b5051cb3dd1990b52b1faa5d863642c27a
MD5 89537d00c7d7b426ef555abd060a9b26
SHA1 124d9472fc2acd365a29a6def2e4042bd6a7761f
SHA512 f51006a12a851ad284511530551e902f1bf482233d9b45b7fd95deebee48e30e91ad58c3ee20401b7c4a08b168a6e6317a70caafeef3bd10d550f52635b9df87
SSDEEP 12288:JURPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:JURPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T17DC423042C4C35C3DA2FC1F95986E0F1B0226E4A3AF936F3E461C561AE7A6DE9970177
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 604ee22958de11848ada373988c1cfc0901472ff1c6998223b11cda34418d1c3
MD5 fbf5ba10eb5d626abd8d4c4a32298f31
SHA1 55e4dcb76c790074f8487e350c5e49346231d50a
SHA512 920d9b25e8ab2f3a3948d80cf0eec274f432cda67acf6a3026357b0e95bd096c8502c1cfd2b28a04b7346c1d7f7e195c52b049476705a6547faa2e113055e210
SSDEEP 24576:hrL3UT3RPWxNs298r3OCDIjG3gE9ow+8xA+:hrL3UDR+ft983Dl3gEe8xA+
TLSH
T1B8250114FB9800F5E97BC17CC9A29512E272B84D1764E7EF03A48A651F237E64E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 6ae961f12988668743a52e5b3381304e0969b0dc59f974dee4765cdf74f198fa
MD5 e1965bf71012d83ee761c1b00ccb85cf
SHA1 d7792e1d781b0766a83c692c8538c47fcea89154
SHA512 a26a3ca56915fc7b4434518b9d83ff7d33d7edef96f21fc5123499d09c29aba5fc29671b758d23f48790129e79c8e75177e2f3326bb640ca5e9191c00dc6dd03
SSDEEP 12288:ypFtYOjRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:hOjRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T1BCE412193ADC20D1D53AA17C8A839249D372BC56176223EF41D081BE5F77FECAC35A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 842eb26ba45afbb38114773ce5f5e258c5d8850ee0bccd4a7f23fd343be4db20
MD5 496e0a0dc05a4df22febcd13ec91b078
SHA1 4debe6a7b4760fae7950890616a4d2ab7dd49715
SHA512 3094c79cf29df72ec19ce88ffa1a4ad16cc47dba3495da6d482363690a9ebedd025f565cd67842d1615ba2fde067a1970904f7415fec438adffc8b0c7798cf20
SSDEEP 24576:z7NM9YmZqmWMUkPjZM48Mv6bEhsYRPWxNs298r3OCDIjG3gE9ow+8xA+:z7cBWMpPjN8DbEhVR+ft983Dl3gEe8xF
TLSH
T12D65AE2E6BAC81D5D577D13DC9E28206F2B2B4611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 80cf13f00ad07ac983ac0ef039cfd5631fb6e4da245dbc9152966dd0be8f066a
MD5 2e137e63bc209e019a7bb2856e7bf0a7
SHA1 3c88a15dac8cb3efaa616ea4157574d386a52d9a
SHA512 bfdbe875678d1e8f50f0ce99cf194c59a2adbe9f2c8579490d437274fa0ef196a22b406b42cfa5be5406af32b47ea4dab6aa64d83804cdf87ead5efe87bfa9ef
SSDEEP 49152:aF2YuHNETovcvNYf8km4R+ft983Dl3gEe8xA+:T6tCf8kjR+l9EDl3VxA+
TLSH
T17A858E2927ED80A4E0BBD2BD45B6D246FAB2B8511B3056CF4255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\SgrmBroker.exe
Size 1.6MB
SHA256 98dff0bd49e310453e3139f0beb2c72a4e99ca8fb22a4bf6be24afd327b0a525
MD5 983b60733ac683900a2bb77e566a4e0c
SHA1 ea55a626ee7cb8b08ed4303d39cd42c5a5fe5b2d
SHA512 796804e7bffe0f46719000c7387c268bdb94a151e68b7ead0eb25bb17ef1b24563815bdf9accb8030e3c9e64bc68b75291e4572fedf2ca703e0365d488c61d89
SSDEEP 49152:10K+GmSLSR+ft983Dl3gEe8xA+VpbHNvPZumqUIWPLXFKo:rCR+l9EDl3VxA+zumqU1LVKo
TLSH
T1C675123DAB5E14E1E43BC1BCDA43C906F67234660362A6D705A0C17A6F9BFD83939B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 29552114785cac3de16913936a380ccafdfd71edd6f7b34ea07d2bfcc089b503
MD5 70d4a6c354685af6f0b4e33b09bf69ff
SHA1 d94b94d8346a73e317c5a1d1068c022dfa513c0a
SHA512 32c9dac1fa958e82be89797b84c37aff7f41ed6086f29e7200557fdda9fc430529a39a520b4ccd8e3be2686e78dddcc566a8ca8f2bf5cccb9604aec22263298d
SSDEEP 24576:SAFs06+OmlfQNXEbTo/RPWxNs298r3OCDIjG3gE9ow+8xA+:LFs060lcXuKR+ft983Dl3gEe8xA+
TLSH
T1D365BF2F66AC00D5D07ED17D8A97C91AF2B1746707256ACB0160C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 ab83ffbcad750b35aeaee41550708d8e1ffa2e69d0f98e08a3a33a271e669202
MD5 eb9692847fe50108f975cec9f6438295
SHA1 e13c867ad42204f16d5ca6838f2b2d09ffdd6132
SHA512 72a1bba2c782c84cdf088d44319b312b053bd32834826a8fb8249faf53ad460d999d87214dd5165bbf2899bfcaa6f46e21adc3cbe92a75f235e99182f0b36e24
SSDEEP 24576:kJnJ5D3WtKRPWxNs298r3OCDIjG3gE9ow+8xA+:kJnJ5DGtKR+ft983Dl3gEe8xA+
TLSH
T15515E12DD29810E4D4B7C2B4819A2796FF72382D2F226AC768B4D5353F12FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 df7b59bfca6fa4e7a3f6944e1ed9147f9cc7009df6cc0b5d3677079527b9b05e
MD5 56bf07cb168a62d304f695fefcc70cd0
SHA1 eae88048c394105b2cefe0d07e9f4c26cceadbe0
SHA512 60a7f9e5753e3f7d51f1b7fb62cfcedf7ab078c893f649c1408adaa196b8690790c43929672f436827eda765a2ef528fe04b29e64e4cd5f073ea33dd4e92d2f5
SSDEEP 49152:no06DIKdwc+eQnSt65aV8R+ft983Dl3gEe8xA+:o+R+l9EDl3VxA+
TLSH
T136955C15BBEA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 854KB
SHA256 5437b2e030b639197afd4fcae45a7f47b1f970d7498d50a0e18ad885ae8f3f31
MD5 da1ea0ea78e25eab535c05bac81af85f
SHA1 cb4f12819434104a741f6238adfc8eb6300a58af
SHA512 93711ee5d621b0ef64bcb516e6f3a491932dab8885a311047d8f4b4b40d1d35a0e5100ffde0af5ce2a96bfe6d43ffb185ec7065d2b02eb31aabf726abe615c2f
SSDEEP 24576:0isyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:0isbHNvPZumqUIWPLXFKo
TLSH
T1FE15122C6F9EB1E5E035A07D8952CA45D3B2B0741BD293DF11B0427E8F67AE91C38A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 bedf4d7ed52a2211de2a09f083f15ee42d8b8fd8bb27aa3e52c7ba241e45f9fd
MD5 fd5e231e563099d6a3e582df3c62b3ae
SHA1 50884f75cb043646a265295742468c6af1d22f26
SHA512 23b62b1a26b1b19568056dc64e8bfd844b01d87a2c8990ac5a028030f5a79601ef99cd8e61b72b9b7ddb84bca304a8c71f33d9f61d425729be58eb364f471def
SSDEEP 12288:zjkyFRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:zIyFRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T130F41204278C60C1DA7F42B89A9391E19631BC156F7163EF9090E63E6F377D9AD30B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 c82d8fbcff4ffa66532f11d55867695439fe6771754cf512751f04058bf1ca84
MD5 401aafbec341fde2dd8e4e361faea531
SHA1 7feb4dacb7849467700b406f562ea187eeb6d765
SHA512 c3250f1a452143ebcc5bfc00062ffa53c002f0666d10273ae4880cb1712d416c59806566ab62f12e34f28a078f8685a07b51af305d9d6b9d835dccff628b7785
SSDEEP 12288:aFzRPWX4GNscdB921r4JWJACmwrhSHVswKb3foE9A9T5piKw+9axA+:YzRPWxNs298r3OCDIjG3gE9ow+8xA+
TLSH
T170D423082C4D34C2DA2F81F94A46A1E1A0327D0E3BF535F7D4A1D571DF7A2CEA5B0966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 1a08e51ac4dc33b50f636040fdc71f35be3d7eac3e0b033696a4bf691bdf8ee3
MD5 1486ebac4cb204535bc6d2ffaf5a8982
SHA1 6da958c6d7fa1d4a36afbc3bbba35d4304320add
SHA512 1a621f0321478b8cdff283d8d913c081d89fe18aba97b3fa2be9e54c82670a05b4e9a9126b41723ca06240832cc6beb92a0fe59f56e3569c7eea8965e656e153
SSDEEP 24576:IQ9MxZKdcz97w3gRPWxNs298r3OCDIjG3gE9ow+8xA+:IVKXgR+ft983Dl3gEe8xA+
TLSH
T1AD558C2DABE9058AE177D27995A250C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 60b2051dde656fe23c7cfe6992f976ae9aa0113de544b4b06017eb68a60fadbf
MD5 fa16d94f8af6d8a66712d368ccd9e291
SHA1 3bc0a394d6ee6ccf2cae8a832a472335f51cb703
SHA512 cf791a9c6a8d9f9e76ccc67929480354583b9cec80ac9ea58061cc35fad41d8c281611645d1fea12ee973b0deeed46350042cbeb08ef6d803b448f09f5af2d56
SSDEEP 24576:GyocxApxRPWxNs298r3OCDIjG3gE9ow+8xA+:bocxApxR+ft983Dl3gEe8xA+
TLSH
T132F4E01F7B6D40E2E136813C89858245E773B4342B6263DBA591C33D8E27AEDBD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a0bbaaea7183e5efb1c75d52997a0a8bce09c7b86e801a116c89a065333d64f2
MD5 4f0c8798f8e1a853dd9bc0ee55cadfec
SHA1 77ad593895ceb3d01955668f4f1854d879e751a9
SHA512 49cd540035378a79509d6b6c9424743828a414e212b104bfc747cd8564f923873efdab380ec863f6a0633e9d59f0c86d4ef8e50df4c5afc4042431fc2e5ad88c
SSDEEP 49152:rWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKxR+ft983Dl3gEe8xA+:b0zuNIdR+l9EDl3VxA+
TLSH
T18EA57C3DA2EC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 38d224bd62f92ed489499ecc424e3680f32f6898631931d323ad1fc26288e962
MD5 6a2d292387ae76577d9483aebba583f1
SHA1 94e9de9a8e9ba4a42a25cc6d54d585ea9188d8b5
SHA512 c4162670f58fc1fe18f93653a2ad177eba85a00d062b97195435373e9d5ae135d6137f28480866db7de473d21c8796440387f9357f49dbe42d0a97855a3deec1
SSDEEP 49152:Ma0h2GEkuAe73q3ppj6zwwQqR+ft983Dl3gEe8xA+ubHNvPZumqUIWPLXFKo:Ma0hNYGjJwJR+l9EDl3VxA+qumqU1LVZ
TLSH
T1E7C5D01D67EC82B1D0BAD278C9A6854BE6B2B4260B3156CF1150853D7F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 746ee815fcd5149455203a87564a6b7b70d31bb1fc04ba049c8f97ba6cddc188
MD5 65c8a3642762cbd3a0003c3b33657d0f
SHA1 972d8ac83e8a48d37d28467368d35d3d9c11b1e1
SHA512 028f0163583aaf8dec4fc40de66bb105442bbc00a9fa966cd40a16ca5e1acaa4cca6a696e765d65518eacd7d70149275eaefe3331ee18b26b3fcfcb01a91c08b
SSDEEP 24576:A1QT7EcpfxR+N5AWAz3ooiYhjMqbfyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:9TDxR+N5YzTTjMobHNvPZumqUIWPLXFZ
TLSH
T11875C12EA7F955E9D1BE85798A23C502FB727421073193CB42A0C17E0F6B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 853KB
SHA256 53c2749a0b2195b4f554723637a76b22c7dc8f281c4e5bb7ad88432f74ca73b9
MD5 41c758c44265a59f7c894689fba63e32
SHA1 0fd37eb2b8cf8204ea6dc5c394910145aa303cce
SHA512 05f200fc6497c559346853dc9149d35decb7dc329d37b9164d8219d2c5aaaf3979c0be5f5991d174278241f45a4c3aaaefaf119e7965d8391d10847efe32a310
SSDEEP 24576:2hbHjP8yh1cHNfXPn13umqUIITPLXv9K+4ecw8+:2hbHjkbHNvPZumqUIWPLXFKo
TLSH
T1BA05123C5EAE22D9F070E5BD8E528A4AD37174291B91D3DF12A0027A4F27AD90C35FD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.4MB
SHA256 142ea95ad6fc28d665c6b3202dfd6b62aa0b324ee40bb05f4cbd1168d7f0f624
MD5 9cb3f11a3843c554752c75b43d62cbc8
SHA1 f2cebeb28218c593b96d44c39e072c56d343f49b
SHA512 b955c1886f137f4201761211efacba293ffbcc001baf44f7dc259db85a8f89084c1fac3ee66db2c278eb0e6aed7fcbb494678500f0c6e45c28bef7b0169352da
SSDEEP 24576:YuYgnJcRTk4yti+R5dUR/Hyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:YFgnaTk46pUR/HbHNvPZumqUIWPLXFKo
TLSH
T1E765C02DF6B910B9D8A6D136450147B5FB71782D1F209ACB0170C638AF0AEE85E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 1388e805d40154775d090b65b7a283927641e898c1876bc4e7bb4e1e2ab714b2
MD5 221fbc88ace84eb7bf2339eef7206779
SHA1 49f7faa1a2c2271bb3ccd4a48c28bcf1b12a00f0
SHA512 b2978f4b342352ab2dfcfaa90842630b642290c20bd27cc08392dba4e0fbbe1bb76d6c46622cdb1f9f2a00ca015de5ab27c0278921232183b6e5581c49cc5919
SSDEEP 24576:/3RPWxNs298r3OCDIjG3gE9ow+8xA+iyh1cHNfXPn13umqUIITPLXv9K+4ecw8+:/3R+ft983Dl3gEe8xA+ibHNvPZumqUIW
TLSH
T1316523182ECE35C1F436A5B9CE16C691D331381A2BE152FF24B089768F766CD58347AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/32-124-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/32-118-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/32-109-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/32-116-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/32-125-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/32-117-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/656-150-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/656-156-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/656-159-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/656-273-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/936-127-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/936-245-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/936-134-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/936-128-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1712-7-0x00000000024C0000-0x0000000002545000-memory.dmp

Download

memory/1712-71-0x00000000030B0000-0x0000000003117000-memory.dmp

Download

memory/1712-115-0x0000000000400000-0x0000000000836000-memory.dmp

Download

memory/1712-13-0x00000000030B0000-0x0000000003117000-memory.dmp

Download

memory/1712-582-0x0000000000400000-0x0000000000836000-memory.dmp

Download

memory/1712-6-0x0000000000400000-0x0000000000836000-memory.dmp

Download

memory/1712-0-0x00000000024C0000-0x0000000002545000-memory.dmp

Download

memory/1844-201-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1844-475-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1844-197-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2132-148-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2132-145-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2132-261-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2132-139-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2284-232-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2284-235-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2284-558-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2716-565-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2716-258-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2716-262-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2844-298-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2844-623-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2844-288-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2844-294-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3260-107-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3260-200-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3260-106-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3260-97-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3296-165-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3296-285-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3364-566-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3364-270-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3364-274-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3508-93-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3508-84-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3508-176-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3508-94-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3628-772-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3628-705-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3784-345-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/3784-307-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3784-656-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3784-575-0x000000000D1A0000-0x000000000D1A8000-memory.dmp

Download

memory/3784-401-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/3784-329-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/3784-310-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3892-224-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3892-541-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3892-215-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3892-221-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4260-286-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4260-276-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4260-282-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/4260-571-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4416-562-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4416-179-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4416-180-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4416-186-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4416-564-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4416-309-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4428-248-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/4428-250-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4428-243-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/4428-237-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/4428-246-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4640-526-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4640-211-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4640-209-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4748-177-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4748-167-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4748-173-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4748-297-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4900-647-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-630-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-643-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-642-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-641-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-640-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-638-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-637-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-636-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-635-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-645-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-634-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-633-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-632-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-631-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-644-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-628-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-627-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-626-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-625-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-624-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-646-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-648-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-649-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-651-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-650-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-639-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/4900-629-0x0000021624FB0000-0x0000021624FC0000-memory.dmp

Download

memory/5568-761-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/5568-770-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/5876-741-0x0000000140000000-0x0000000140167000-memory.dmp

Download