ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
Size 1.3MB
Sample261014-lvldtsfe49
SHA256 ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371
MD5 38f34114ff2d193b59c2d29128b856ba
SHA1 a56e80c31b965129452281d608fce615496afa8d
SHA512 c8dbbc29630f2708a6e1ae2f6db618e485ab2deff5aa7d82823777ff32d07d43309f7808ccb09b6edb514f13ec2b4ffe0dd519567ffd7144b2902a3c83ce31ad
SSDEEP 24576:+znCE6ZeFvIdkm4W3uHfVx5mS6xBf9wuNwod9PRqxUu4jQ:+znCEGmMuHfVx5f6PJNwod9cxUjQ
TLSH
T10055239836834BDEE409D3B2C3FFA4FBB842A730E171FF94AD0A55A119175660F3125A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 20 IoCs

pid	Process
4960	alg.exe
4000	DiagnosticsHub.StandardCollector.Service.exe
2724	fxssvc.exe
3316	elevation_service.exe
3844	elevation_service.exe
4116	maintenanceservice.exe
1836	msdtc.exe
332	OSE.EXE
2064	PerceptionSimulationService.exe
1188	perfhost.exe
3352	locator.exe
4256	SensorDataService.exe
1912	spectrum.exe
1592	vds.exe
4644	snmptrap.exe
4460	ssh-agent.exe
1824	TieringEngineService.exe
1904	wbengine.exe
4600	WmiApSrv.exe
2824	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ssh-agent.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d7a68bca250d612b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\locator.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\AgentService.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\vssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\System32\vds.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\vssvc.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	ssh-agent.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\AgentService.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\vssvc.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	snmptrap.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\system32\msiexec.exe	snmptrap.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	ssh-agent.exe
File opened for modification	C:\Windows\system32\AgentService.exe	ssh-agent.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4024-0-0x0000000140000000-0x0000000140289000-memory.dmp	upx
behavioral1/memory/4024-80-0x0000000140000000-0x0000000140289000-memory.dmp	upx
behavioral1/files/0x00010000000232af-135.dat	upx
behavioral1/files/0x000100000000c540-138.dat	upx
behavioral1/memory/4024-183-0x0000000140000000-0x0000000140289000-memory.dmp	upx
behavioral1/files/0x0001000000017062-182.dat	upx
behavioral1/files/0x000100000000c8e8-189.dat	upx
behavioral1/memory/4644-199-0x0000000140000000-0x0000000140154000-memory.dmp	upx
behavioral1/files/0x0001000000017ec1-201.dat	upx
behavioral1/memory/4460-216-0x0000000140000000-0x00000001401C0000-memory.dmp	upx
behavioral1/files/0x00010000000178cd-218.dat	upx
behavioral1/memory/1824-234-0x0000000140000000-0x00000001401A0000-memory.dmp	upx
behavioral1/files/0x0001000000017430-185.dat	upx
behavioral1/memory/4644-402-0x0000000140000000-0x0000000140154000-memory.dmp	upx
behavioral1/memory/4460-403-0x0000000140000000-0x00000001401C0000-memory.dmp	upx
behavioral1/memory/1824-404-0x0000000140000000-0x00000001401A0000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	snmptrap.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	snmptrap.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106062\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	snmptrap.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	snmptrap.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	snmptrap.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	snmptrap.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	snmptrap.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	ssh-agent.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	ssh-agent.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	snmptrap.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	snmptrap.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	ssh-agent.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	ssh-agent.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	snmptrap.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	snmptrap.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	snmptrap.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	snmptrap.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ssh-agent.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000204efcdc15bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a4a98cec15bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be3c28cec15bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043c531cec15bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000363885cec15bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056f921cdc15bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4000	DiagnosticsHub.StandardCollector.Service.exe
4000	DiagnosticsHub.StandardCollector.Service.exe
4000	DiagnosticsHub.StandardCollector.Service.exe
4000	DiagnosticsHub.StandardCollector.Service.exe
4000	DiagnosticsHub.StandardCollector.Service.exe
4000	DiagnosticsHub.StandardCollector.Service.exe
4000	DiagnosticsHub.StandardCollector.Service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe
3316	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4024	ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
Token: SeAuditPrivilege	2724	fxssvc.exe
Token: SeRestorePrivilege	1824	TieringEngineService.exe
Token: SeManageVolumePrivilege	1824	TieringEngineService.exe
Token: SeDebugPrivilege	4000	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4644	snmptrap.exe
Token: SeDebugPrivilege	4644	snmptrap.exe
Token: SeDebugPrivilege	4644	snmptrap.exe
Token: SeTakeOwnershipPrivilege	3316	elevation_service.exe
Token: SeBackupPrivilege	1904	wbengine.exe
Token: SeRestorePrivilege	1904	wbengine.exe
Token: SeSecurityPrivilege	1904	wbengine.exe
Token: 33	2824	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2824	SearchIndexer.exe
Token: SeDebugPrivilege	3316	elevation_service.exe
Token: SeDebugPrivilege	4460	ssh-agent.exe
Token: SeDebugPrivilege	4460	ssh-agent.exe
Token: SeDebugPrivilege	4460	ssh-agent.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2920	2824	SearchIndexer.exe	122
PID 2824 wrote to memory of 2160	2824	SearchIndexer.exe	123

C:\Users\Admin\AppData\Local\Temp\ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe
"C:\Users\Admin\AppData\Local\Temp\ff3e69b2eec042cc6374da1fac9e290d1569971473149e103e70a5e60a1ea371.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4024

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4960

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4384

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3844

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4116

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1836

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:332

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2064

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1188

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3352

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4256

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1912

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:904

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4600

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2920
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3307c93ea199eaf289649556782f7954f7a3e62787fc1510b3250b66343970c4
MD5 1dcfc472b866a5a651fc49b63e125b3f
SHA1 a4b6930b5f8e0d0a3ed68dc9b29347e168051030
SHA512 de241a115de7dcbd4817dcff5a0f3cc69b8bc05b99b86275bacd58eb6516f373410ac4748b658c873567b4083cd5a4078150302b989b672b9880f0736a387b3a
SSDEEP 49152:5b+632BuPkFKRrdE6ohrstBhuXjfS4LWxn4nCEGmMuHfVx5f6P:P3q60jBUHmMuHfpk
TLSH
T1D6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 6b29f6e11818c1dd5b1d58e0cb0716c6592d01d0d1cb5c2e03de6b36002e3a7e
MD5 57668e0f30ee1aeed15c35d6258a8abc
SHA1 d570c5cad104aa778c3d054b4704b9a810ec9964
SHA512 6c27b89c27ae58e22832da41a21fba4f844b45de3feddd03eed13942dd4ca61ab41f9b335ff19d73d3c29e8fdcc777a1ea1cff3304b634677af339aedbf550c5
SSDEEP 24576:kXYEDtczA9nCE6ZeFvIdkm4W3uHfVx5mS6xBfpwuNwod9PRqxUu4jQ:6tcenCEGmMuHfVx5f6PlNwod9cxUjQ
TLSH
T12375122837D209FDEC5BC279C9F6C466EA7378604370FB8B036495661F232990E3A755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 e7f7dd84438500eea533ca6c6fe1e70a3560800fce6b0e727e4392e7d6eb77b8
MD5 79f08a0f414b7dc598adfc35bee1a1bb
SHA1 c1c413b48529b99a663cb6daf155d94eab4dcc01
SHA512 e940ea3a9739e9d84ef591222bc07d554c4d617a692e220f783adf1ea09f0e131db94b5d1a27ddbe1cb4ca519881f605d04a2ba489b74b784319fdba6ac031e9
SSDEEP 24576:VXYfDtczA9nCE6ZeFvIdkm4W3uHfVx5mS6xBf:AtcenCEGmMuHfVx5f6P
TLSH
T1EA05012873E509FDEC2B827CCCA2C515EA7378514764E7CB03A49A660F236D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5698c1c7b8fd8b6a36d6e31b927bbd116451db31e4353a57942d6e2344349ec9
MD5 19f179389cc5627d05b2274e20cc4a6d
SHA1 ffc35a480c41ceac1bb3b488ad691304d3d23a87
SHA512 75e661e0d1826aee0aad2a16f93c4ca8941161c290f2e1f6e5ff8f59955476a948bc19841684814e51cb162b192f9cdf6afe44987c6d91a611e4c85765cb4d94
SSDEEP 24576:y0Le5ji0hmxNrM+nCE6ZeFvIdkm4W3uHfVx5mS6xBf:yPji0A7RnCEGmMuHfVx5f6P
TLSH
T1F1359E26F6748335D073C0B9C5D2A69EED7130825B308ACB4286D77C6F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 de92277d25aeece1f73c2cb55f35a1ed88516a2ec80031541710b73cd9217aec
MD5 c30ad1fd65f4ed6825bf6f4559ce131c
SHA1 bec4d29587b1d67837b9412bbcc74c5271496d03
SHA512 806528f1b1f8ed2e7d0c9363e73663bed9e4181238bb9fdb65b7ef42c1a17511c371b7bc56058b0498237ca3bd9af3e501d6543385e1e962fec9c45a0b6e37af
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWr6q8wyuInCE6ZeFvIdkm4W3uHfVx5mS6xBf:+/ezSC6vUzPviHjydnCEGmMuHfVx5f6P
TLSH
T1B4755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8734240ab7e22d3bf41a5d63079de446fcb90dd0540bef9359dde53808fc7279
MD5 a330c2476d15b26d71e69cdf1563afdf
SHA1 b8790aaf52a54ef107a9afdc13faef433765af96
SHA512 c735a609031f40fbc83b16c49c4c35d2e481bed003134dd93bf9f47fe6e3c260b67d2f85d391c19f1e2894897573936eb486b940c8bfa3431a917b5d7a34de37
SSDEEP 24576:yVbqPb88hv/l+bPnCE6ZeFvIdkm4W3uHfVx5mS6xBf:yVO88hXl+jnCEGmMuHfVx5f6P
TLSH
T1B0559E66F5748331D073C0BAC5D3AA9AEE3234424B31CACB1246D76C2E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 4feea341b1aa8af3e0db438a69cca00d9e746798eaacd8f4d33c41483be97522
MD5 f968270281d974e14b967aaa81c2cc2d
SHA1 50e47cdddbef70c9bb61e8537d92a336e7e0eb84
SHA512 07a00bee158bd5fca9378053b308428c8012a38de8a72f227bdecefc93d83f8fdb282285f0f1bac82a7c00c901d405a789fe2d583266527ba9c9ce275660398e
SSDEEP 24576:djynCE6ZeFvIdkm4W3uHfVx5mS6xBfLwuNwod9PRqxUu4jQ:QnCEGmMuHfVx5f6PTNwod9cxUjQ
TLSH
T19C5533A827834BDFE50DD2B293FEA4FBB8834F30A071EE54AC06769615175660F3125B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 f059682cc65866305fdf0bc5a75f33901466f8cb2efd13067b9d1d9bbddbcfa2
MD5 1334cd7d7b1a963a55171892ba239ed1
SHA1 370354e2a1c6d0f624f779733fb55377d20d1311
SHA512 9343392e35e6422a9cf6b4c28b6f61584a858457220207c74f0481a0e151db0eaa9357f602f1ff397ee2ebadd29151c761bc3b109fcbafcf3ad62429ab708b4c
SSDEEP 24576:LJIUnnCE6ZeFvIdkm4W3uHfVx5mS6xBf:LJIUnnCEGmMuHfVx5f6P
TLSH
T16E05CF3BAE28FCD2C27E9DB85A91C640E76278304F61A3CBE165830EDE235D15E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2d26754d7293858387ea806df45f6cb82fd2f7c6941f31f02f7e886e12a1dc54
MD5 510b6a0af810645647fac9c4b7535dd3
SHA1 7fa781823925b5fa96fa24d1316e86c3e95ac689
SHA512 fe35aca53279d1710b428d8d79941f2159206b500953e86945e6de5d5730a7ad7fccf49c7327a6feeafecc87b8bf36d25661e58f5798619baac156ef3f4d8733
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THM:PQvGAdlCEL8c/RRNw5C1HmMuHfpk
TLSH
T10C266D656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 573ec872faea2c03461972b40e0a09e88c0826bb035aecc625639a111767fa2f
MD5 d30b8de5d783832a415e535e15c4c148
SHA1 21d58dda2798cbf3752ce2e9acbb33c3dd70b70a
SHA512 388c3ed5d51d09cdb0c88e9d378c0f4591fe11b6de8c67926e9c0bc4304a45dc3d732716690292f3bd9a9d9aff944c0fd598a992d0e0752c3c785e7504542b36
SSDEEP 24576:bSewsAjBnCE6ZeFvIdkm4W3uHfVx5mS6xBf:WljBnCEGmMuHfVx5f6P
TLSH
T1F015E031FA75E036C67F0DB21B3AD716686D7A204F611AC3F3A85E9E49301D22736A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 87c4c17fb0d8cbc8451d9ecfcd40d2c6a980aad0586dc4fb67377a1aef0a6037
MD5 51ea4a7f9bef55a15c25c854781a7a54
SHA1 057c026b79b4048e72fd22379a4783108001b2cb
SHA512 ff74361e82d263d1d5fa6a2eccad35d6720fd629e9ba964051e2a9a20c1f893edfb3573964f964936d1a3002f7070ae04cf0cbc18601272a8c3a1a632edb3409
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHqZOG:LUEtQevvqc2W1cpV2RI32qZH
TLSH
T16B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f859f0ba5a48c3252924bc5e09ec4d32fd5a5c75f4ecc5ca84ceca3a21f07756
MD5 b37cd05d322224aa070de203f4c87371
SHA1 8a53cfc4248f75ad883cdb80b81f3981b5ec5ed4
SHA512 0fb1b7eb2ae0b9ceeebefa55581c0fcf64c553224bf921622128e011152202f0124061b5a14579029ba882a471025de165a42d131df86d368a52ce99c71d08e2
SSDEEP 49152:ACbRquA/m2yL5zQfFiV+XenmE3/zhnCEGmMuHfVx5f6P:JoqtVjnmhHmMuHfpk
TLSH
T12BD58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 983d83406e456c17d01de1ff1eabba7a52357421e3b7ad07e13362537eb923a0
MD5 7fbb3a0012e5272304ac149a6fe5d64f
SHA1 75ac1a37f9f7c0113e915b8f9523a046739a1607
SHA512 6d251448e35638d6f890f7034fb7a06b29806791295eb743eba3917cc0e479ad2d505546236761f209c80877653ee45f0722d43a981dcd123856f8ccaa9454e2
SSDEEP 24576:UAhGL2IFoiwtA5l7S530nCE6ZeFvIdkm4W3uHfVx5mS6xBf:UAM1Foiq5EnCEGmMuHfVx5f6P
TLSH
T1E335AE81E7F955D4F5B3AAB899BA9570EA76BCA55E30C20F2150D11F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 f06263d254226d9b3ccfd60a0cb565f7907d5678a432663832dc3e1683c708e3
MD5 f85ccbdcb49b0c5609751124afe6f408
SHA1 91d7db6d1f853e2693ed93e965a49ee8fb9250ca
SHA512 bdef84f11c86bec26aab88f37d3e69ff688920a84d0308bc2d566b9d4d8641bc8da125bf35ca67b73d36d5efce2f10d07ffe266265be30f05638009866fdf401
SSDEEP 24576:lwuXOWjnCE6ZeFvIdkm4W3uHfVx5mS6xBf:lwsOGnCEGmMuHfVx5f6P
TLSH
T1BA05F14632E50CF9E9678238859BC536F7F2BC112A24DB1F1760CA5B5F37261AE39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 bf1b8a8c264b50e929f00b77369bec687db0b3c089c806e48d2af16401c10a00
MD5 14041998a26c1b471ab74b75d846b26b
SHA1 df0e003d4f5f4181b57da86d298d3b6df81fce0a
SHA512 086fa136240bf481db345244149bfa917b6bc5e535e5f190d72dcaf0dfe27832a23325aa552c2f7ed7abe39fc7a8a10336977897837671be4fb33bba4b320ada
SSDEEP 12288:i/Z1IyxiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:GZu2nCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T15CE4125633E521FED5579278C9EAA959F7B27862173883CF2A140BAA0F339C50E35331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8f55b36aa8ccf4ea97a42ee4222736848f594888031948e93542e3be84baedf1
MD5 2d2fc8698f5aa8f5f52a7dbde2f8b370
SHA1 1f127f951f9507d3b2d3f484fcbe96907fb3c3ed
SHA512 639ff5c8959db010eba7b080c2d6489b5d66467df15d39ebeda011933c084184f41efdc24d71d269b637cd040a05ce6c702a40c6e387d2aa720ec4b718750b28
SSDEEP 98304:+QRQyi36YOcPhLvw2gAf+PN3OHmMuHfpk:lQyiKahX+PNgZOG
TLSH
T13A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6ac6c84ee8ef9225ee5cef7a0dbbbf4c4d60b359e0f096e7eac904d56133bfe0
MD5 197f25b6c4bf9ab994e4a26cb28d4b08
SHA1 8bfcfeefc1afea1c3ca31cf4dcb009d3f988786b
SHA512 0b2d2b614aa73424a7afea5baf78ca92e088c671293b44a438e1184df27d7beaf1b8fef4363ed2387a1c3c3bd7980b3519e41575725af8ba81bc540e312ef9df
SSDEEP 98304:oQRQyi36YOcPhLvw2gAf+PN3OHmMuHfpk:/QyiKahX+PNgZOG
TLSH
T103667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6c19a58f735589bb0f85c0f69d2ad814e83036a7d371c5b7b556bf511a07231b
MD5 f40f64747004c3f62959f72f24ce34cc
SHA1 1af5edeb9ad8ccdf44a0cf8097762500d5c1a0a0
SHA512 4e6896d45944b5100cac5b6c388ab6fece695b6a228db33d22fa52966f14dd2fb7e82c290ccdbf9b4178b4e94159431e433a865ed8569d900052f9a8d988f644
SSDEEP 49152:x68Qg55nhceWu7PNU3/RnCEGmMuHfVx5f6P:vthLRc/0HmMuHfpk
TLSH
T14AB54933B2F600A9C44DE1769F4A973196D27C718FE0E3DB850572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a1b260e870c60be4500bcb2aa644edd12687307ec716506863fa3be5592da9b2
MD5 adf59c6c24a1dcd5ba14a970ea1dd471
SHA1 708d393917621ad38b49a63a837cb843b963331d
SHA512 9b2c63a89fefe8cf8080639f24bcad1ad1727847ed90cef2218078579ba40894c19cb8863c01e22b929b74a3031abe08cd6026da23bc8d4357a13cfdc38dd502
SSDEEP 98304:sy5112gYy5azzVva69nLKnhZvHmMuHfpk:tLIHjWhVZOG
TLSH
T145167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2a31de39a8595352b7e4bc6909efef41bd96ed24e9274ce1f8e898ec6a17b21d
MD5 b05c812aa2e04a458ce1bc3db5ce85ac
SHA1 76c886ba2886d059260022a0a8a0881645a54293
SHA512 73c30edacddbaa2c385ccda46bc653ef2600d3feb91046e862e8091066e4f9cd99d2b57d5aeebbad22ab2c5ed4577039da7660221499a4c0cfe62181d3f80d8d
SSDEEP 49152:lB+taZ3usBWOBr4tEG20bqx0z+n217aau1glNnCEGmMuHfVx5f6P:Lu6JmUxd2dAHmMuHfpk
TLSH
T168D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 08372400852210ed6afd95881daf148aff5d72b46614dd782f3cf1aac6f677cd
MD5 64d0a700c15e812397fafbd89b70e760
SHA1 14c7aadc02a15edfdd5b3ec25364a4d2351af796
SHA512 927135a0847ff9cec4237bedeaf4c751d6e0972cd180943fc15fb5276af9687eebf5bcafbe115e1a2a0ec0c879825240c258534a148821081dc108c760c17185
SSDEEP 49152:h1hpsNoJpF1A6BU44CwH7R4xHnCEGmMuHfVx5f6P:hmifPkRhHmMuHfpk
TLSH
T13BB5BE13F2D901E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 38ce2f4702aad63138c516e4f5e5928c681c5074d0bf751e85bddc8caab79c2c
MD5 d7f93495ea1dc75cc27f64f8867f9f1f
SHA1 235144909f681490568d1360ad898f54e4cb8b91
SHA512 d05d552d81bc83c4a1b948c0d8b7d89d7db141c8d17e547f29bc20e82f3ebd8e29dca023a0d66b4997b5c5961f8ec605f7ff204faa236bbdabd8a469f8a82235
SSDEEP 49152:0SuZQIY0Be2KNRVtOnks6NMHq2nCEGmMuHfVx5f6P:m5dKvi61jHmMuHfpk
TLSH
T1C2C5BF13F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f0280cd0a2401e43c44889b9215133f5de868c2db47dfe98a6df4fcc4950e39a
MD5 c51f18cdbc2d18a121aa9eb987623f0e
SHA1 d0e019a8ffa057caa2646e4385b603c1898859c0
SHA512 acf3085b59277ddd41d96c4b36eeaf22dbe35759a645b7dddf011f2a1014fd77e2f8f31752bb0280cf7d2377905d8afb53399bfd39d98fce53f24bbd07de033b
SSDEEP 49152:fhtSn8EApI0figXgiDn0AP5wbnCEGmMuHfVx5f6P:OX2iyph9HmMuHfpk
TLSH
T15D95BE13F2D901E8D05ED178C7568632E962BC150B38AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 a322adddfa3081169694f8a3ef39bf977e61b1073ee9eaf8c5c6ab6f29c6be14
MD5 0f4b8555d19ca6e6bfdc9c4ca2f25d86
SHA1 e97522277238a61d60c5ce4c115a876a0f5b76d0
SHA512 9f032f488af71adcdd597ac13f5f3ee0d42feaac568148ef8aa4168a4706b1594d9027ff71e26966967331d4b8a818a8e3c518f59e2d0137569ba752dffafe42
SSDEEP 12288:MoiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:MqnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1D4C4236221D747DFD409A6B185DFB8F9F58D2E61896CE1877E0C2E624F2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 333520fb58d84d123d34c0f444b747aa290a4f3ef0ede821852f905be513887c
MD5 b758454322c967fd1accf06cbdd7f01a
SHA1 403f003567fa6d514cf589beb6909b5214c0e532
SHA512 90e68d7a3a4c515744b70f3a020049878344fb3aab81a7905ec67e401db6b21494432a0902452f7ca7fbf3ff4bd409baf0983bd3e5adf148ddce2c9823c7ad6f
SSDEEP 12288:MFiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:MFnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1F1C4232221A747EFD409A6B145DFB8FDF58D6E61896CE1877E0C2E624B2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 24c38823131f3c54d553bdf523ba109aa9a9ca65c39f0f775fc793075f33ddf9
MD5 801958e392888a3a86323f52475ead8a
SHA1 dc567d931d26e8d43117825f6a5b8c900906655a
SHA512 d6ca373786f7860ea68ea1d7fc4a48bcb23b5d26ea50b9ec0b3ba302afd9b3b2820dd2011e0cf12469c251aff1c9bdfb5a734c9aa2ee255a88ece350a8e18d96
SSDEEP 12288:J/iHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:JfnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1E6C4232221A747DFD809A6B145DFB8F9F98D2E61896CE1877E0D3D624F2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 4b029a60e7ef932022b50ab1e95f45ff4d01391ee629a486c0cbba4ccfe2ca89
MD5 df0c7e66148d6d941be6aad2feb60764
SHA1 4a2a81677b7e226062df47cbed25bc7c79d7ab5e
SHA512 6cf93874012521d3a7174d8a209a7a7decbec470980e520a1d382af7736afb52859107fc7fcc31bd84081351f75d341590a563f3cd637fa7e53b1cde763113ef
SSDEEP 12288:FVqiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:UnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T13DD4232223AB02DED816E2B5C9AFA4B9F6A97D618638E6CF7F041D560F335D40E31714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 e2f048c93dfd4f99a94002ef9d1d48942570dff7c294716b9a63252f02dc07de
MD5 9a04df180e4d44617a35fd3e3205a8c1
SHA1 b68f3baf2dd9d4397762e86d3dd4c53fe8217311
SHA512 7495a6bc795fe45abe01175a18a64e08bb6ba854e0c8c2595da4cfc7ef3a720719e9c615ba2f63a9f069e228d51e215ac92e24b2f77b799ded2a32b495a3e906
SSDEEP 24576:UcnCE6ZeFvIdkm4W3uHfVx5mS6xBfrwuNwod9PRqxUu4jQ:5nCEGmMuHfVx5f6PzNwod9cxUjQ
TLSH
T1D35533A836878BDFE509D2B283FFB4FBF8465730A071EB447D0A65A216174660F30299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ba9473a0c4c3567986d7298f7b22cd787c26c6e2eb8e845b44147a2c507729c5
MD5 60e54efe9ebef38331ac714b481f8588
SHA1 a07e3557d887b865ea1baff81f43134dcab91857
SHA512 a8d7110289a00fa875efe6a963aef6d665148b11495b07bd9467c01a97f323a878d2982e59e11b261e40cba0e1d924cddbf95bedaa153671590f8d2a01f43ae8
SSDEEP 12288:+5iHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:+ZnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T144C4232221A747EFD409A6B145DFB8FDF58D6F61896CE1877E0C2E624B2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 9b0aae26baada01f24714fb72b3262023fcbc9ab2c20af14e474b114c18491ec
MD5 45dd57edaffb7d74abc51db5539420c6
SHA1 72b1a28da883cc4a2f7cfb8f3b94e9f1214d4081
SHA512 7096ee79e162a5a407649879d427bdde1080ed02cdc408c7be12c8eea90fc16bb2bcc29a05181606af9b848973c9a371f33d1f287aef2af9e0265027697c0e48
SSDEEP 12288:WtiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:WNnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T108C4232221A747DFD809A2B145DFB8FDF58D2F61896CE1877E0C2E624B2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 511e9bb51c2acfedf60ab7f0c5fef9e1f2390ee3f526e1bee993f7e78d47e25a
MD5 5534a8680b201000444c977dd3bf6aac
SHA1 cf810ec485bff3ade320a64d22829e7bb80c900a
SHA512 e12642ccb2ebfe3f4226763e1b5c39bb95509f0c5595a96bfc3341da8241935b39f1830676c32a81e1364475ae4dad1e23d25d1124a432891658067028d7543b
SSDEEP 24576:KZMMzFVSOlnCE6ZeFvIdkm4W3uHfVx5mS6xBf:KZMMzfJnCEGmMuHfVx5f6P
TLSH
T1BF0502A5739108F8EC27823ECD5A9916E6B27C150B70C64F17A83A675F333A10D3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b30e4a90b9cb83fdfdcc123f890b45d0d01b8bb0f5a0fc604358d0da7648b461
MD5 65e700fae849fa43c829cd5ef3db56bf
SHA1 9529c9d400193309a9e19fc8b5320f12ed009687
SHA512 f5c47e3bfcc24e23dffeb32b5df2d70ad774f72d531438d5575da56926ab048f60688dfd66cb9513355b9910ca0b0db81a28f564c36d3bcc511c45e143be7af9
SSDEEP 12288:HUiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:HmnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1F1C4232221A747DFD80966B145DFB8FDF98D6E61896CE1877E0C2E624F2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 e4313ed1bf093b384177e217f2d7eb40325435831a9401762cdac08fe0e9ea0e
MD5 201857a11b92446558ad9b49856e76f1
SHA1 6beb94839b62d89d6281c18cf133f095cf8eeef5
SHA512 c45f4f1261c71f7265cb3fe42911fca3673deccac72e46c883fea9419a9ba47453e5f2fd7dc4af3f3bc75768bd0676c262d32be66511057b2860b1a7175f2f0e
SSDEEP 12288:yAiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:yinCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T13BC4232221A747EFD80962B145DFB8FDF58D6F61896CE1877E0C2E624B2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 43f16ab655dd6c3c1fa73094d4f9ef71b128a3e913ecc8df5f3bc2d8c8c6f01d
MD5 b543fc91ed14d54124123a481549b17c
SHA1 63f99f70e43798cf85c9dc39febddf387e76f83b
SHA512 397933c1a9c3b1dd8ac557eff358088837242403878d1231ab212c71b64605e9bcaf343570ed987288faa0c819c05315b777a9354d76ae37728aaad8ea539a5a
SSDEEP 12288:UyPz5L8xiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:NzyxnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T105F4121733A631FDD0269238C8A61A56F7B678324734DA9F2B640B771F276D05E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 2bf8e9556e38bc4cbc8a4463e93e9036995a0d53e9b5fa94860ab99a60df8337
MD5 92a5a4615e1e907b6a23d0aaf0b1d9aa
SHA1 4bda07f29b488964b9ee687175dca33eb2eee9d6
SHA512 befa83832eede658d8fa4b321b0c43dd04567faefa9cb0d2233d906d38bd022fdbce36e6439cb3ee2805eed8836eaf6669ead437a9bc3d64fc580baf5f47efea
SSDEEP 12288:GUiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:GmnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1BFC4232221A747DFD80966B145DFB8FDF98D6E61896CE1877E0C2E624F2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 abda811c0bf06812fecf1f0f9821279a0ab835950f4c17a808d48284181623db
MD5 f1ffc885158a345f3fc636ab3f08da89
SHA1 20978503ccd8b6efe5a4db56cbbaf004b69267b9
SHA512 2377ab1770d81406c19fee2be44a210b703501165ade37914a9decf0fe85036c300df23f0cd5a554e1e7d186b35121a9461fa935c01fdb3ef184c8038143da73
SSDEEP 12288:DUiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:DmnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T10FC4232221A747EFD80956B145DFB8FDF98D6E61856CE1877E0C2E624F2B8D90F31214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 afcb9ee8e614c995f292cebb6647c5b6a58995bcd274a5861c1066ec0c6732fe
MD5 82fb05a2b8022cb27a735900d36fc07a
SHA1 4dc4d162dfa2dca721081ef9b45a653987c37ed7
SHA512 4dece58d4460068d29b0a1784ffd1865698dbc85937e211389d9b742fa0e1d15ff07081c34adfa03c321ed51419bdaba94750cd0b593cf2e43b96803d458cccd
SSDEEP 12288:ayPz5L8xiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:HzyxnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T152F4121733A631FDD0269238C8A61A56F7B678324734DA9F2B640B771F276D05E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 057b931237836361a8cd33149491d91194aca1700246689e89d3354243a798d2
MD5 4b6d285233c07f9470983a97f3392bf1
SHA1 325fb62ab3e6168c13f946c845b5cdbaccc22ee7
SHA512 ee195b29b833668731c359cc5bb4b0ecfb5e36eb054c978f308771fee6d524d1d243f66d1ea18f6c4f912807bb5409b0a7c3c0a3ff0a245275ad669d8abfab57
SSDEEP 24576:LT9aLl3z0zDvnCE6ZeFvIdkm4W3uHfVx5mS6xBf:LTQLljInCEGmMuHfVx5f6P
TLSH
T1A60502A5739118F8EC27823ECC6A9916E2B27C160774C65F17A83A674F333A10D3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 7dcb37489a922146523c60025cc49ff20e99a0b2e1cf4c372c26cf2e66fd4f65
MD5 4fc3dc0c713b34b101a90ecac4e6b28a
SHA1 9a8da7a541323942802c4f5d8dcec8c0f10b4cc7
SHA512 a94a2d6b817672a25320985aea2c2a5cbb7dda1a5d38c0abd4c44cd209419d95bf9f11efd3a8aa48ec577ae9250316efc3691f0ae7719f1230c9fa969fea5814
SSDEEP 24576:03td9CHKy7GZznCE6ZeFvIdkm4W3uHfVx5mS6xBf:+td9CHKyaJnCEGmMuHfVx5f6P
TLSH
T19825CF90B3E414E8F0779A35CD765511DAB67C5A1B30DE8F03A8265A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 194514946467d2d73fc82a8098a5ac2afd88ad9fb114d936fdebdc58e012e2d3
MD5 85402c81915408030bf2f06f8c593405
SHA1 ce576cdf71e52d717dc07c799838601c07c6027d
SHA512 89bef81698306e1146c017957926ddf5ea6b0d63c407363abf7597fe33e32038c1f0a402802fdcc1d81b3f5350a0f6700d4bce27fbc2378ff352798565566c6a
SSDEEP 12288:eGsfkiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:C2nCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T13BE4F01AD29902E9C02E6275C79A5A51F3673C2187E4D3CB6AC0F97E0F365D05EEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a10465e8deae39bfff3f8cb96cad74d828e9e14c16dc3fff2d9c99fb4d413534
MD5 119d17a4a05862c756aa7c1fff956f9c
SHA1 58254d2eaf378424fe9d5a597824ac8a301474c0
SHA512 d2dbe762b4c3f4b8d00551bcd3b9bc15f865226113a34a6103956012d9ea8f1db3fbe90c79d487e8a6a5adcdefe92345aa6ae38a060c5eef3d10ed4f7c68fc14
SSDEEP 12288:zuiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:zInCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T16AD42322139F4B9FE42AA7B0459FE478F54E7B304E2CE5877D082EA64A378D54E31315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 f7c3af034e7e960e46deafc1c4f4a3caa4f2e165e1aac5623c773e92a7b2eef6
MD5 37220ae384f5411ca099a8b1dfeacad3
SHA1 1a4c59f440abdac14e9d94440abe2a4c660515cf
SHA512 70856d5f142913dc6f2fe655ecf94f35fc2519c2c8c821c7bbd7d402680ee5a3950c9a0a47f72a19374e63ba01674d5559692f529bdcb9684174fd5c353634ed
SSDEEP 49152:dTDxR+N5YzT4jMZnCEGmMuHfVx5f6P3Nwod9cxUjQ:pu55HmMuHfpk3NwPxIQ
TLSH
T188A5E12E67F905E9E1BEC6798B23C512FA727821033193CB4260C17E1E6B9D85E76F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 8d50c364ca6248a95b7f73994ad44eb1ee395f79fa7cb3082d65be9b8411f01d
MD5 ce32dfea3cf91a89c61359e788caee23
SHA1 475d440e3a94ed122f2af2518ee8bb85e8575e9f
SHA512 f8c3b75d99a5dc04319207494f7b928a456d8e96df0a42f82959192188f9907e87a3900c9f74de17ae3ae99ec34129402e2879668cfde810aeffa402802acdb5
SSDEEP 12288:FhbHjfX7iHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:FhbHjPbnCE6ZeFvIdkm4W3uHfVx5mS6P
TLSH
T135E4127E22AE21DDE435E27D859A954AE371BC210724E3DF2B85427A0F3BDE80D35B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.9MB
SHA256 c6755bc9b7faf7550d4bc8648efef0dfaf28e2f73d5279dfcb95fd6d4569763f
MD5 6e9bec9e45472023e8c717caa2c171cc
SHA1 a8df4a07918abf1d9e61cdd0fdec0cde548feb81
SHA512 e2bebb4a35411baa16529673a3b490176673891193c18606f73c56b35b129f567ed8db33782501eb1733c5e7dbeafba855d91521e813ffe785ff57f5417f5982
SSDEEP 49152:JIgnaTk46pSR/jnCEGmMuHfVx5f6PtNwod9cxUjQ:J3PHmMuHfpktNwPxIQ
TLSH
T17D95E12DF2B910F9D8AAD236454547B5FB7178291F209ACB0170C538AF0AEE84F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d199980e3addfbefbb763cc12f779fefd6c75885b72f7889305fd92590bb557e
MD5 3090f8a2075830b3401aa4423003818d
SHA1 9fcbf55c04c5233a6f9eff2b7a1b65a011be4ab5
SHA512 dfed60e24fde9c569ed9cc89feec8841fc8eaf54370f0581dbf63ab36035971abf65d1a967ed9600d76561ff434a4bf30ae9933787c706bb54805c3a0467fa2b
SSDEEP 24576:J3YgnJcRTk4yti+R5dBR/jnCE6ZeFvIdkm4W3uHfVx5mS6xBf:JIgnaTk46pBR/jnCEGmMuHfVx5f6P
TLSH
T1C345BF2EF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 1953d429b688292c01e72b2698e04d09938661a80540e4bb39871f815bb12141
MD5 06482d63eae65539a26496a2876ed52e
SHA1 83ae9e66145cc0fa3df3b894b478cbc3aac298e8
SHA512 a844a3496e6df7c0c2c04bf7260bece260c0eb1d27044416b79ae7d564a218b94f4baff23e2f3f670bf61c298f2dbaf6d52066c927db54e4db9795aa07daf6d6
SSDEEP 12288:tKiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:t0nCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T103C42361129B4BDFD819A7B5459FA8B9F54D7B204B2CE6C73D093EA24B2B8D90F31310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 5280ade83e85c7904323d9fb5935571ea39598c220aeb49a842c8897009e92a8
MD5 f1b8f9137dbedca55820d14588970225
SHA1 017889085d946f6fde102d6672bb1a8d8019637b
SHA512 18d80b4aa40e27aa1f9cda92226fe07bbed7dfaae5e2129edf1199de9419b869a4a25995b490985b6affeb2ff51bea2b7fd22a1cb1bca1012156702c09e92cfa
SSDEEP 49152:tHL3UsNwod9cxUjQdnCEGmMuHfVx5f6P:hjjNwPxIQQHmMuHfpk
TLSH
T16E851258F79600F9E82BD27CC6FA9427E67274681360EBDF07194B661F136E20E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 378448577661341551a135bb33d58cc651a1741b321e211ac00960c5c7cf813a
MD5 a794fa9a286f50d2801c36a06c316c41
SHA1 5d220f3a05c805768802c62091f98fc4748f395a
SHA512 33221a577992df1312033f7f14188f22fb73a946aaa65b677c85a391c09695d000fdcb764ce29259164da1dceb761b9840146d218aa31ec0d34867186ac503dc
SSDEEP 12288:YpFtYOZiHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:LO5nCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T14BE4122A33EE11E9D43AA23C899B925DE371B871072593DF0A9045BE0F67EF85C36711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 91f85993fa4fc87150a1af7fd6f33e932a63048dc138e607e54e41151a8546d4
MD5 92a5321ffb1d4be650f367017e45705f
SHA1 33c0e8862fd28320f927960845de0fad05312040
SHA512 87f4a66e8a6b135b807d2b6e88e79db2fe5261aee82131ecad7badd438ec3480b7aa6465fd791df825a6d33ada630c3deabc43a9f7b0e75cd98e384e693ed55f
SSDEEP 49152:KF2YuHNETovAvNYf8km4nCEGmMuHfVx5f6P:D6BCf8kcHmMuHfpk
TLSH
T13F857E6A27ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\SgrmBroker.exe
Size 877KB
SHA256 05f3aebe70388ed95d7691811c27311928a14c65a5dd680f58c08096768b3948
MD5 f4351fa1aca1e61480b5712c126ba454
SHA1 b090d07b604ae36529f74f2083f5d0dc2b0412f4
SHA512 6d97e9142a6b6e558c1220dd6c24faf13547ce6fa77c6d8f924ab4ccb32ecccea091e222eb4d5bfb39e24539209082c2014f9748bd029bbcfb1c157b8929e7a6
SSDEEP 24576:fTMdOz0FFS+hmSLanCE6ZeFvIdkm4W3uHfVx5mS6xBf:90K+hmSLanCEGmMuHfVx5f6P
TLSH
T15C15F13E63AE14E9E43BD27DD647D906F67234610321A6DB0690C17A2F5BEE43E39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 49374ab888edfdc7a6a81d111a45733e52dce0e5ff5d23b5741744c43948fa0a
MD5 87abda8584bbe176b839164ae175ec67
SHA1 bd258b91adbc722c3fb212807c49ff7eb38e896c
SHA512 17180e9c8eaaa5f8088adaad23d37eb4bc62ae60330903041e01ae09dd49d76f40c2a77d0fc90bfa70a5f876716521d345213c12b4f54ad2f8880937bb2a74ef
SSDEEP 24576:xAFs06+OmlfQNXEbToVnCE6ZeFvIdkm4W3uHfVx5mS6xBf:GFs060lcXuinCEGmMuHfVx5f6P
TLSH
T1C165AF2F62EC00D5D07ED17D8997C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 0d460a4358f1a469bf81b826f25d3630685a811c52401a088744901c2be075ac
MD5 e3c70bb095768c359184b0b54e5bec42
SHA1 a41d4f513fad7285d36a6d037ab4138bf718697e
SHA512 d014caafaa0591fe910ea46ac889e06089244f3ea6094cb627f991a073068c6eb760f8670385974756f4082cc8ba69ec63b80fe66ff55c78fb45059ae1eb5cfb
SSDEEP 12288:GEP3RnciHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:FnunCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T1DCE4126D239E70EDD02AA17D85D5C559E3B2F0701B2567EF2A90863E4F379E91E38B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 fe7f7c22f7e9abdc8c1a13ae45eb8315719a4719d481e005249643921fdd9922
MD5 50079597463a06cfbcdff25f690bf44a
SHA1 62549aab0e694d9de927d38fe3c03d47f03f6297
SHA512 9f82988e8f21010899ca6a18028d7b558b22255f64d1633ffd936d2684ce8761d68bf6ccc06b205c5689636edc1e06fccc1cf3a82df5c9ee84175f0b7b255740
SSDEEP 12288:pjkyriHQzNa6CEiHZeFvIdkGmIBR4Q133DMbHg2VxNPmNw6xBTz:pIyLnCE6ZeFvIdkm4W3uHfVx5mS6xBf
TLSH
T196F4120423D951D9E93A523889AB91B4EA79BC304F24A3DF6980BB3F5F37AD45D30B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\System32\msiexec.exe
Size 1.4MB
SHA256 2eff35d649ee2f6ac11dd7e13d21b63341dde3ddad6073863ea90bd62d5aa074
MD5 554bdc0c0d01d22636c3b65a5d4ce1bf
SHA1 c6445ce30d09f9d9520f724d72d4a79b0bfcad8a
SHA512 2f1d52e33562ef5f1e4d12dacb7358b4fad181ca92f26ed32cb3908e3087738b8c018787186e01ffff3dd0fe8444c387cabb6ef4e195450adf073b11caadb1d6
SSDEEP 24576:f9nCE6ZeFvIdkm4W3uHfVx5mS6xBfjwuNwod9PRqxUu4jQ:f9nCEGmMuHfVx5f6PrNwod9cxUjQ
TLSH
T16265235C23D726DAE416D2B187FE50EBA561B9306331EAEF3845C67A0F275E50E30316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 fad4534eb26ff0b18590c3ee7b9cc1f9f6f0aa8e95268970c8c86feb7967b2b6
MD5 422d99720f37386a48d825abce5679b3
SHA1 5a059e1a4c067e007f73c844afbad85162724e74
SHA512 bd5b4688c9208cfb57d7b6587b5bddbcd5d7d4d3aac05e2b27edaa31b23b27ceaad777cdf9bfa348ab0ad295447383a3fb790df4620b4bba895d71290d28552e
SSDEEP 24576:9bAwuNwod9PRqxUu4jQdnCE6ZeFvIdkm4W3uHfVx5mS6xBf:9KNwod9cxUjQdnCEGmMuHfVx5f6P
TLSH
T1615533AC37934BDEE409D2F183FEA4FBB8426730A171FE997C06A57216175660F3124A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 58cc03e633d6b13d32baeeb78ed81efd1914333b33e1e43a4b7f1ed19be82727
MD5 a25cced8765677725065761b40ba8e39
SHA1 4b348128866a267bb73deb5943829a6782d5d283
SHA512 dfdb98b6d3606681ec3c2802fca13f297da3cde3fcfd9a48acce25f67b2919df103bae671370b9b2ea0372d888b18e8f43ce22ec87d9d113953c48d6b22a430b
SSDEEP 24576:lQ9MxZKdcz9dw3QnCE6ZeFvIdkm4W3uHfVx5mS6xBf:lVKZQnCEGmMuHfVx5f6P
TLSH
T1F5558C2DABE9059AE177D27594A650C3A633B4301B35D6CF2448D03D4E7BEE8AE34F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 783eb3e8bcaed60cb6b5917950e0709488b1bb9e8a510880bdbde8c71c95ac3f
MD5 a440f14b0ba56fde83ad024f02c7cc15
SHA1 5b178b0a1b4781928617c405323ef55a4ceb8f44
SHA512 370b159485d6c8218c8e2e6efb89e7880f423fed8501f10427e01956d95eaf4e766b5a3c4815e275e80cf42302a85f9aff0c2ae9affee2d1d916031c473cb3cc
SSDEEP 49152:rTDxR+N5YzT4jMZnCEGmMuHfVx5f6P3Nwod9cxUjQ:zu55HmMuHfpk3NwPxIQ
TLSH
T151A5E12E67F905E9E1BEC6798B23C512FA727821033193CB4260C17E1E6B9D85E76F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 7a6608af0ae35f5d176c4dc0b8772d7cbb746c00d7bebc37b0a62aba3081952c
MD5 e2e0650665d7c12ddec17091a430ff59
SHA1 3bd6b733388bf45b97c28c2d12551fb914859584
SHA512 8c75898335c43884eca34f9cfeb35f13ba364960cdc2396235013aa7d0b2b01a4a14e71025a204864b8204fa89944db644456bd92af4d55c7a5f7580af027917
SSDEEP 49152:90K+hmSLanCEGmMuHfVx5f6PoNwod9cxUjQ:sHHmMuHfpkoNwPxIQ
TLSH
T11575127E639E04E9E43AC27DD6979847F57234710322AADB0690C1792F5BEE43E39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.6MB
SHA256 3d6940b4d9fc85d534b0dfd11973f2c8246924d1af86e588cf683a6e024829bc
MD5 4c4028bac11363f8301ec6bf65e49cad
SHA1 998308eb8f737e990c464647578c02f7e0ffa53f
SHA512 d2dcc6120491bdc23b211d446be683181098822d81136a707c41037786f5c3f3e052ff8cf6bb2a713aee1caa9c2c9e190e938f1dd341e988646817e54d313143
SSDEEP 49152:nJnJ5DGQPgNwod9cxUjQdnCEGmMuHfVx5f6P:UNwPxIQQHmMuHfpk
TLSH
T1AD75023CD29910E9D477C3B4829E1696FE72343D2B22AEC72864D5353F12EE05A79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7a68bca250d612b.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\d7a68bca250d612b.bin
Size 12KB
SHA256 59a8ecde84b2c40e5d86864bf03a091fb02532bfc49d93e3571d47ab01ab58f6
MD5 88dc51ab5843dd9f928a38214069542e
SHA1 c99721d1890b042492225306679e729df5005b6c
SHA512 2917a97843982e406e639e113dc544c284e26a90e666d4f00790aac1a8b92b28e24cf98fef196911879f0e039240304e4e4204ee3c7e89360b50642452c850b6
SSDEEP 384:qkr5dUwWFyURX1pNXQvT5TSDrQHUXxWzEf:qkr52ZFywX8kCCxWzEf
TLSH
T11342C0A0A15D7BE4A8C80ED752EA7125A8446DEBB88001CA4797DA490E18DF821FDF9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.9MB
SHA256 6b5be8566f2fc512765917c26771d6ba32befd0d6dcd2edc187c1292f39e3085
MD5 5d7056ab849b2de61face9c6116a1fdb
SHA1 2fdf9be91e86144a4106469f07c3179f4d84dea8
SHA512 7436d86327f17648d692eb091a233ceff18e8d9596bdfdc4faa6fceb246f3926a5547316c8fd2aa5599c10fe5a7a3ade40ebd7d6fd35d124d27e9a692675e174
SSDEEP 49152:FPgnaTk46pSR/jnCEGmMuHfVx5f6PtNwod9cxUjQ:FYPHmMuHfpktNwPxIQ
TLSH
T17C95E12DF2B910F9D8AAD236454547B5FB7178291F209ACB0170C538AF0AEE84F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.0MB
SHA256 f066dc389f1bc3c1da0701bab1cd3fb3fefb0229a376671acb6e91572d4e2f3b
MD5 82f1ef0aff83e7f7bb82b06fb83e602b
SHA1 c9eae8a11adb9bc67fda070dec848145db20f394
SHA512 e873cd109e31b564e3c13d5a49887adbfe672a85c84693675ee1839c8d4f222dc6aa4639f5c33780c7f3748567bde1e5c3c4aec91239b4cd1f193414d5a003e8
SSDEEP 49152:Xg06DIKdwc+eQnSt65aVMnCEGmMuHfVx5f6P:QDHmMuHfpk
TLSH
T145956C15B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/332-94-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/332-97-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/332-88-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/332-233-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1188-122-0x0000000000550000-0x00000000005B7000-memory.dmp

Download

memory/1188-117-0x0000000000550000-0x00000000005B7000-memory.dmp

Download

memory/1188-125-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1188-278-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1592-184-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1592-401-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1824-404-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/1824-225-0x00000000008B0000-0x0000000000934000-memory.dmp

Download

memory/1824-234-0x0000000140000000-0x00000001401A0000-memory.dmp

Download

memory/1824-231-0x00000000008B0000-0x0000000000934000-memory.dmp

Download

memory/1836-215-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1836-81-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1904-441-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1904-530-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1912-167-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1912-165-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1912-159-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1912-396-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2064-99-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2064-105-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2064-250-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2064-108-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2160-490-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-491-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-495-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-516-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-497-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-515-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-514-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-505-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-506-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-507-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-496-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-508-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-510-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-512-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-513-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-511-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-509-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-504-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-485-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-501-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-503-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-502-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-486-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-500-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-499-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-487-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-484-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-483-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-482-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-493-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-492-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-494-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-489-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-488-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2160-498-0x000001DF93810000-0x000001DF93820000-memory.dmp

Download

memory/2724-50-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2724-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2824-478-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2824-445-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2824-537-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2824-462-0x00000000018F0000-0x0000000001900000-memory.dmp

Download

memory/2824-446-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3316-48-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3316-51-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3316-176-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3316-42-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3352-362-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3352-131-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3844-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3844-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3844-190-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3844-62-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4000-34-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4000-26-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4000-35-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4024-80-0x0000000140000000-0x0000000140289000-memory.dmp

Download

memory/4024-1-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4024-9-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4024-183-0x0000000140000000-0x0000000140289000-memory.dmp

Download

memory/4024-179-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4024-11-0x0000000002770000-0x00000000027F4000-memory.dmp

Download

memory/4024-18-0x0000000002770000-0x00000000027F4000-memory.dmp

Download

memory/4024-177-0x0000000002770000-0x00000000027F4000-memory.dmp

Download

memory/4024-0-0x0000000140000000-0x0000000140289000-memory.dmp

Download

memory/4116-71-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4116-78-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4116-76-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4116-65-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4116-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4256-154-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4256-381-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4256-398-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4460-403-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4460-216-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4460-217-0x0000000000D10000-0x0000000000D94000-memory.dmp

Download

memory/4460-209-0x0000000000D10000-0x0000000000D94000-memory.dmp

Download

memory/4600-442-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4600-536-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4644-402-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4644-199-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4644-193-0x0000000000670000-0x00000000006F4000-memory.dmp

Download

memory/4644-200-0x0000000000670000-0x00000000006F4000-memory.dmp

Download

memory/4960-124-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4960-22-0x0000000140000000-0x00000001400AA000-memory.dmp

Download