95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
Size 1.5MB
Sample261014-ndvx2sb18x
SHA256 95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a
MD5 9147fa60376bca797bf94044b5e93f95
SHA1 80746f889c4056e5cc1f0839b34b023b32f66a9e
SHA512 c8c5999d499b517b63c773b6a375f3a7a313d5e827250736c94b40cb08771ed7aa6e3fe7dc98dd8e548be89eb5b5c1076a7b832250c3823c46c017514def0c24
SSDEEP 24576:HPV1jbkIx2foooooooooQSnnrFb4PM4MYgLxEVyGL1:t1jAI9j4MYPVyGL1
TLSH
T14A75D022A7E816FAE977737589624241E5767C024B30CEDF03A1117B1E2FBC4AD76B60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4640	alg.exe
3264	DiagnosticsHub.StandardCollector.Service.exe
1644	fxssvc.exe
5048	elevation_service.exe
1792	elevation_service.exe
2544	maintenanceservice.exe
1544	msdtc.exe
5060	OSE.EXE
3488	PerceptionSimulationService.exe
3808	perfhost.exe
820	locator.exe
1672	SensorDataService.exe
4924	snmptrap.exe
2732	spectrum.exe
3024	ssh-agent.exe
3812	TieringEngineService.exe
3520	AgentService.exe
1136	vds.exe
4772	vssvc.exe
2880	wbengine.exe
1068	WmiApSrv.exe
5096	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\AgentService.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\System32\vds.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\msiexec.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\wbengine.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\System32\alg.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\966ce3f5862f6ed0.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\locator.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058048a9ecd5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f6fb39dcd5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc70949dcd5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da3e859ecd5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004758929dcd5bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000072684e9ecd5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e3ca49ecd5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077dd639ecd5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3264	DiagnosticsHub.StandardCollector.Service.exe
3264	DiagnosticsHub.StandardCollector.Service.exe
3264	DiagnosticsHub.StandardCollector.Service.exe
3264	DiagnosticsHub.StandardCollector.Service.exe
3264	DiagnosticsHub.StandardCollector.Service.exe
3264	DiagnosticsHub.StandardCollector.Service.exe
3264	DiagnosticsHub.StandardCollector.Service.exe
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe
5048	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5040	95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
Token: SeAuditPrivilege	1644	fxssvc.exe
Token: SeRestorePrivilege	3812	TieringEngineService.exe
Token: SeManageVolumePrivilege	3812	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3520	AgentService.exe
Token: SeBackupPrivilege	4772	vssvc.exe
Token: SeRestorePrivilege	4772	vssvc.exe
Token: SeAuditPrivilege	4772	vssvc.exe
Token: SeBackupPrivilege	2880	wbengine.exe
Token: SeRestorePrivilege	2880	wbengine.exe
Token: SeSecurityPrivilege	2880	wbengine.exe
Token: 33	5096	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeDebugPrivilege	3264	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	5048	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 1028	5096	SearchIndexer.exe	114
PID 5096 wrote to memory of 4228	5096	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe
"C:\Users\Admin\AppData\Local\Temp\95d21c7233945f31daff2e8ace2c8ad89c8e6ae053bec7de0b6341b9bf7e908a.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4836

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1792

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2544

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1544

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3488

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3808

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:820

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1672

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4924

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2732

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5112

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3812

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1136

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1068

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1028
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f8d006de838decd28ac56dbb297581947ca261e3f7ddf2eb9a276a35690f2bfd
MD5 adf83a4215448dc6304865c37698f129
SHA1 ac01b29620ade89b6f4b012a7a2b84bf1857e071
SHA512 8b37acb69316d702837cf8e5cb5834a55bb68d509f51a2eea4c11e2d9440a3eb4dfd3a028e3375937b1e3ed43a88d02280cd2f3fdf8329aace1bf19c0fe42cb2
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxndj4MYPVyGL2:P3q6HjBZV6
TLSH
T187D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 2a65f8eb42a70fc3e4f007c9e52dc2f6750c1cd0041954f878c44d6deee95f56
MD5 fe7799994e77b0e8dea54c092cf1ef49
SHA1 4f1ea65aae9f77954f021c2d2fb8d56975f8117c
SHA512 17bc9e633707917041e27542857eab7ca9241502839842572ab249325b8a07304f0b3751c2c9eb5b796a16d4a636d7a494134aed64e78950e46301b8d57c3925
SSDEEP 12288:01XLsswWkxy2lRq2czA034XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9q:SXYfDtczA/SnnrFb4PM4MYgLxEVyGL4
TLSH
T11B65F12977E408F9DD6B8278C8A28555E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 342348fe4d8c9e5b74edb148e6fdf651b3ddfab7733f2c53adf625eff139751b
MD5 2b1ce2b4be036e49738413f3c0eea821
SHA1 afddf5263fd8b5ad42a80bc86d81bb2cf968a0dd
SHA512 b1f25fdf1a7752808c98515e33ca8252564bb1b1bf37c6114da04eb3edb9ad44abbc6dd4531ecb3234230cd4f196c6ffa52e622ec4b4031c7ae965ebe2941c41
SSDEEP 24576:70Le5ji0hmxirMaSnnrFb4PM4MYgLxEVyGLh:7Pji0Acqj4MYPVyGLh
TLSH
T18F859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f030d3ec2e71df2accfbb9cab9e175a291e7d622b20ffe029870c14ad4ff05ec
MD5 142866ac1130e8f7217d88e4983d773e
SHA1 ccfd0e205ba7acee8c6c5c276d980f323e3fb6cc
SHA512 72a291b0fc6bc2200afc57dba44b0e7fdcf6802ccc0c783f7e747d9ae7fa5b34d965e1f7258c5b3a8b30ba32d33975d22df94c5625b7bd72e596736d78a5307f
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWE6q8wyu4SnnrFb4PM4MYgLxEVyGLP:b/ezSC6vUzPvxHjyWj4MYPVyGLP
TLSH
T18A755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8dea8658ea2ce54ba032e03cd6ae03e8d16ab0b28c4b8c5f7761fcd67ca5a3fb
MD5 0495b85c56d299d7b03aa5491d9eac0d
SHA1 9d1db17713a4198f98217d84577f3bb32be84aae
SHA512 7013161288d418cfff7ad623d77f02b1cbf888d2807090e643b84a3c8c81148037be77b91e483dea55f5fa0b001f8408cadbf56e4ec2ddffc0721d3efb20a2fc
SSDEEP 24576:oVbqPb88hv/l+6TSnnrFb4PM4MYgLxEVyGL5:oVO88hXl+Rj4MYPVyGL5
TLSH
T1F1559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4bb0e4bb8e46b99ee620359bf1a2e50111b2b7534657b0e1b7ec6684d54f6ccb
MD5 548fbfeeb1411a0c67237725a447e603
SHA1 430fe5a359d1e70af00a34e1f9c2cfa0ab9b26f5
SHA512 b2e61ddfae041bb24f925d72df2eead48b2993db0b055af18e61b635b662fe7ba99f8ba517d4f5309bc87e1a9acc3a8d838adb102e07381ea0c0b9c6b9af9ee1
SSDEEP 12288:qRZ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilj:qReSnnrFb4PM4MYgLxEVyGLN
TLSH
T11E4523A72BDC10EACFAE15B0D1B96AC8E215BC61F875B20B6750785B363F60DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 814190de254101269b4a544232b94ddb1fab99fdcbf542a95ab530271668ed4a
MD5 275ea011597f3c5b73952b2cc1baacdd
SHA1 99e64578f6199c9953bdf942d5c90cb29cf9190a
SHA512 6625fdaa57cc12c4ee09b4e1c31b65d338c1967737b7e55cb3ffdafabf7a9bc212ea1b5230704d5a5b0b4625f9bc772754ba4a1606aec8ae75f4d4ee4a280887
SSDEEP 12288:ZeBNUbTVO86UY34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:ZJIUrSnnrFb4PM4MYgLxEVyGLX
TLSH
T16B65D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 454c4421d78806be0703bc20c4162b078d4acc73e0c0264351b00fc2c45c3628
MD5 4d9bbb01677e37c2baa4a1e50af35da5
SHA1 b28371e39afb4e24dbd1d3cd9ed7cc253eb482c0
SHA512 83842e2f4f5e4cc8c90cb880cb12b59eaf078b54c74c96e6d6fe37d84674d4db12dcd54181e37fea787b4df387d9d3bffa9133507b7f9eaac6491a879cb51a1c
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THc:8QvGAdlCEL8c/yRNw5C4V8
TLSH
T194267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1642d9323a0742483ddbb060dfa444f1f2787597afb9c69ccad56c17229a96e0
MD5 a6803c1fabac1b35444a2189185e7c2c
SHA1 6fc79e3889ccdb662d78cf82b3bce3ed81b09807
SHA512 7a83333acef6defb455098b60e45903821498b2e79b438391705bdf8ec90124b0e8827f5cdf2fd4180a69375e191aa1208777c8b85ebfcb2d4891557fbf2ae3f
SSDEEP 12288:NAwSfxL/2Dc34DLLmt0LDQewsAjy34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAz:+dewsAjBSnnrFb4PM4MYgLxEVyGLc
TLSH
T1EF75E031FE74E036C7BF0DB21B36D716542DB9204B612AC3E3A89D9E59342C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2495c66add11185f1ffc6521c12ddff7f8c14a9bae48fcf4aad4b1a75359d1d3
MD5 0787ae61d22b98aaa4ca41e3cac539b3
SHA1 4448728e5f4987f884664b63b7cbb662d8788cc2
SHA512 592619e2a36c5484075cd33830410b9de0a2488a94ee82715283cf570ed527c3bb7f5d462b65ae49769cfef05582dfa44d4278b5b7e711e3aeb3aedda457a223
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:CUEtQevvqc2W1cpV2EI32
TLSH
T197474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3a97b7752ce75c5facc9e732ad8e3d5987044391a4cab810951e4fc7f773e2f5
MD5 7c870e84ccee2812267ffc885b0c537c
SHA1 ab9b687b4a293dd0bda7ff87bcd96ba716b77654
SHA512 a7df3e2c0e5046ca3dcba4387673e0739506bc038ce98de67fcd53c2a71474b03da2e6f1298e40bed419711ab53cac0ee675f6f906cc050d04596757011d21bf
SSDEEP 49152:3CbRquA/m2yL5zQfFiV+XenmE3/zaj4MYPVyGLl:goqtVjnm0VB
TLSH
T13BD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 13065b128b4310253bb5d20d154119fa0d35477120c1c9694ac0abe36c3dfb24
MD5 d586890aeae99e2a4dd3c4fb114c30d3
SHA1 13f3c9e1385110b11ec9b9888df7ac9cf493cc3d
SHA512 51d06da74dcdf0eec20f9b1f3c9d6e3733613f586440203e4a989e2be9dfc1e28b1a1b42516dc30849ec99335bbd68de885f036f120085b3122bb55e653c3ac3
SSDEEP 24576:BAhGLJIFoiwtA5l7S530SnnrFb4PM4MYgLxEVyGLb:BAMyFoiq5Xj4MYPVyGLb
TLSH
T18735AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5781092fdcb91e6ea8b99ba33ea130451810cc5eb46b5c150b029cadd63c6204
MD5 03ad5ecc3113f2b03a60436cb36b878d
SHA1 1e1052e38e319256623fadb2e23e927f09d5a0df
SHA512 4477e4045786e8d93fffee0cd13937c802199d51438950e29226e93ca04329de975f56fcba64c5000f2930b1e57682d235339ea4cbb19587f4083a2e832d8b86
SSDEEP 12288:0mw5HEjsChNVBFgl0WDm+CX34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqH:xwuoOWdSnnrFb4PM4MYgLxEVyGLh
TLSH
T1A465F14637E81CF9EAA74234C5978536F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 febaef41d5452ad37e5bf1fe08a106071631790981ae942e48f2b8de751fb6b9
MD5 4ddb05697303a790beb42a9bdf68ca43
SHA1 dc5c021ecf4fa590fc4f23666b856dd5afccee06
SHA512 67e1b79586600d9f1522695b81dff6730afc19ae6566a195cc4c95852df10db9754dc5abf257b0d366fcc585a5dccc8f6658cefb1437e6fa3429e8d5f0a06ab0
SSDEEP 12288:YBZ1IyC34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:GZuySnnrFb4PM4MYgLxEVyGLY
TLSH
T1815512AA37E820FAC6AB4274C4F55688E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3af7789888b5a51b7ab17542e05f543739581fb4a6b6c2fd525e6951e58eb7ac
MD5 7291ccc9c872cae5934716d780166b85
SHA1 5cf9399ddb2fb882263615d5dcd762c1eb65b155
SHA512 563473b7f61c8648d44e4a4b44964385ad6ce589e53be94559520fa635f2c13c4df23d74e84371ba7b679247ddff8e7f103f4c5459bfcc3591eef3e4fdca69d3
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U7:yQRQyi36YOcPQLvw2gAf+PN3tVH
TLSH
T12D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7b6e1507400e77a6c5904bea31403b873586d113ae1256e0470271bab45dd8fa
MD5 7c2646deca4fab1385fdbf42fd309a4f
SHA1 37607c9e441a117cd8d73583d48f404fb9d08475
SHA512 66a87f3bfa02e6b893a3646a0da8457ceb2dc6f2645d10c4e766e19b980de73ad5f27f1709a21d43a4db787da96730da55fcd13a7c7fc8b127bf9f6662cec3bf
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uq:8QRQyi36YOcPQLvw2gAf+PN3tV2
TLSH
T1CB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 948888d65774173c754f42f8946751846256cad0c3a7fa074edda613f4886363
MD5 3b88a13f5ec19731573ec9c85066d3bb
SHA1 9017ae699c27db8cc09117c6662cfbd199206417
SHA512 7350102b7a0b7b25ff716678a7b5c29f3aca99e7675515b7f0b195deb55aa06aec6fcfdd75c63273ced9eef5844d551c30f0b4bff7bbf4be921a9ec5ca4fdcbd
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0iSnnrFb4PM4MYgs:668Qg55nhheWu7PNU3/qj4MYPVyGLD
TLSH
T1C3B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 03a56f3eb33df0f9f351b57b82b1dc86bae991efbcc8070b1d541724aceda1d5
MD5 6c215f210969010d753bc387233cd012
SHA1 0eca309480a6978ab3c4a2ebd4ea8529a45b1a27
SHA512 85fa2bb10cf13a9d314e2afa96826950ddea1d44c4003ccd41c85a521a9f38a8162d691b9146a89e7fb0d9d0b009c6cfa28e2a02893601e93c2c6ab63b66b10d
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99i:Qy5112gYy5azzVvL69nLKnhZiVg
TLSH
T1AC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4d4203dd0189c6e335e63d25699f7366f8ae84de27b21c59b04b458a4556f6b8
MD5 241ca3d070110e7a6760a27841643839
SHA1 cce9a061b1897f43f7ae62a18aa18a70145e64c2
SHA512 c16364883c12b7934c8f7a52c122b4ea82b0b7879eaa229282ff32d61d1b1469d2dfc019acfa8e3c79c985010c24fbb54015c90fc8e06f41ef3fed0fc1298c40
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glIj4MYPVyGLb:vu6JmVxd2d1VH
TLSH
T11ED59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2ce9fee733ad5a97a6da74832882be6de907aaf014efef54a1b6647ad39e013b
MD5 b70820a9b8787da1013b484d9af7adc8
SHA1 70fbd52df7fb98c60130cb018d6a84b39f44f55d
SHA512 5f84f5f60ad8073122ff14be9553680db11a798260c8859ad8819f658c30d23987b9a1365ca2d1b74adb62c1d34b2b6dd6448cfc1b0cc9db5d9e1c14c9bc4d62
SSDEEP 49152:41hpsNoJpF1A6UU44CwH7R4xUj4MYPVyGLB:4mifPbR0V1
TLSH
T10BB5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 311954ed81413f00953d1412ba462c71996b76832cc4d6437bbf252e661184d2
MD5 f845a80b3adae943f9f4d93b0c78bab6
SHA1 a7e2b5a19634659faa8e6807e2ab51136e0ab57e
SHA512 4af4ff8137e400ca53201adb83341df97f9936ee900089063514569de65e63003ef29b2566ddc9fcb6ebf1e849afe0ce2cf6352a25e39659e2ae47cd28d7c7cc
SSDEEP 49152:iSuZQIY0Be2KRRVtOnks6NMHqtj4MYPVyGLb:85dKTi61WV/
TLSH
T1E2C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 19603f8842ed1c78760597a83cf881c3a4bc6967fef8061c62e5081ddd77ee3f
MD5 27d4a76cc78db1f1f69b738894e2f5ce
SHA1 ba58710f0dd4a4d10dfba1c8fdb9415e9dabdef1
SHA512 36b1bdf439bc3b5b538bdc8576c3edb2c5c4ac55f5e7e6197b8fcb72bfb6e59dfe2bda729529d6854273ba8688b7c40c1a0226d6625a15225f6dad8c7ac72465
SSDEEP 49152:phtSn8EApI0figngiDn0AP5wYj4MYPVyGLu:YX2iyphwVa
TLSH
T16895BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 23495bbc234ec457ce53a77647eeb4178861273323b1dac7fffa5340033a26e9
MD5 bf29f0df49445319187cddf13e853275
SHA1 4f81224ef993c99e78b5bd914b69a831a12ece0d
SHA512 6c3156c4353924ea0af42b6689aed1453d7262f30db286659f00cac393c210965418b35f38bd1129a7938e2fc1e2ad4774ab6ccbb63784a5c48fd33df44ae8e8
SSDEEP 12288:jx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il6:j2SnnrFb4PM4MYgLxEVyGLU
TLSH
T1154523A62EDC10EFCF5D16F0C1A966C8E2097C62F976B20F7B4574173B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3c52f580d640cfae7dcd0d89d76e76609657233f918cc5b2267af7d47d05c6bf
MD5 0d1666c26ac732c4e7687161cc1fca31
SHA1 02704dac50ddf113da7c499677044bcf3c5cc637
SHA512 f8ec07688253b8ae28520c9f8dac594270f6a5c72d55e37af76fd01f15d065da16ef5f6927dfe2618cc48a1d681772e9a6d0941dc3a442be32b9e07a4034a4e1
SSDEEP 12288:6O34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilH:6FSnnrFb4PM4MYgLxEVyGL1
TLSH
T15F4523A62EDC10EFCF5D16F0C1A566C8E2097C63F976B20B7B4474173B3B60D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 292d42e7b0db1928c3a5d0e2fb87398e0f60edc7981475c62d964c70359cfebf
MD5 8a2146853e8148dd2db605b9b9d01d0a
SHA1 c8f209e8ede4d85314ff66100ca5f50f8e217507
SHA512 d8d288697bafed4275cb24055ca39518e09189605da8d89b63166fcd70029ba8adb8260b8f6bf61d83c908850ad59b6f72f9835e756b22bad782a2260da17baf
SSDEEP 12288:kw34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:kDSnnrFb4PM4MYgLxEVyGLO
TLSH
T1D64523A62EDC10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ea8d99b99520a79ef8277cd245df07c5e302c55a71e1aa6623ded654f1727dcf
MD5 0b2eb54678135065ee27c5d771c545d4
SHA1 146787f877c0d6a7d62c692eeafebfb387f3cd8f
SHA512 9fe9e90f0c4f66bb6362971eb5ecae6c0a3cd180ce6b8ec8ceb214637759361a51249417721853d59c1c58051a5ba71dc7158732997d92eeee09ae2211d336c5
SSDEEP 12288:/Vb34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilM:+SnnrFb4PM4MYgLxEVyGLS
TLSH
T1154523662BDD10EACE6A96B0C1B556C4E225BC62FA72B35F6740381B3F373489C71711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 80c7fa1d58fc84e21bba3d1b79750199a6700fddd67bf866546bfea0145390c8
MD5 933a43fb868d3c21c01854b53a1babec
SHA1 d927456211f127636956af501ad7c599d289c361
SHA512 7198eed5f4ac20fda5107166beb3c4eddefedb7704ea7e864ddb184316a0ff25ecf7a863b0a3ddbbd762ade927ebba56974dd022bf6900aa226393273bea1bc6
SSDEEP 12288:SD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilP:ScSnnrFb4PM4MYgLxEVyGLt
TLSH
T1924523A62EDC10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a643d09daf74bca1846b63201fa0c12dcb717c51636c19bd2a6b67f3796d9dd7
MD5 013287dcd6a5729931571a4cc106184a
SHA1 cb4e0f3d5fa342044233e2300734413c697afdc0
SHA512 91a6f495639532f6c1a47c6c832edaefed85f45d4c334e906af77b3320631983cc6059cfd4c541523e74bb722909700e1a7ef72627187de09d7e1190689f9200
SSDEEP 12288:0q34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilM:0ZSnnrFb4PM4MYgLxEVyGL2
TLSH
T1834523A62EDC10EFCF5D16B0C1A966C8E2097C63F976B20F7B4474173B3B60D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 db51867f7944f45960252141d5d0f5b87af97df726a94c1ef88734d8a9ddfe1e
MD5 0e6134e22794a64ed7f2e25716b788ec
SHA1 9520ea25aa4cb0b88ffd12da7dbf3026bd66d5b7
SHA512 937358ecafe4bc6e341aa20257f380b1350768ccc1d0305b8ab756afe3c2dd5ec8a758084fb460acb8218b4359916576919cfa16336089938ee4e17b7b80db59
SSDEEP 12288:nW34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:nNSnnrFb4PM4MYgLxEVyGL+
TLSH
T1924523A62EDD10EFCF5D06F0C1A966C8E2097C62F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 da4e22784af2c3c66f64c96fac5721124348703f039ef5abdb0d59d815daf15e
MD5 0145968c86c165d62452b705b2d4ed8b
SHA1 1e7fbd5af1e9f60319e1ce20fa063d703a6053c2
SHA512 55de040607bc0c6b8379b9a15cfde7563051c90ef70e6adbd89141c978931032be8dd9ca8def7b3788c7090d4e69e434c11082bed79feac4e03ab332bed48c8e
SSDEEP 12288:qiZwb6zzFEoS2cPvyu34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2h:NZMSzFVSOlSnnrFb4PM4MYgLxEVyGLI
TLSH
T17A6502A5739018F9DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 019591d2fc286b45cfaf4c8a490b4580b6d3d717a4010df817f3d20e76fe7bcb
MD5 c3e628f2bb322507df2638f45ccde5e6
SHA1 97b5422662a05b033beee4df4c2c1f8ce60d6ea0
SHA512 b62855c6c79d173cb33b09a0357131241265fcaa05758d0965b0f8608f8fb39d5aed78b2f2c5f797f08bf0de6bc88219e4503ad02fc0d357e7ee1349a3452e45
SSDEEP 12288:5F34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il/P:5CSnnrFb4PM4MYgLxEVyGLRP
TLSH
T1C34523A62EDC10EECF5D06F0C1A966C8E2097C63F976B20FBB4574173B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5c536f1742dbdf502735b5accedd26afd45c3d1b48188835a5445e92c5e9e3af
MD5 1af993bae7f487b3e7e9c7eb53fc1e60
SHA1 8cb7faa27c7e9e5a528c58162954a6b55670868f
SHA512 11fcc7b5aaeb5d52f856b15c9dec39f2e4f244c4cffc86917cc3f9b9f8f2246c1852cdc3dc3a2e6a801c4b508d66537c084d8d9705c2c131cea9b54032510b51
SSDEEP 12288:6p34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il/P:6uSnnrFb4PM4MYgLxEVyGLRP
TLSH
T1974523A62EDC10EECF5D16F0C1A966C8E209BC63F976B20F7B4574073B3B20D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e55e597c7a44aa5af93b8e21c89e749f2e25071d2f940949d361ae81b2149ac7
MD5 69042a6855b3357a8383a7bc0b1f02c8
SHA1 251671ac19eddf5a25e50a2c1575d3095fc8eef6
SHA512 9a468a1afd9e7403df927d44f00d1d1b28309dbf87d203d0b256d234030428c00ab98155df748fe03c0afbc437e71ed507c6c970a2a8611c84bccb864c13a3de
SSDEEP 12288:5yPz5L8C34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:4zyRSnnrFb4PM4MYgLxEVyGLc
TLSH
T16C55025737A530FDC67A8274C4A21A45F336B8329B309A5F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 85227219f36287542c88041620740b0703f5764bdfd902e610901b34c18fe53e
MD5 586484de702a70f3233023fe20e9132d
SHA1 8f20a02cd755810b6cb6ac0b6125a3195ec1943f
SHA512 852eab47d2b4442dc31c311201d8a0b6ac6c7758436b41fe20d5d0d0e194847514cc30c630586bbd8920643bcc069783bdfbf53cc0a93b69c62576776a8ecc14
SSDEEP 12288:TF34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:TCSnnrFb4PM4MYgLxEVyGLI
TLSH
T10F4523A62EDC10EECF5D06F0C1A966C8E2097C63F976B20FBB4574173B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a3a9d7334f48822bfe9713f82b383316cb14455c414aedf85b0f3b26c14c32cf
MD5 5d559b442af8de300741f5a038c8241b
SHA1 186e03de521a535d7dc30015bcd950bbe8949fa0
SHA512 da9b207a8eafa82a454f7c95ac66a6bf23836bb59a66386b2c8585b1e85ca13bc2317fd7df9c9a8347548c3f0494501e312e2c3c7f95fe85a0c6ef485a4b6cf4
SSDEEP 12288:NF34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il9:NCSnnrFb4PM4MYgLxEVyGLX
TLSH
T1604523A63EDC10EECF5D06F0C1A966C8E2097C63F976B20F7B4574163B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 5c510449491e65e2a79d15ff3cdae9d3f9fd2bdbf79951eb390642cfc10de433
MD5 46b6223822c79ad518e990c7b8bf5c6e
SHA1 ecb57975534474bbfa542a1b7308012852a1ae44
SHA512 f8eee9b020da2feb8e32f1220611fd2fd703d2060bb8f29aefc6887f19d65dc80b541767dd70a9db7934e0009891e50fbba1538dca364363f2b3f1786297ec6f
SSDEEP 12288:nyPz5L8C34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:KzyRSnnrFb4PM4MYgLxEVyGLl
TLSH
T14F55025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 df2fa045588f279c0367216eeda11ff85a3f3c4d5a80e067e88af951f904c542
MD5 82f7f0026746edfd97fcbe0bf73c5b6e
SHA1 5b1b8d374abea1eaa741ceb0ae1478276ae4b846
SHA512 b0e8273088d213176ef870f2b5ec610fdad735f70b24bfa93cd0e228a59baf00e67d7acd62196ccc1c22158be6daf5f7a1ed5193409eb0e049101bcfd0f4d6af
SSDEEP 24576:iTHaLl3z0zDzSnnrFb4PM4MYgLxEVyGLt:iT6LljLj4MYPVyGLt
TLSH
T13C6502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c8f104d69d397361b3391f7df7b38caba99be6cf199474304c4feb7a94a478cb
MD5 e987588762ef25a2a624edd243cf2853
SHA1 3571bea9b0fee89d9501f0701c51e16f6b3518e2
SHA512 8ef4d03e54cc48d9418a1c747e03c9382dee566ced3bc24301772479b020dc92e8890923ffccbeaeaf83bf4da2eb0c39b69678e2f6735991e05c252fa79dd8db
SSDEEP 24576:ucP4mcvIjkGOxhKP2l71nNKbrh/8KBKSnnrFb4PM4MYgLxEVyGLy:JP4m4IpOO67W8Kbj4MYPVyGLy
TLSH
T11465AE2DABDC0096D0BB917485658A49FAB1742A2F3286CF1160A33D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 fdf094c6fab3308a3230c7db072264a6a163a793ec5a9c6f45097c74ee4ae8f5
MD5 a73209a2c7f8240a58b8a8264ee4426c
SHA1 1b5210cb4d6df69262e1f7eac4d846caaa5ed0f4
SHA512 3b72dc30215d963951fe390062eb4fd4277aad1a570da537213dbb81acc989e563cd46a0b16157de820668b81b643a1be454d971fe99d227f175c944c80cacbc
SSDEEP 12288:yNsf134XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ill:LySnnrFb4PM4MYgLxEVyGLz
TLSH
T1A655F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7d9234d622c53d7ecd1ee360f0904b2962fb41c8accb0ea9482d1b70c5200e10
MD5 13748ce08583bc6106136d10f564c6d2
SHA1 e3bbf095d8a4754c430f050b5516c51a8ec82001
SHA512 c6ba7ce671ee594c6fca68c525416b85e2e3665205cfe8f0a4b962a6d3cc5ed36fa394d56cf808d7b522a4e8e18cc4f2265e556ba80ec56f08d968edb142a3f7
SSDEEP 12288:DV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:DSSnnrFb4PM4MYgLxEVyGLd
TLSH
T11E4523666BDC14EFCFBD16B080A596D8B20A7831FE71F10FB740741A3A3A6499CA1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 45241ae1fe5ecfdce9f8c8b37f13185d6b2a0aef125e0233a7e8ebfa45004bcd
MD5 db6a91d4200738ad3a8d3e88150455bf
SHA1 4c9b19159daa2a7c8987fc19f768f2656cfeec3d
SHA512 5d6e6b9b8e1081f8b25b0d2103e50374cb6f2c4d9bea1e525f179b4aa725f827358f3f6483c695548e17f19b37763a929781dbeb8f11dcf06a3cef74bc2cbbe1
SSDEEP 49152:Ba0h2GEkuAe73q3pp46zwwQPj4MYPVyGLY:Ba0hNYG4JwzVU
TLSH
T15385AF1E67EC82B5D0BAD278C9A6814BE6B2B4221B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 1535d69f1c360afa5923b34721144056862df256f43c009ed1c74ff32d9014f9
MD5 b7b6f660e43699ea9d54cf2b696ba8c0
SHA1 71235a7f633788db3cdf3bf0a4267a633a88706a
SHA512 90e2b45c24bd0d2d117a55e4eda6062dd6b8f6f552c6b2da610600a29fdd9325eb48edc1accee627f4f0fe4924e0424b8859718abd34057d45071ce7046f0dad
SSDEEP 12288:NhbHjfX+34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:NhbHjP1SnnrFb4PM4MYgLxEVyGLl
TLSH
T13955127E27EC20D9E675A1B8C1954689D331BC226721A3DF23C1917E2F3BAC85C35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 06c5c62f74ae0b3228328ef1cdd23e78012d7b62466ff0062acf87a7302d9fe9
MD5 842432f368ec03df89d79e535ca4073b
SHA1 2f8cbc7f7cf26ddb182a652d3d0c545725129cdc
SHA512 e512f51017937ba4cd791f2e1a64cdf53f9370346e2fc03cd1ee13817f2c1b5fe28bbd99baeaaf38aba6656c94ad22d3f7936e6f88ba6b36427210c36f358f0c
SSDEEP 24576:k3YgnJcRTk4yti+R5dBR/dSnnrFb4PM4MYgLxEVyGL6:kIgnaTk46pBR/2j4MYPVyGL6
TLSH
T10A45BF2EF2B910F9C8AAD236854147B5FB71782D1F2096CB0170C538AF1AED85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 4dbc90f1062b4326cf4c6dad65ca73c42609bf97355e9eefc4508a1f45ba3682
MD5 3439882557e302359a3df72a53d1d758
SHA1 edad875d4bd21e25427e78aa928a6556f564080f
SHA512 3c9a7abd2c34dae550cb55716ceb7ee7db1c2f438cc6ce7b037cf563bcea37ab16ce731678c923db37198598df6ea7f25dfd80603cc8f5cb5f56a73d2c5b7827
SSDEEP 12288:3534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilH:3+SnnrFb4PM4MYgLxEVyGLB
TLSH
T1EC4523A62ADC10EECF6D16F0C1AA56C8E2057D22FB76728B76407417373B68D9CB1312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 72e9aa432587d340a51f1c257ed6015d45f49e7daff372ed2e2b226c36c34eef
MD5 3ffd1de325584715e3e3ddbcff05ccaf
SHA1 55fb142f98e3a56d2827d9b6d123fa885dc558b0
SHA512 ce9f1bb1445cc84fd9a5e25139dda47d6a383f35d930887f93b579c42751f3ef3aa63d08c3cb9b4d61975ff2c988db738a4be2a0453ecc0ef890c684e275fda7
SSDEEP 12288:FOb9A4LWOsvAYFT034XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:CpL3UT/SnnrFb4PM4MYgLxEVyGLr
TLSH
T13C750155F7E800F9DD7B8138C5A28A16E272B85D1764E3DF03A84A662F233E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 c602f313181da8bcdebb6c3e313e0b9e0a24599c10f301cd1a09e649b2c57178
MD5 8e848357584e68b6d64148ca5f06fe3d
SHA1 9d20ae9f2069c5ee0b65ae9da1d687a4ca66000d
SHA512 b3d33c113e3286ba52b4a4c2ae0e7c584b420221cd8ffdb5d35f33b5db3c5ba3ba7799b29260374d85a595b702ae53b277284bd13feb345820080cb938878ca8
SSDEEP 12288:tpFtpO434XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ils:FOLSnnrFb4PM4MYgLxEVyGLu
TLSH
T1FE55022A37EC10E9D57AA1788592434DD331B8625B2263DF07D0907E2F77BE86C36B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dcd971fdb7abb047ad4629265d074d374c834755e70c80a8b3deda5b52f7342f
MD5 f20c2c85f0bafa7859fa7f00cf68a0e4
SHA1 3cf281256372a35035a1faae8acfa10120fd44ca
SHA512 ac0484759ed7b0fb2b86065d337a0db5a516212914dfb7ff9013954a09feb0837cc044c9e6be386256d1c94c2f88f875b51ceb20df97405daa11ffe32e337ced
SSDEEP 24576:P7NM9YqZqmWMUkPjZM48Mv6bEhsCSnnrFb4PM4MYgLxEVyGLJ:P7cBWMpPjN8DbEhuj4MYPVyGLJ
TLSH
T1E1659E2E6BEC81E5D576D13DC9A28245F2B2B4611B318ACF1252833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f9b6c8ec27aa0514f958390ce742a7172550524f4d4f2d97b1304f89c76daf69
MD5 aa136584b939ea10c58e922ea334f909
SHA1 c3f722f82e1ec37604edb0f027c154f8ef32aac9
SHA512 2a14fa28a50a929bee18b3ad8931a3fc989512f8c70e2b9fbef58b15f60e21da00d33b3f44cff4cfd962620b0006f233108dbe8f72d4920cec01965b98ae4d0e
SSDEEP 24576:BW6BApg2YuyuNDYTabvcdvNYf8km1ASnnrFb4PM4MYgLxEVyGLk:BF2YuHNETovAvNYf8kmdj4MYPVyGLk
TLSH
T12A857E6927ED80E4E0BBD27D45B6D286FAB2B8511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 2d14c1805f56e684e91ba80af6edf814c4dc0af6a2804ba4f519dc3d8f06cbb1
MD5 b41154e23c1578df673fdac49cca6e23
SHA1 45b69ccd623da305f69ca3201abaf511b8e87f5d
SHA512 90162c25ddf331479bd12407b83e26e495cdb0884b05a838fa732e6a4779a521e0176bcc712e4698a169f056f3c6ff8ea65675b6ffe4c59848dd23dba22b3f1d
SSDEEP 24576:sAFs06+Omlf3NXEbToXSnnrFb4PM4MYgLxEVyGLc:BFs060lVXuvj4MYPVyGLc
TLSH
T15565AF2F66EC00D5D07ED17D8997C91AF2B1746307256ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 a695867c977e81b414b6d845b816a501d5245888d8f0a8c78afe1b3b53a6d1f8
MD5 3de2da839fcb46ceaa5b72bc9875059e
SHA1 d1601902c82b1472d7405884e17832ef794952a4
SHA512 f42e7b60962563c85d86127c0fe2fa400803ef14bedfb5870507db0c835b66e5e333a8e6ab72ff58ebbb9b8f72268b8a283d74774f1f77ffe7bc051f9130fe4e
SSDEEP 12288:yCJnJ5D3VkrDzxl34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:zJnJ5D3WX8SnnrFb4PM4MYgLxEVyGLn
TLSH
T12775D02DD2A810E9D4B7C2B4819A1795FF72383D2F226ACB28B4D4353F12ED09979F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c1e8c5771af2eb5807de70e591a0ebaee08398be091726e6f0f6d4c4ca1d0d1d
MD5 7ad941931ef3a0dcf6ba9ecdffb497bb
SHA1 2f94ff5bc18b2e641012a49f0d26f8280be424b2
SHA512 08e71603d0ed8be78d3adbe643cdee82c5345cb05b0426495ceafa9245d27c83266cda6c82658bbb29e97a3c1093d06bae3c8cd0cf9d90b7be69bbd8890bd31f
SSDEEP 24576:kEPghm6/7IIXdwcXrif7qQncjlP65i3VudSnnrFb4PM4MYgLxEVyGL7:rg06DIKdwc+eQnSt65aVRj4MYPVyGL7
TLSH
T189956C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 3f677d9c75d0220b4ba8258e1ef823a5f6a2a6e1f5e93e5e217383ababb954bd
MD5 a77786929f38c0e58fdda7b65f66e522
SHA1 28bdcf0833978c98a3a746d883f453a0d731429b
SHA512 117bde996a241d78cb56bf0706fc98b2302e64bb16b0511f727f3c3ec32c9c4b6d6811ad83185f8ec08fd951625a620decf55c70b6cbec875abe7d53a14d9d00
SSDEEP 12288:qEP3RnX34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:JnYSnnrFb4PM4MYgLxEVyGLR
TLSH
T19055126E2BDC20E9C62A917881A18688D332F0717B6273EF1690D13E1F37AD95D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 17ef907a066d78aa9a115feb371c6a12b5faa6c6ecce5f8721770e2b9cd611aa
MD5 e244b216ff79e3637559d5774b22cdc6
SHA1 8e61e9bc2c2d7d4b2dc3ed6607a416719080db58
SHA512 4bad8218bbe2ff8714f85106bae075a6cf1a13d21f7d81216937d796f9a397b0e08dfe4edeb3e72d066f2d11f7dc4c4edac027450f8c045e9c6afaa9ab1a1e57
SSDEEP 12288:CjkyO34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilM:CIyFSnnrFb4PM4MYgLxEVyGLO
TLSH
T16A55125527D860D9DAB90674C5A682D49A35BC21AF21A3DF6280F53F3F377C8AC31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 7361f502a50eb1db228e81e6a80f2132481d591f3c87e023bfd0a2d76fb95c21
MD5 5c914017fb5118f6751d9788cbd7d005
SHA1 b31fb855cfa206525c638b06e0b8fa5c06245d73
SHA512 1f5eb8c797088ac9dc74af1ebdb8321e1a98ea2ebeb84b83d7ba8bc2a1d4f5278c6957fd951a7a24df95c4e1646c166cbdbc8f5880faa0597a200b23c7b63155
SSDEEP 12288:zyI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:ebSnnrFb4PM4MYgLxEVyGL+
TLSH
T18A45236A2BDC20EECF6906F0C1755AC8E2157831FB75719F76C0B4363B3B68958B1A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 73a70483401d28636f40f6a2e989c07809152150ab1e0bfa1dd4d310a34b5942
MD5 c1cda49ae5e3c51d6e238cf85145e80a
SHA1 b86e320644303cf4e6b31161f64fc9851aaeb42c
SHA512 d5ceb995102fa627ed4236820f8909dd784ed5892db5a22f86b28823462debb562bea099bbd80abd8cc2b30e4a9ab4ec6fa18b52f2591ef71dd258b9c9e1335c
SSDEEP 24576:/Q9MxZKdcz9dw36SnnrFb4PM4MYgLxEVyGLa:/VKZ1j4MYPVyGLa
TLSH
T102557B2DABE905DAE177D27594A250C3A633B4311B31D6CF2448D03D4E7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 fcb057d89a2f41f11348fb4315cf70b409e83457081b533b9ca2821573943626
MD5 402554ca8a4d1d8755fcf2fffe8af54c
SHA1 91abc3ff69ed7ce3299c005506c4f18e8844dee8
SHA512 d30a5c22ed5330b0a877e79a11506ea586222b03d7cc510694500680373765ba375efa7fcf0a143fe0c36863dd9846f0fe3b91fad6b875b21c2f4991a58e656f
SSDEEP 12288:byoKo2JRple9py34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilw:byocDApBSnnrFb4PM4MYgLxEVyGL2
TLSH
T1E165E01F7BAD40E2D176813889858785E773B0306B6263CB6691C33E5F27AE9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c4b25ff273bfa479051137145e433be1569ba4452beca0d3ac064f54aa5cd3cd
MD5 2edbffe83db6a0a5a304fc97d250ac5f
SHA1 1404ed8b38782eb445fe921677f548847c488939
SHA512 06bb94760c7d5bb22529290e4f96feb2f2e640378d4e84ba2b79dabe1a1f0b7917490d6e22852eacfaaa6518bb82d4c196f930aead49be83031a46da2ba60039
SSDEEP 49152:xWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK6j4MYPVyGLX:p0zuNIlVj
TLSH
T14AA57B3DA2EC00A9D9AAC375C14513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1658c4b4e929744997de958ab02872864c4bc92a431f1d40f45863f3fec13c49
MD5 42c8d1d2a77c443354f3d7628dce9d0c
SHA1 78166d49ea975cb3025a211f89ca929536f46461
SHA512 b4f1d0ba296643ed1baf89c38a9b37360e053d07cbf34ab1b35ae7b74e69aa9c498446240d648721ef29b49572745865371ae8308364562e0e361636049c81c2
SSDEEP 24576:j1QT7EcpfxR+N5AWAz3ooiYtjMqbYSnnrFb4PM4MYgLxEVyGLp:+TDxR+N5YzTfjM0j4MYPVyGLp
TLSH
T1F855B02EA7F815E9D1BE85798A23C502FA727821133193CF42A0C17E1F6B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 eeeb1db3a1157eb9e7dbb4bcabb755b70188bf394f1333bc48a8ab88534912ca
MD5 64bbe7a835290a464d016d3c79ab4af8
SHA1 b32851deac139b8cffc8d39dfca1f2a4dbf2c198
SHA512 50ad1bf40edcb05f5566f22feadb07daa6d266744f8e24ec25cd7eaf44ba1d475e76c5a0ae072175f5d018108528271ff8d0b923b446776dd6b716302143d5fe
SSDEEP 24576:PTMdOz0FFS+imSLUSnnrFb4PM4MYgLxEVyGLc:N0K+imSLHj4MYPVyGLc
TLSH
T1AA75E17E67AD14E9E57BC27CD6538906E67234620322B6DB0690C07A3F6BFD47939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 854944acdcc2ac0a2873af57f2f292b6b3300d0736606b1a42e7ab92d4bea461
MD5 11b28f76ba26e59ae2afe1145ec3ba73
SHA1 64d8b062c551b969f001b06059875e5499dd0e82
SHA512 6c4a951390d48a71f3a295c7fda0fef63ed9e3f992cdf84972c841a677fa6ee3194b18578a46671cc3c45b7365fb0fe91058f922946cd003f820aced4864fc78
SSDEEP 12288:u4K034XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:c/SnnrFb4PM4MYgLxEVyGLM
TLSH
T11855126D27EC30E9D9765670C2764289D230B832B72562FF36D0E47A2F376C89875B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/820-112-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/820-167-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1068-464-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1068-169-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1136-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1136-369-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1544-150-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1544-71-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1644-41-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1644-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1672-431-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1672-115-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1672-172-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1792-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1792-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1792-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1792-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2544-55-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2544-61-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2544-62-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2544-65-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2544-68-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2732-129-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2732-316-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2732-130-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2732-123-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2880-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2880-414-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3024-143-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3024-137-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3024-347-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3024-136-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3264-25-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3264-17-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3264-23-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3264-111-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3488-95-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3488-96-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3488-89-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3488-159-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3520-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3520-151-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3808-101-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3808-163-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3808-107-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/3808-102-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/3812-362-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3812-147-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4228-445-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-443-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-415-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-417-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-432-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-433-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-434-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-435-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-436-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-437-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-438-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-440-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-441-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-442-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-444-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-446-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-448-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-450-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-451-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-452-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-453-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-416-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-421-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-430-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-429-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-428-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-427-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-426-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-425-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-424-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-423-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-422-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-454-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-419-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-420-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-418-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-439-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-447-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4228-449-0x0000020A45A50000-0x0000020A45A60000-memory.dmp

Download

memory/4640-100-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4640-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4772-160-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4772-395-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4924-223-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4924-120-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/5040-1-0x0000000001F40000-0x0000000001FA0000-memory.dmp

Download

memory/5040-8-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/5040-70-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/5040-9-0x0000000001F40000-0x0000000001FA0000-memory.dmp

Download

memory/5040-375-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/5040-368-0x0000000001F40000-0x0000000001FA0000-memory.dmp

Download

memory/5048-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5048-39-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5048-38-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5048-32-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5060-75-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5060-155-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5060-82-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5060-81-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5096-173-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5096-214-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5096-366-0x000000000CEF0000-0x000000000CEF8000-memory.dmp

Download

memory/5096-179-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/5096-194-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5096-561-0x0000000140000000-0x0000000140179000-memory.dmp

Download