ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
Size 2.3MB
Sample261014-h55nnshw21
SHA256 ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e
MD5 9bdfebeb6a2aa57c46b0eb3788424b05
SHA1 c4b7a9f2a90f46fdd1df920d0d81e45277970c4c
SHA512 b00bb5d612f082151f1e1719e882cab426b8f46c6a31259fd3d49f1d2b2ddfcc6cabdafe1c5e0cbc07f1274aef9fa2c3ad689d5b914c913aff1c6e1aff1924db
SSDEEP 49152:wiGL3i9XR774Bc2cSOHYP1N9tqZUXVRELNiXicJFFRGNzj3:wiZ9XFicFS5P1XtMCVRE7wRGpj3
TLSH
T126B5236132C88032F1F2593119F0A6713AADFD725F669ADF23443E4D4A34AD2C63976B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1612	alg.exe
4956	DiagnosticsHub.StandardCollector.Service.exe
4992	fxssvc.exe
3332	elevation_service.exe
5700	elevation_service.exe
3232	maintenanceservice.exe
1844	msdtc.exe
2536	OSE.EXE
3228	PerceptionSimulationService.exe
5540	perfhost.exe
720	locator.exe
4244	SensorDataService.exe
1104	snmptrap.exe
4012	spectrum.exe
2504	ssh-agent.exe
4376	TieringEngineService.exe
3196	AgentService.exe
5192	vds.exe
3036	vssvc.exe
3492	wbengine.exe
3496	WmiApSrv.exe
5720	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\locator.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5e9385dc4bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\System32\msdtc.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\System32\vds.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\spectrum.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\vssvc.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EU9AF3.tmp\NOTICE.TXT	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9AF3.tmp\MicrosoftEdgeUpdateBroker.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9AF3.tmp\msedgeupdateres_de.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9AF3.tmp\msedgeupdateres_th.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9AF3.tmp\CopilotUpdate.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9AF3.tmp\msedgeupdateres_uk.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9AF3.tmp\msedgeupdateres_hi.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9AF3.tmp\msedgeupdateres_iw.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9AF3.tmp\msedgeupdateres_ko.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9AF3.tmp\msedgeupdateres_lt.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaws.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9AF3.tmp\msedgeupdateres_fil.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU9AF3.tmp\msedgeupdateres_ca.dll	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d63c582ac5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e8ce880ac5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088ff3b81ac5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020377581ac5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4956	DiagnosticsHub.StandardCollector.Service.exe
4956	DiagnosticsHub.StandardCollector.Service.exe
4956	DiagnosticsHub.StandardCollector.Service.exe
4956	DiagnosticsHub.StandardCollector.Service.exe
4956	DiagnosticsHub.StandardCollector.Service.exe
4956	DiagnosticsHub.StandardCollector.Service.exe
4956	DiagnosticsHub.StandardCollector.Service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe
3332	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3852	ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
Token: SeAuditPrivilege	4992	fxssvc.exe
Token: SeRestorePrivilege	4376	TieringEngineService.exe
Token: SeManageVolumePrivilege	4376	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3196	AgentService.exe
Token: SeBackupPrivilege	3036	vssvc.exe
Token: SeRestorePrivilege	3036	vssvc.exe
Token: SeAuditPrivilege	3036	vssvc.exe
Token: SeBackupPrivilege	3492	wbengine.exe
Token: SeRestorePrivilege	3492	wbengine.exe
Token: SeSecurityPrivilege	3492	wbengine.exe
Token: 33	5720	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5720	SearchIndexer.exe
Token: SeDebugPrivilege	4956	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3332	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5720 wrote to memory of 3480	5720	SearchIndexer.exe	110
PID 5720 wrote to memory of 3296	5720	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe
"C:\Users\Admin\AppData\Local\Temp\ba1fe15e2cedb42f6bcdfe1de2058e7e297b4b34c14304e8dbe18d605448118e.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1612

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1112

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5700

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3232

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1844

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2536

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3228

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5540

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:720

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4244

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1104

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4012

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2504

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2288

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5192

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3496

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3480
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 db957714963cb72a726166cff189c03048d6f059ee1d60aa80139570bb3a355b
MD5 c054ff57f0c5e1d74bf2a1cfb8942945
SHA1 eb50059445e02d2cbffc00f172e61ff245ed1350
SHA512 ce8ca946d6fa002a40d61f28f11b1fdc7e0f09ac251ac60a6b735fc6580d6b9c2c164b731c726a6a1cd8a05e493bf304046a100346a5a5358ab49cb150f11b29
SSDEEP 49152:Ab+632BuPkFKRrdE6ohdstBhuXjfS4LWxn4LNiXicJFFRGNzj3:q3q6mjBD7wRGpj3
TLSH
T1C8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 59ad34c5734210ade3e2dc806f207c4e7b22cb5ac429216192564694d4eeb0dc
MD5 09f12ad87392cc1d54d2fdb9371d3f60
SHA1 083eebbfa71cc9c1b1d0ba00dc373aa617be8215
SHA512 506fdc306948eec6fa367821ec0c35b6d4b9f9374a497b37cf71ec9b13993cf3039d76ea0ab7ab9a381f7b359c670c8f45809e9a77357d995cd79d3831159295
SSDEEP 24576:MXYfDtczAH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rtc6LNiXicJFFRGNzj3
TLSH
T10275012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 e091f115eeda3578337d5ad0eba0f506ee1dc70c21eae752421e4a3c3a7e39f4
MD5 c8a285adc852cad27f99c4ee91b170ae
SHA1 348f88a41d8cb63e229ad148180318775e6c372b
SHA512 30a970973a23c981c58e2b8af9de74a88205df0006e4e64b6827be7c1982b2bf179226fd1ec102120204caca0f10d051877bf09816389c0852fc75e93f6fdcc1
SSDEEP 24576:m0Le5ji0hmxhrMQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mPji0AzdLNiXicJFFRGNzj3
TLSH
T1AD859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6f27f057a2fe074dad45a67b0daf385fffa6ff4b740fee840097bae08b525b6d
MD5 e79f864e1ca5600eeca90b9d5961ba50
SHA1 68511aec49a11fec89d30afb6b6a0858b21968c2
SHA512 02d6d57e35496cd72cfe66927f55159da13f75cb0214220f839933b8af1996d0572c5969c9f573ff3487b6dc642c8c39479b09948cd23405fc59703c4152f22d
SSDEEP 24576:qa7/ezSC6vUyD/aqgrvWj6q8wyuq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:d/ezSC6vUzPv+HjyhLNiXicJFFRGNzj3
TLSH
T10F756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f73b21d4b6a037674862651df8e81d733e96f69402169d125a532d79ccdea292
MD5 e983386c694829f9a23e9391cf373e94
SHA1 c8a2090f51d4d2cc8f8d4973fb5de5ba8b1b3915
SHA512 2213b35cdf0a33cb0bf8d7f954ab56296bc87c8f8dc8efd61b120f157fd96384ff85a23789d40577dbe1768fee2149c1022bcd8a999404aec6baf6a12e7b93a2
SSDEEP 24576:FVbqPb88hv/l+Bz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FVO88hXl+9LNiXicJFFRGNzj3
TLSH
T120559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 da328ca4fa38c4d054257fa76700c3a9e01b7358cc1e5f6a5ca93080a6ef10dc
MD5 a1313705f0ea2974ebd09e0757813945
SHA1 fd36124e3441e955ff20394b84c7cff4e6d86db6
SHA512 4851e6618a006d8422d12d900e955532e453a01271585678f8f0ef0d830b2bfe89a1267285f873136a255a7f455e7b5b41f5422c68294efbfe83434081d146de
SSDEEP 24576:5Gc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/LNiXicJFFRGNzj3
TLSH
T1E15523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 37c53a9c76695e2aa862c5a8d7f6d83beaafa2f692c11b1f296651a13aa8b246
MD5 990119f763662d2e38657dc2efdce64e
SHA1 88d27a6ea49bb674a235cf276fcf443816bd8d4d
SHA512 3b01664458f2103535ccf2d6525fb721565be90d2538d4b2acbfbcbd916d791bf9ee8122eb41828e81e15e7907bc2c3c73fe494ffa87e7144efa2460ea2bf0ae
SSDEEP 24576:3JIUr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3JIUrLNiXicJFFRGNzj3
TLSH
T1A875CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3326e3a725f3a066bfbf4043affc7ff54ba324b344f5a8665299d17095eeca53
MD5 847a1d5cb11365b2c0547d0374e0a602
SHA1 db1f7b347788ec12270fe214de652f40f89aed0d
SHA512 7ac577505ccfab9b45dca4675fe968d3c377001d7bd04f8f8750125735a5a8cfc758df0d82dbc21035577ab046781faf6a8fa3c1f80326d521e268cf7b2a9fcc
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THP:3QvGAdlCEL8c/WRNw5Ca7wRGpj3
TLSH
T186266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 aa02486815b230da905f59eedb9f0046fe027291f4c4bd5f5d977e26df1ff875
MD5 11689c0f5f2c98f4a488b08b29c18b12
SHA1 aa96c9c891fa8483aa29eaf6c844323a44c21b01
SHA512 2d29e4bf0ed5b752ca2ed61571cdf5afdd36bd59404b4786d85fff60af61791a432fbf8d88a0b2fbdf6310a1b96bab6f528b2d425ecd30f3a27687ea277df463
SSDEEP 24576:sfewsAjN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OljNLNiXicJFFRGNzj3
TLSH
T1DA75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b2e8c040a2ee4717d246b8a00d1d4deb5d2621738b934a617e32f89c079ac280
MD5 0fb76d9e75103562980317d468be0dcb
SHA1 d0dd85e45487a7799bc4fc61a14ef9879155f1c8
SHA512 814d9154cf55017f95b71cb3698b1ef6e4f438ee9e1053e1d7449a7318086945dcef89538925d29b9aa1fccb0d613167bb1be8b1deae58fe2c509b46b295215d
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHpF9:pUEtQevvqc2W1cpV20I32v9
TLSH
T1E4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 54ee18d2d190aa2bd6bc024480d7cf6ad85e43bf9d2bd825c04f5e62e245b11a
MD5 45a1202d9708a9df93646f63366007bd
SHA1 766d12bb4a42a6e74bc72d77718ba6b0b3c929ef
SHA512 9d0a528cfc85195ad7a1d550514ca45f80fe0697c471baaaacb8a0e955beb4334f675624f831c22a4018531266ce4f55780b76b5efc0a624576cf4d5d505afb5
SSDEEP 49152:5CbRquA/m2yL5zLfFiV+XenmE3/ztLNiXicJFFRGNzj3:Woq2VjnmO7wRGpj3
TLSH
T1CAD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9910b31670b5b887248c895f5502fb5aebd50bb2573dd925a271a7e1943bd402
MD5 f6b78b828230521f5cbf76c2db2ceb59
SHA1 2919d17bf6676c251fa4319e474e5518dd640406
SHA512 36c753c9cc16ad315e5a132bf7099f1345a98de5e78c7a22aa5d2f341bddd696eb12b9ab69838958951508031eead4f5f200248f6b5ff7d0de4bd43e064390dd
SSDEEP 24576:iAhGL6IFoiwtA5l7S53u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iAM5Foiq5+LNiXicJFFRGNzj3
TLSH
T19B359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 30ea0269256fa1504e7a8364687a65632a23aa82dfbef8f484a23faa11222374
MD5 a6468c103c901cc0b9c942a56ab9084c
SHA1 fbd347fe5683b09e69eb23b341860491290b0c9b
SHA512 11460f758cdec23ea422a97af6f0a3e8f3fd2a96db91df8aec905cd0fe67cdb89800d457075d5406e781e7640a1b43e660eb47187fbb44c9f42b834014c7d5ab
SSDEEP 24576:PwuROWB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PwSOCLNiXicJFFRGNzj3
TLSH
T17465F18632940CF9EABA41398657C035F7F2BC152A25DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 cc2d2dece11468aa52ddeec2ed5a0dcafffa8a3a5ef90bb2dca783ece59febc4
MD5 dcfb2c909ef21584f6d6487db3a589ce
SHA1 62c8cc687801544afa1d3eaa5dc7ea4bd2173e8a
SHA512 34c2cd8abe99acdb038851404823aba595d15a5a4d17fbb8fa58c457932b0cf176df3e2d9b2a458f61e6b19957019f1dbb760e81d7af0ddadbd39e1c4b890f3b
SSDEEP 24576:kZuo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eLNiXicJFFRGNzj3
TLSH
T1AC55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7b71bea8589e858056c8bf837f44d6ea3eaa40bc6e3535b3d1b5a3265c5f59ef
MD5 a9a7834beff51f6ef84b202751973272
SHA1 2fbcfcf66b2776328273643fa4bd4ac851b93d47
SHA512 ebb26221ff4b33285b231af5242439c7b858ba00c1cc76152396cdc1776df27e08296cb6c4d75d6b69359f0247ee52a6d9966b1f663af9a6bf7f76803f5aaf1d
SSDEEP 98304:rQRQyi36YOcPDLvw2gAf+PN3/7wRGpj3:aQyiKanX+PNTF9
TLSH
T15E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d50619c705ede023ae461eab31a1de10200e8376fad133ba3edf85759e7436e3
MD5 ef491930e3d1408e1b3870fb4e10c30b
SHA1 80f80a847f70ba8aa7ca4cc16f90d7b8e6243929
SHA512 6c2e1b3e40233f12549389434783ab020754f2ebd832d1f797e406fe097973d9a6716b2a5ad0b97330d559c63c508999d30aa32e4e6e7fa398cc2f1074c4bc81
SSDEEP 98304:+QRQyi36YOcPDLvw2gAf+PN3/7wRGpj3:lQyiKanX+PNTF9
TLSH
T1DF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5c0d69ecc219fa9df0b4faca2eb566797e8513cc6919ca71921d0813689fa216
MD5 160f2eaf1e863f9ec223da23fd7505df
SHA1 dc2026d4f53a866d65d4f35fa6ae6e8821bc51b4
SHA512 2da7aed50fcd2b3193dfba5b64587e4fd2d5c1b657268f5a15b3579873ac972a3902bab5b6dc50984f7e4a4233ba05cc45dff520f4ccd95dfeb458e91e46097b
SSDEEP 49152:U68Qg55nhkeWu7PNU3/dLNiXicJFFRGNzj3:+thTRc/d7wRGpj3
TLSH
T179B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 66464df634a1e49b415cb75295b692040dd6b5836072825ce6ac35bc901229d6
MD5 57ba71219f1facc14258531bf818c404
SHA1 f3063339ca2c275118a4358d580442c3e5f42b1c
SHA512 4871bf1f82818aa36ae71eba203d61523ffdf27020a3d8171f3588c71d6ef49e7a02cd21444c94399086e493f4ee2df0d55eb1fd60c5acfb30640270f318dcaf
SSDEEP 98304:fy5112gYy5azzVvU69nLKnhZc7wRGpj3:SLIHRWh6F9
TLSH
T122167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b367650f16e5ad766f9b028a99d8c374359e1f981e8231f8e2c0fbf15a92f601
MD5 63437e7b8b5377b0106db0e65d6b8f57
SHA1 8048771bf0041a3be1183f2dab75b7d7031d03f8
SHA512 b83304ce08febe5a5c723e7e64ca7a8da521890dae077a95ea85dea20e2f1268ac9317e5716221b8acb017b4d127431e05ccbedb8ec9f88f0dad7fed81c99328
SSDEEP 49152:MB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glXLNiXicJFFRGNzj3:Gu6JmIxd2dX7wRGpj3
TLSH
T178D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 43a079d202c924f2d7a6cca5532d03c4e48b7e94fd11d6616e54993860762f8e
MD5 d36978b3bb3a107e2bb90ae07f177119
SHA1 0b9e0189b5c31754e35d4804a8730336e55dbdb2
SHA512 622648c15557645d590f98d8e3e6d226f3d65936386d031d275e16df24353292940bf27881778c4dd889af3bd76a2edcc9c78f7497f45cba84ea9c6b348c04dd
SSDEEP 49152:r1hpsNoJpF1A67U44CwH7R4xLLNiXicJFFRGNzj3:rmifPqRO7wRGpj3
TLSH
T1E2B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6e84e3d7102882fca854f14f483a11740e2c05163b25a05dad4047b3ba2c7606
MD5 c56907aaae778a2d5934cc0920962953
SHA1 db7bf6fea5769408b37adaea58103054e9ea7f94
SHA512 ba79babbcd5eef386193123ffe96940da3f3dd93d3e3a3cba512ad9dc4848d5a18785482e228c584ab9d0b0d937a1616bd463f05e62519ce58bb066b23cd62d0
SSDEEP 49152:QSuZQIY0Be2KkRVtOnks6NMHqoLNiXicJFFRGNzj3:K5dKqi61o7wRGpj3
TLSH
T101C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 43541c23c8d7c3b74cb6a1efd348ac65bf065fd4a6bb9edbe927151fb6342178
MD5 b65d8c9a2ded8f64e8daa5ac2463360c
SHA1 0ef408d73c10898344bb233a0607acf4eaf521ce
SHA512 1a20777a3cd9d51aac22c4d13f8da10fc5a9b48519dd85a5c1d767f06b3da7af1cb4249d498729ff71d68e5c923c218bc188bd0a7b314168a4254dad512eedef
SSDEEP 49152:1htSn8EApI0figjgiDn0AP5wHLNiXicJFFRGNzj3:EX2iWphi7wRGpj3
TLSH
T15995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9e3d0d9a04917dfce66b116061ecef547fedc89fe09d7aac251d51fa19d3f6ad
MD5 eea87391f55fe0c07d41fbddd3d91d2d
SHA1 34e1322e7f3ccb33f60fdf642bf8f0918c3b3d91
SHA512 0ad7c0a9ede6b5e0168d8629b1ea2912c381d3a8ba71e2e3814f44997a8460cd4b82c04cf576923f0de3cf314248caab21f7edd9693c26659b3ccf399771e647
SSDEEP 12288:yyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1105523D3558955B1FBFC0039C6754428F5882E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0327c66825fb28d2243ec64030031419bb0b30ddfd145187f29d30912633c6d5
MD5 9389b81ab7cb02566e3adfbe0225f140
SHA1 0775a14e1fe5c479505ed4867fd4c7d8c28d53bd
SHA512 75bf71a8aafaea30d99ceaefe3643d1adb195eed1f15db60a9dfe591dab7b4a61df67af9e087735423903620e7bec0acbfd78e8e292ba8d785b4fc214614e470
SSDEEP 12288:yFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1875523D3558955B1EBBC0039C6754428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4774e7dbc75db78fdc3deec74675c3805dbea1544f5325475e21eaaa4640b443
MD5 1e37d3a2d2c5a5c215f382cf7704f128
SHA1 2952b98e17cf5480db5569fd7e0742d9f729569b
SHA512 0a5e1954ba7e69436bd050e0ec38653ca399a4ca5f7c97efd71e250c6a9062d7da88fa0486f32f0d0fc3aba12ab919d21f872e073e6bbcf7d091e59826f03592
SSDEEP 12288:N3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ND/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10E5523D3558955B1E6FC003AC6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 339234c0e9b5f01a69730696e6e809ee0304f265156c0d65e1a0d009d52ed93b
MD5 3d5299f37d6ea167acfb8955173d486d
SHA1 095bc2d5d1af88c0d74bc6ca115677228b5b84a5
SHA512 f545a9039e7affb8c6ca1a65a0f440d24c9904725dad56c4a13e024ce0ee40c6fe21434961b1541efad89f0723732aba673b302340704b3cf106a864532d7f1a
SSDEEP 12288:dVEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12A552392168900E1EAFD803DC6764424F2A47D6CD7365AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f91be811179fa111c72162e405c5e599862b713df88a19b781e32eb67c500558
MD5 8534f4fdaf8bcb5b61388e9c4a384257
SHA1 64586a7bbacd3a5ed176670c83df473feeb2e643
SHA512 6364e9ab8f3f0f461505473c31c8bea91537776bd120f9288afbf2251d67c35b567622e412ab6d937ae1ee4e70dca36bd8d4b3ca50f4fa8c95eb62c6c0d3cbfe
SSDEEP 12288:psiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1225523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cf6668e06924089db4c1d89b7eceb8e66f5e8a5a08b39bf0880b9055aa36fb00
MD5 9ad66bcd6caa9f2fdf7833702d653e23
SHA1 80f5a94a04e62beecd1a6a63dcc57eed7c4995dd
SHA512 c6bd4004d62fbfe75a2a7821e09d1ec91ee88d25b77f5ebe3a11aa5736ef7258ef2895801e3692724201c6ec4b918b20847ca1dd584962d207d771e56e463da1
SSDEEP 12288:rZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1ED5523D3558955B1EBBC0039C6754428F5882E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1133e7f1e4d76dc7510180b06de124ddc5ad0343aa277e568ae01f908c54387d
MD5 1604d47e3eab921931f96bdf33aeb7de
SHA1 12e423ad0dd957ef52fb6ac9516f046211bdf4e3
SHA512 d463745fe659d2c91d5b2f231f3e6d843c4258c77067c1c479367f17a006b28c50717da89295c52354c0333f67f116ab87beec1b5d9ff9e56c6374cdd9cb05c6
SSDEEP 12288:WNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:WR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1685523D3558955B1EBBC003986354428F5882E2DEB5659E3E3083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 8d1677cada056949bbf3c477b73789c3ace117bfe1b1e04846486645dd34a0a0
MD5 a09e12d8e9214127aa5b30dde8236b39
SHA1 e54378eada14caeb32347f8a7f1ebe0aa24a16f2
SHA512 bda7654c4e09de089c87ac1818d0aebda91fe28ee760e23fd46131c9e643d50190a78ed82ce462a997a404cbc487f51c1f5a0b6ef6cfa0a32d063c60608885c2
SSDEEP 24576:mZM3zFVSOp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mZM3zf1LNiXicJFFRGNzj3
TLSH
T183750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1c761d8053c1ec686500bee7ce3d8ec9914a1df4fba720a9886af0f0099a16a2
MD5 900559b0042337b8fc91a63383df4416
SHA1 964f76fe08293d204f7e56e651d8e01a7f987cff
SHA512 37e5385302bb805be49f6a976e30e75ac82758e680a868a8f2405fb30e331d01b6a5839cc43cd753bd9109f1fbb5a227674ad0e8d75bc692d8b6658753a07c16
SSDEEP 12288:vuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1855523D3558955B1EBBC003DC6754428F5881E2DEB5618E3E2483D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 95fe8e68037e0bc0be89c01b6cf461467ea7843d3c1b68d7bcd7ae5625dcc9ba
MD5 3e2f247c74f1e95df1e29147bb492004
SHA1 fd83054d35af9dfd0f3de1968356e0bfcb5d39c1
SHA512 138cabd9ac3f3c50a51c086507100a413934c02634836a024ccb59a6f92d8074717a9adeae52903d8ff85f5a0d011bcde4a2f577d5d4a322c07ac942bddd8c72
SSDEEP 12288:tKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E65523D3558955B1EBBC003986754428F5882E2DEB5659E3E2083D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 22052deece1b6f139f6f468a15b7d93a33e3e80533e667c60d37faf5e8d84018
MD5 6eb732191e8c5de898e00d6bedefa32a
SHA1 19f4ce76a3644af9997814aa23637514a3575198
SHA512 a3492d65c9430df49bac1933aaaaec3d6c7de4611a1087d4af9a397b3ed7c56bd77b37c13f21ce785bf003f4f746a405b08a369d191aab5e7c2091b321a8fd6d
SSDEEP 24576:hzy9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hiLNiXicJFFRGNzj3
TLSH
T1EE650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7dd7dd3ff8a4f5b2d8e60ad4ca6460fda856888f97017c56154d0dc5b4f293a6
MD5 9a66083b92c7aae6fe00c49ba70cb0c8
SHA1 d383186eac517af9a6bad3ae9262bb3408c787cf
SHA512 d91c958cdb04b08b9cbecc8a7b8987c46e28dcd88aacbb6e8d8944b4647710b0215f4cf025e205f5ede746ac05165b7c24b255b01dad9ee02f363ca11e0c4811
SSDEEP 12288:9uiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1955523D3558955B1EBBC003DC6754428F5882E2DEB5618E3E2483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c3eee424300ba94953e4f5f10a4c2c65c964be1ad316a2fd61f3bef0511f5eec
MD5 2139becb4d4cde6ec35c5d3a5badac2f
SHA1 6e57bed9ba92c8d88ce432701520a17d0ee7fa5e
SHA512 a3bbb03bcb635f5c23b73d35b9444d28eda6b8bc6987a22833f8d2c26f1f0d3b77016895cd4f155bb940e12893979ac6bf3359cbed1c36559ff7db184a576967
SSDEEP 12288:3uiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1505523D3558955B1EBFC003986754428F5882E2DEB5619E3E2483D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 85e3307bcff310d7834094582042b2e5978e479b4b6812c8886b769cc191b619
MD5 ff7a9e7bc5062c47146f6794501a5dba
SHA1 cc7c1d718a21bc8577eeffb1e12ed0028d74caca
SHA512 0c3170947a9fd23d78e02fae93dad1b32c59440014e566f80dcf7b7096a62ac99bc5c6b6a9878a9d0870b5f405089ca8a473ce7b7d9229319e9bf9a8fb78bf17
SSDEEP 24576:yzy9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yiLNiXicJFFRGNzj3
TLSH
T1BC650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 5ff9fb7ced03684a22df78499766662aa92c95789c2ebb3201e746c66f34ee4b
MD5 ad5264ecc81f3ffb3135748a045356d8
SHA1 88a7ba1fe545e726191f4c7304d816c011232286
SHA512 0c1f46080f88d923dc43c5c9db41fd048e029d1b32c8a9553147a40d6a07a3f15c421c5ff80aefb35f064400abfcf3e6d0c6cc278bc2dcac51d3b36243a44ff0
SSDEEP 24576:HcP4mcvIjkGOxhKP2l71nNKbrh/8KBg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8P4m4IpOO67W8KaLNiXicJFFRGNzj3
TLSH
T16265AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a4c1f139000ba0a9d88e23076cbdd891f89e7b45cbd13feb4c0e813c0f28f3d6
MD5 1ca34410413d2de4a63e39d60f8520cd
SHA1 b341d42232ca0a1831976cd28d4cca04690e5879
SHA512 6bd525474162b5d97ab4e6bb8902ad48720c5a4017fb06836c2eb9a674b324487b957f798a8a048e644c277149a86d7fbf7a6ae9f76b7acca87f4002290233b2
SSDEEP 12288:7psfeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Mo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10165F15AD28802E8D1AE5139C7664900F3673C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0d3f865bf63dd450418f14e841832874da6660f7d64e4470498594b37cb99d7b
MD5 d81b843b3301ea0045ddac44d5ccaa25
SHA1 e0eb741d12c7ded5e49a8b0db792ef20fa41b719
SHA512 7c4537315df4bbae82d13d151b942fa033be147cf36e5886ec400ad9b769e41a898b4367e090d5a40b951bd1b1ecb0f78cff04629209aa4d569ec0357e73b679
SSDEEP 12288:L+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA552393928C55A2FAFD103985398438B54D7E2C9F5598D3E2043A5EA138FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 490520d79bfd5b0ad6500ad124c1a944e9b13acb24df3862b7c10f578103e241
MD5 4718e6b199d8ad17fb03d14a0c9f260b
SHA1 744b556b5ebef886c6d161494f1bc2b86b79c905
SHA512 e323d06d87b79b1ec51ad804d7773645fb8d2eff65fc42824b57ebeb4d37919e27c02aa9ade4b623786382b5d277840bf9d493df08805de61fc429b8a3bbe0a8
SSDEEP 49152:ma0h2GEkuAe73q3pp46zwwQWLNiXicJFFRGNzj3r:ma0hNYG4JwV7wRGpj3
TLSH
T1CB85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 d629bd73dbcd96e95692eacff4a7474ecbcb83c5cdf7ad643fb21296a414ce82
MD5 93e9e5708a35786e29e4502d68ba56e2
SHA1 66edc7421f4dcf56e6145e1b4a76b34a0d735f33
SHA512 c60fe850725036e965479bced76a6d3259627e231fb815f9f4686d62c4be070a31ec2e5ddab98a2427735b538fd0fba5cddbdc32d3c0c092951548760849e0f2
SSDEEP 24576:4hbHjPZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4hbHjRLNiXicJFFRGNzj3
TLSH
T1EA5512BE129C20E5F6B5903D85668409E370BC29172197EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0b3c2fb44bdf10b9104bfc56605a22da6102153ef6020f27500ef603ba890fce
MD5 a54fe185db46a4786df2e8b535144684
SHA1 d597b3dab18cc7c3180ee26e11b0d344451c0e17
SHA512 eec7ffe1731d2354318d337a0bab75427aa3b8e80ed44190dfc8eb409c7eecf1e7553ceff83141903685e9b548fe11bfa023fcb32bf315ece77946defa0e342c
SSDEEP 24576:63YgnJcRTk4yti+R5dBR/B/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6IgnaTk46pBR/BLNiXicJFFRGNzj3
TLSH
T19645B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 63467262c36042289bafd56ae6d332250052f43f99b20c783ae63214aa5a8944
MD5 d6531c37d7b9f3e6c94d8bc19e71a960
SHA1 a56a74ee6d551252eea7120ae7464083265fd1a2
SHA512 f056e23df3efbb31a770359b0ed18899eea04d88b866f9004b2e01c6c5864a1e7da6640b24d7af3e018d48b78643b9d133180a63daa7cab754df94181513f366
SSDEEP 12288:taiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1645523D2518955B1EAFD003D867A4428B5882F2C9B2619E3E1543D1EA27CFEFCF38563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 19d6836047171c14628800a38dfb6288954b9705eba6d7547f5886faa80689eb
MD5 5e01a067e37e34be8cfe98e35fe35463
SHA1 ba481f144a1bcce3a2a1cb82434101b3d7c3669f
SHA512 29b6dc63574661dd54fc70818777737739e78df1b7d60e6e32047acc8889958498a5f235c5ef5b3751adc4414884b9688f34a2219cbfb2d824fc597170081945
SSDEEP 24576:hAL3UTH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hAL3UrLNiXicJFFRGNzj3
TLSH
T19A750155E79400F5E97B813CC9728916E2B2785D0364E7DB03A84B6A1F237E68F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 e400e34d0dc0940bcdeffa8941e67ddb38210b20d301dda8242ca7e091b6f758
MD5 17baffa668782ec9cea87140bc93e39e
SHA1 54b7a033f1ab8462d8445188661306290e562965
SHA512 d3b0c3b77e4761933f74199d36b68cb7b100fbc61660d332d599f074b9f48de156571ede014abe96645ef5e41de0803c7a9565d734ce5410cd20421361a1cc4e
SSDEEP 24576:4OL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4OLLNiXicJFFRGNzj3
TLSH
T18755126A32DC10F4E579503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 70845623752dbaa8c2c2744a7c1ff60994e06e6b4506958a734d9d06438bda00
MD5 26c0dc82290a6335261bb851f4946f7b
SHA1 cd5d8c8da6d32ed05ab82393a3ba3344f5bfd75a
SHA512 3f5c7ffe63a6a6d8b7b4880057d320e5a9432749c8b2cdd57a6178791581d34adde44deb7536ed75ca2b5c2c27d859674d60d0116d26f6ba0e3d69f9788828fe
SSDEEP 24576:O7NM9YqZqmWMUkPjZM48Mv6bEhsY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:O7cBWMpPjN8DbEh5LNiXicJFFRGNzj3
TLSH
T15265AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d8848ef8ca872e210c5ab455e32ebbcc7c3aff036de8af0a44996e20631b9e85
MD5 29efafcd34d4fbb3171dd42527899c96
SHA1 db204304b86648473f436059e87c6420e711e3d8
SHA512 17e53385d6c0d456a5ec55f6fabd8851f0570c7975ca15aa422667235507240679822ec52526096cb25b84941d5e5f757639c7c77999407f797c9abc0ea74462
SSDEEP 49152:zF2YuHNETovAvNYf8km4LNiXicJFFRGNzj3R:i6BCf8kL7wRGpj3R
TLSH
T120858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 43bf06ca51914a9a87f5bf00800c9e63618143359eb7a410f539409f256483d6
MD5 c62832e8a116ab5ebe0f56f0bf952af5
SHA1 5df12b98e33e861f2f7ef37b96067620d6e9929b
SHA512 d81cd4887279e837364922607070baef2f43ed6405bd1cfc90fde780a540c694a40aaeae573627d651d61bfdb783a5640358fb1056c68431bf5271ff414a251e
SSDEEP 24576:iAFs06+Omlf8NXEbTof/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bFs060loXu2LNiXicJFFRGNzj3
TLSH
T19065BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 9b0385e886e043a847c8b0acd34f159131273b5d25e3e89dcf6248941fd0e4a6
MD5 1795bc41d501aee36f18d338a2ff0de0
SHA1 3b8ca5a47415cf2fa4a8da69b0f52eb4c95c9941
SHA512 2c2cdfdf125d964ff80a90a688a4f0f9e54d7d92395b197c5da9e81c69f8ce727f142a41629ac3216049537d14e81e6fa8459ca6ab9765f369bfa6653bdad4d0
SSDEEP 24576:ZJnJ5D3WX2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZJnJ5DGX2LNiXicJFFRGNzj3
TLSH
T17475D02DD29810F8E4B7C274825A1A55FE72383D2F2269C724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1865dc742ccc19aa7eb61b55f0cf620a8b647ece0a46c0462525a71f91616c8f
MD5 926c02b17f1d7d292630ce68dae4183e
SHA1 4bc618c3c0e7307012a384ed32059b01a3b05aa2
SHA512 449c112b19e959644ed10c23ef284539ea978beadfaeb2b8b12c12924f2ee85866fa3ddd740565c740dd54b7cfa161cbc29b591c03139bc16a0e036953d8709b
SSDEEP 49152:xg06DIKdwc+eQnSt65aVULNiXicJFFRGNzj3:6S7wRGpj3
TLSH
T1F4956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 6d3ac17c72715790c1460cc17668df2ca393a768eb28e9ae71e4181ec868ea26
MD5 fe178aa6c47a93bcd67889dc928f98ff
SHA1 1cc1f1f921984e5c4833d1d08a85193d4f4aee0b
SHA512 3587333cc44afa824d87dce267e344857f0c6112d499f47669ca877ff6040c8955b3f95e3fc0f0288a2cfb898133bfb9690428f83277f0d41cc3bfbcd38afae0
SSDEEP 24576:rnK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rnKLNiXicJFFRGNzj3
TLSH
T1C15512AE278C70E5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 674fbea83248bdcd008ce547dad2d73a8d8321f3255d5931bce20c620b03560c
MD5 82593ca82aa6dedb82a27b0c3c8af86a
SHA1 7cd1f2d389c948c74c98c9af30971e259939b729
SHA512 9713044106ac7929ad4fd6e373f84d9237cb05cef3b58fea38dba754e0fb79d3a3a7768e8f81d844061c7e75cded224f76ad87cd0cb6224012880ca32d5383cf
SSDEEP 24576:QIyJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QIGLNiXicJFFRGNzj3
TLSH
T15F65124553C860E5EAB9013CCA774064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 50defb22ab4ede6fb981b333e2907b28e7f7ca5607263e988871e429448db201
MD5 ec8e72d04d54f0fa4ae35a8c1e3ca0d2
SHA1 1902fdf8455316c7f076145ad87a361540739ed2
SHA512 04818e54e6510d05d7d89ab7d27caf8fcffef807e3a1a5e950a5716c6fdffe54d8216dd7213ae7877ffc55fdbb591d3c755904ab2f0bdb494c6f8d14956f4c04
SSDEEP 12288:tyPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E555239A118964B1FABD003D86354824B1943E3C9B2628F7A1947D3ED339FDBDF38952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2a65628650ae350ea4040309d8414b2f67665bd3d980cef48ada580c1b037497
MD5 9a69f4e58d4ce68ed5805737dbd6e1e2
SHA1 9f9d503b17a9563575dc270a593cf19ce12193a0
SHA512 caa31ab71b1731e5e1e65b9330be108d9fba269082df58c6dd55852b79b769a5ed9f8b947e1636827807a7351a4d8f3709a81b33caff6dd8f8ae2b0357cb63c2
SSDEEP 24576:QQ9MxZKdcz9dw3w/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QVKZwLNiXicJFFRGNzj3
TLSH
T14E558C2DABE9059AE177D239D5A250C3A673B4301B35D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 8cdbdddeebad7426e7c7025c145269d9eb63c431fc22eb1be9bb0f0099e0a3f0
MD5 5224980f6c6aec066bcf820bf1a7b8b0
SHA1 0de0331dbbdab632710d0e4ce21461557c6a58c0
SHA512 81f88ec4afd69af9a53d5ef987e5c1b73b0e74fca5163d3dd6975718940fd05ffea21dfe19a01154538914ca7cf1213e3df0d3f511391ba5dc9f83b6f2988b97
SSDEEP 24576:1yocDApN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IocDApNLNiXicJFFRGNzj3
TLSH
T13165E05FB76D40A2E176813C89858204E773B4345B6257DB6181C73E8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f9b2554130720b54393ecbc314096d66c07683b1e45869e4cbbb1de6f8f7d9f1
MD5 5e23f17943056f31eb1c8c70871da47e
SHA1 31631a8cb559ec5baeb1298170753217f9ee9b14
SHA512 13b836ef23bd26eaf619f53c4241ffdc0592c5166343104fe699e535a6c6ebc663121d63870e24090cb44bbf8798c294021a2944eecf9cc96479e0725e0d5de8
SSDEEP 49152:IWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKNLNiXicJFFRGNzj3:q0zuNIH7wRGpj3
TLSH
T1DCA57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 53e72967de532c38669e95d89d66aaed9ef991177707c8d62570ad119ca9ee69
MD5 90494cf9027e21030dcce0465728a133
SHA1 f8cd70977d2fce3b1ce8643ab4b66953c8f20227
SHA512 8319ad60e497d1b075cc3a0eb6f31856bf3283f919cea3877e97ec01e6b61b02e9c3034c7704d24d989bfd98192b96e39efb165fa28bfafc934ff088d6c2349f
SSDEEP 24576:M1QT7EcpfxR+N5AWAz3ooiYzjMqbK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RTDxR+N5YzTBjMrLNiXicJFFRGNzj3
TLSH
T11F55B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 7a37d082d2a064b87da530360f6eda5e72dd4ba05d0c9c5615abe7b97bdd3350
MD5 956165f481e5a1d8d380e8a1c9d03259
SHA1 c5da2972d7626a205f564782e45259407b8c99f2
SHA512 6b68c2d02e323d8a91c4ccce5adca8be719be8a1fece3de53c5dcfbaaa12d55e34285edb8f6682ee90a74b4d001af1d374b2efca47d66c61007f88f9136fc157
SSDEEP 24576:lTMdOz0FFS+UmSLO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/0K+UmSLOLNiXicJFFRGNzj3
TLSH
T1DF75E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 9b3d92fb2e35ffcb015c0558d93ebbb486196e60b4bf1c09797d72e44d344d34
MD5 078f990cc8b525189c32085be072f56c
SHA1 ac87a47b0d97881b3de09a40f0a68edf8dfe1dc5
SHA512 eb23ad4909ab023b63953f03c09cfe3c4f66c2f691366bc7cbc9be3ed1704178c9d28e261e431d6f24c5d1e9e39755ce7a435a96717a328ed052764d4fa1bbe7
SSDEEP 12288:54KziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9H/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B855125A13C830E0F5BA5139CA364014A660BC3957255AFF71D0E97E9B3AFD9CE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/720-215-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/720-270-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/1104-409-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1104-222-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1612-13-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1612-204-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1844-118-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1844-252-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2504-237-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2504-243-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2504-449-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2504-247-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/2536-139-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2536-258-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2536-146-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2536-154-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3036-472-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3036-262-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3196-253-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3196-255-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3228-178-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3228-169-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3228-261-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3232-62-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/3232-77-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3232-99-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3232-93-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/3232-80-0x0000000001A90000-0x0000000001AF0000-memory.dmp

Download

memory/3296-552-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-544-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-531-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-536-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-532-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-527-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-549-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-525-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-524-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-541-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-551-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-548-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-523-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-530-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-547-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-533-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-546-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-545-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-543-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-522-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-553-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-554-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-540-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-520-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-555-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-542-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-556-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-534-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-539-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-521-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-550-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-557-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-535-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-529-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-561-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-560-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-538-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-558-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-559-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-537-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-526-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3296-528-0x0000029AB4240000-0x0000029AB4250000-memory.dmp

Download

memory/3332-38-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3332-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3332-32-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3332-232-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3492-267-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3492-474-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3496-518-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3496-271-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/3852-110-0x0000000000400000-0x0000000000654000-memory.dmp

Download

memory/3852-0-0x0000000002380000-0x00000000023E6000-memory.dmp

Download

memory/3852-477-0x0000000000400000-0x0000000000654000-memory.dmp

Download

memory/3852-8-0x0000000002380000-0x00000000023E6000-memory.dmp

Download

memory/3852-5-0x0000000000400000-0x0000000000654000-memory.dmp

Download

memory/4012-233-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4012-230-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4012-224-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4012-434-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4244-274-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4244-465-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4244-218-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4376-464-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4376-250-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/4956-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4956-24-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4956-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4992-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4992-103-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5192-259-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5192-471-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5540-209-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5540-266-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5540-198-0x00000000006C0000-0x0000000000726000-memory.dmp

Download

memory/5540-193-0x00000000006C0000-0x0000000000726000-memory.dmp

Download

memory/5700-246-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5700-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5700-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5700-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5720-361-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/5720-275-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5720-519-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5720-307-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/5720-469-0x000000000CCE0000-0x000000000CCE8000-memory.dmp

Download

memory/5720-291-0x0000000001780000-0x0000000001790000-memory.dmp

Download