ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
Size 1.6MB
Sample261017-eze92swyd1
SHA256 ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d
MD5 57300c139b0bb2a397c1c00b88b149a9
SHA1 411c938ef18fd42a666b59391d856c2fb2d6d32d
SHA512 b6ce1ffa2dbc6ccdb1c552a538c936b68344c777c081a794e163565fe5ed9a8dbf75f94a1722b289ffb704e21b7ccbdeeecadd6a02228aeb7d44f2ab1bd70ae8
SSDEEP 49152:aWz/ClXvt32W+SPYrDHH0a7jRK/AMN/j2U4FH:yXvt32W+SPADHHj7jyXj2jF
TLSH
T18B751268F2B514F9E4778178CE429906FA36BC264721A9AB13D047172F277D09D3F722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1364	alg.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
4016	fxssvc.exe
4040	elevation_service.exe
1912	elevation_service.exe
2528	maintenanceservice.exe
1372	msdtc.exe
3480	OSE.EXE
436	PerceptionSimulationService.exe
1220	perfhost.exe
688	locator.exe
2804	SensorDataService.exe
2072	snmptrap.exe
4488	spectrum.exe
3584	ssh-agent.exe
2624	TieringEngineService.exe
3428	AgentService.exe
3412	vds.exe
3916	vssvc.exe
3036	wbengine.exe
3444	WmiApSrv.exe
4988	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\spectrum.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\vssvc.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\wbengine.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\dllhost.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\locator.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\AgentService.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fc4302825ef7726b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2836-3-0x0000000140000000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2836-72-0x0000000140000000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2836-327-0x0000000140000000-0x00000001401A2000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112140\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009430f02bef5ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f17782cef5ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006455352cef5ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed7fdf2bef5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d91112cef5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a5bb92bef5ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024dd5d2cef5ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4996	DiagnosticsHub.StandardCollector.Service.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
4996	DiagnosticsHub.StandardCollector.Service.exe
4040	elevation_service.exe
4040	elevation_service.exe
4040	elevation_service.exe
4040	elevation_service.exe
4040	elevation_service.exe
4040	elevation_service.exe
4040	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2836	ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
Token: SeAuditPrivilege	4016	fxssvc.exe
Token: SeRestorePrivilege	2624	TieringEngineService.exe
Token: SeManageVolumePrivilege	2624	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3428	AgentService.exe
Token: SeBackupPrivilege	3916	vssvc.exe
Token: SeRestorePrivilege	3916	vssvc.exe
Token: SeAuditPrivilege	3916	vssvc.exe
Token: SeBackupPrivilege	3036	wbengine.exe
Token: SeRestorePrivilege	3036	wbengine.exe
Token: SeSecurityPrivilege	3036	wbengine.exe
Token: 33	4988	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4988	SearchIndexer.exe
Token: SeDebugPrivilege	4996	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4040	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3664	4988	SearchIndexer.exe	111
PID 4988 wrote to memory of 3096	4988	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe
"C:\Users\Admin\AppData\Local\Temp\ebe91c8c5d55a7b7c762d3e7e573ced6fcc13972ee11db8cf4508e0ec175662d.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1364

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1516

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1912

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2528

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1372

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3480

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:436

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1220

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:688

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2804

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2072

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4488

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1368

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3412

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3916

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3444

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3664
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 11b31a92edc40373609de29f94c12e2f1dbf524e604bd551083d7cc3c80bdebc
MD5 75479a7e792365e57ca94806556dc35a
SHA1 0bf8e33dff9ca2f4872d1976006dfa6044efdcc6
SHA512 8858c590aa981257eb2836de0fbf3c25ac6ee69565459a18d25e24492180c13535db5648efee7760e136e01d98121344ca5ed1543d89bf8c31b3108af6652c91
SSDEEP 49152:ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnuN/j2U4FH:w3q6HjBnj2jF
TLSH
T148D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 02e1bdac78fc58dfadce1e780c50d55944ccd20e735284d47a1a0a582831ab0d
MD5 ca129b6990bf9d35fded519015316f16
SHA1 e74079ecdd2a9d448c2ade388dda7aa03ac14d44
SHA512 6739d00608764535da51b134b44b7cfd8285b9289e84b3733ed7b33f368d4af88fc1505bd33b889107400fc1ef5a9dfe8e5eefc258e8284d50d55d6879c8c88d
SSDEEP 12288:q1XLsswWkxy2lRq2czAmJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:gXYfDtczAKdCN/j2GLl3iFSE33b9
TLSH
T19205F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6f9529c760192c5ccd4ef05604861428759f0d005560f22b980fcbded345781f
MD5 285f3e3d73d654924582c227d34fcc2e
SHA1 c917e3aca5b34332794f2939ed64453d0ff88783
SHA512 a680fc63d5d099452f3d4c9209d4ed38a272a32d2125dd6ef7198d0d7c391ff217babe09e16a7450d495707e15509c0730ffd13452af9f3ef3b63653da305f67
SSDEEP 24576:a0Le5ji0hmxirMhdCN/j2GLl3iFSE33b9:aPji0AcvN/j2U4FH
TLSH
T17135AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6833ba0b9b63ee32e91962e91c5aee077c2ac971c74804aad3aa92bdedd5f90c
MD5 80d7dd4f521580e5999b65d04ff93125
SHA1 e2bfac1438a3a5f3f5ba7bd519a24b1d52a441da
SHA512 028ce0f69acc5d704fff081fe8f7d9678f089def75d2e99583dfd7cfdce6802ec0f592ebb1e0a317a414d161d8d3b51a9edc45be4a37b670665b31263964e207
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWE6q8wyuHdCN/j2GLl3iFSE33b9:S/ezSC6vUzPvxHjyjN/j2U4FH
TLSH
T198755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5252c44764c9e68b19b37566a756bc31d1765c2c91ef07ba6fcdc147e9bbc681
MD5 e2f490b3f2c9f0009ec9a4660ae17fb4
SHA1 5971993b925227ce7792c7418a2e30f28ee7ce27
SHA512 db54545c4be8254fc008523650f24d378d3cc99d3ab5266817b26717036364d5e1ed97aaf920296edd64671d8b8da3cc67d2953e2cca97705f12c7a8ac2b7296
SSDEEP 24576:jVbqPb88hv/l+6WdCN/j2GLl3iFSE33b9:jVO88hXl+KN/j2U4FH
TLSH
T164559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 7cab54114103abe0cc45058e6c7d5d10ec2268755804f9ade8a8cf86da32f0eb
MD5 59c47c98d56789d5b4ce3ba2deb16fe7
SHA1 bb34fc97113d36b404ad62f8beff743e998f1d49
SHA512 d38a21d8f9cc9a397d3e2bff594e615b3611f6c0af59b7fcbd56083f0b9420ce9d7072626614d52d1f00b3817a7d3b61f494554eaae4e5b56ec22fefb296ca7c
SSDEEP 12288:4RpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHA:4RtdCN/j2GLl3iFSE33b9
TLSH
T1B1C42360DAA5B565F66F837903ADDE615200FEE8E525884786917BEF127CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 54e094f80b4858b91757c35ccd733de0007c00afb46678a3234df2b70e9befc5
MD5 eb6a7909fec416c15d404185f17dabe1
SHA1 535c2d4cdc763a742cd1648690cee90f28539131
SHA512 9c7978d5b62cb2ababc41d7742718b668920690394010bc63c59c2ecd4c5422e713b9be41a2100da5a1cb969240aacd2362df9287adea628c655ead565ff41b3
SSDEEP 12288:ReBNUbTVO86UCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RJIUedCN/j2GLl3iFSE33b9
TLSH
T1BC05CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1afb866339e17c5cdfc7d3a052df9a54d87a85f82124a38b27a4e5b64eda0d46
MD5 7fa7785a54d32915678b6bbb77e6deff
SHA1 1b5e56406c669f12ce48372ab16444c0c0efedb0
SHA512 2eddc8329263fe1cbd3d28a2387dbdaf36b692f0d5d489c62a1fa201a9a044ea1de10c383bf1285d16c9e0dbf0a04acffb0192dda3a9f68336ecb43c592b7e39
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH:GQvGAdlCEL8c/yRNw5CIj2jF
TLSH
T102267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 6f5bf4aefe6f6a2876f4c907fe9ca09bdf1f3b91fb4077af4378b28e2bb81f2c
MD5 77a957dae63b6e3e615f1c72697a399f
SHA1 f71f8000eec24f7b3f1a6456d03036459799a07b
SHA512 4226b069fc3fb3cd699e27ec63690e29df321b2492cf6ac209263e44fe040e2918ed2ddf0b5d5c212d1f812df61a72a3880e1e8b5ff9544461271254209e8e18
SSDEEP 12288:UAwSfxL/2Dc34DLLmt0LDQewsAj8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b93:pdewsAj0dCN/j2GLl3iFSE33b9
TLSH
T19015E030FE74E436C27F0DB61B36C716142CBA608B6119C3E3E85E9E59346D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 03276951c7aeaf6da63b901280276a013847ef35c65c3e1b512b6c46cf9cfecd
MD5 79a18804e4768763c41bf8020a4925bd
SHA1 a6762c45603ebdf91ba9fcb8a2b32a3180c23c35
SHA512 fbc9f9f8f3501d6260c39451b2782883ecbe023fcbbfc9f8ffa732ebc5ec943742eec13601c98428e17f4d5614608f0dee83afb7e9b3b819cb0c4e883ddc072d
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHp8F:yUEtQevvqc2W1cpV2EI32p
TLSH
T13A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e0642a1810d42bf31a50dcc1125eb7c18e1649946e9ab2a2996ebfebf92eaa1a
MD5 0a18b4f527da70024fae5106d64ff8dd
SHA1 304e2d433239b279b82f309d57b5b0f6fda2b010
SHA512 adeed28b247cc539b8cef2c498c83a062bf0bc85359fc3875f76b6562d60c30cc5dbf25690df16d1498b8d70c07e78d502be0bfd2435c2a19e3d110d1f409197
SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/z/N/j2U4FH:7oqtVjnmkj2jF
TLSH
T187D58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c5cf98e33b41f703819590418d611d8fb229ef26588f92726c62b070ecae8b49
MD5 63897d96ed45e34af8f5f6ce8e98f4e1
SHA1 4bc8ee38bfc57e21eb6ad6ceb4036cc8d7936980
SHA512 6bb79175f7b96bc26caf05a4633042fdd336facc8ecd0cb244c12b95e153d002f90a9cc4264a776dac2b27cd1c3f8f02c7bec3a19351f2b0763d815fa4e2f58e
SSDEEP 24576:FAhGLJIFoiwtA5l7S537dCN/j2GLl3iFSE33b9:FAMyFoiq5oN/j2U4FH
TLSH
T14335AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 0a2f653feaba55cbb34dee15435974c487a7bbc760c99eddd37a85a75fab8d89
MD5 9590396cad9d9d8d8e566371a4f9deba
SHA1 c9c6b6da660441254109f6a6bcc2481966922ded
SHA512 70d455e30df5626baa5066efa13c7bec8eaca87f9f8f0d63889df0f608b1dd1a2dc53e1959c0fbefb48159fd5c745a0258c7b13e493a64cbe932db8f0cbb5962
SSDEEP 12288:4mw5HEjsChNVBFgl0WDm+CnJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:1wuoOWYdCN/j2GLl3iFSE33b9
TLSH
T12405F14577E41CF9E96782398697C536F7B2BC512A21CB0F0360C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 93a3a23e74cfbf49b449aba13c33a6ff938e852a9fa9a7f7f957bd00546da984
MD5 ad46950935e25d6483b61a960dc1229a
SHA1 cdbdd9dc9d95dfbc6e47817df54c2961b511488c
SHA512 4efe7962487353260215beb12a001a5f19328052d5989c8fda413b3f139f7506a6dda320637afb6f5e656628405efbdb72fcc03a578fb00a5146edc1c4c1bf97
SSDEEP 12288:dBZ1IyMJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7ZuJdCN/j2GLl3iFSE33b9
TLSH
T1FCE4125933E471F9E1A7827C8AF59A05D321B8A5A73243CF026046EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1d9f43fb35968119df497a48c823a835bc24cabbc3cb6903b871dbf73eec0d70
MD5 2f6d80f8cf540520e46456782e9ef145
SHA1 bec31b6b56b0eee768c892fedab712c5af467484
SHA512 7b13a5f61cc9bae076995da67d2dbd8e2e78d4bbcfceb446c5a07b87251a280d80b107f70222a26ec8d0a0bc3839887ad5745f1d3f6a02da24ec3808bc78f991
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:tQRQyi36YOcPQLvw2gAf+PN37j2jF
TLSH
T1A3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 59a61bcc7b2c1c115cdc0e52b09d5b9a675b3a3f40034eb678762c9d3a741b08
MD5 443a98897d7c412fa6acd3493b0ca26d
SHA1 1e246af9e26f78370e5fd639cd1668f46045a06f
SHA512 e978f53dde58463ade7c71349b7c4214ac7b73a7b00c1a10ae2524dd92a604feb46ff008f1235d37872dc0c48afcfc7119bed66e402bb7c9d488c28cc43beaf1
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:VQRQyi36YOcPQLvw2gAf+PN37j2jF
TLSH
T1AE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c115dda946720152b8680c67c00caa2e349b9209fc8f5bd9fc333ee616420270
MD5 f0e3fea11ef454016183788b43686f4f
SHA1 5b2c489b691549a22072da21ab6f5b181d9c98d6
SHA512 7ad7c8130e82e13b0de590b01e0d02f9ef49880f0beb626f6cbaa246a6af7f06d1cf8d54b473be4e1574fe7bc04c65bbc60579a10af9480c29ce1b59e5211315
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ZdCN/j2GLl3iFS+:d68Qg55nhheWu7PNU3/vN/j2U4FH
TLSH
T136B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 71eafc41cdd5e7fb0be5c709b6dd3efe41b985772348e7fde3c636816df254ce
MD5 ee2b5480d801a009e0ed11d68c0a0ebb
SHA1 55414d3f1da2206a1e12d95e064f0e75c9cc865e
SHA512 9c82dd3ba7cf78a10206312145a1fb4fa62146d2875a0c0034232b32b1660bb089bb790bff0e3309d896ed367165131092bb2270233bb3c3b69fe8405d9a1088
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:Ty5112gYy5azzVvL69nLKnhZSj2jF
TLSH
T18A168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5310a77400e013a72f8c81e7dc1c22721880faed7c312f12efff9f3c5f783946
MD5 292305df961e7690fb81a27b5dbcdc45
SHA1 04ff48c2263eaff7e0a26826c69fdb2a0af56156
SHA512 a5fb16c5cf7bb1dee0ec3178e9ec50966b6713fea70a3b6c5c2af9ba25175f3001a20001e78306c86f5a2c6424e57a8b641c60adbec0d07cc230396fd9a5ec1d
SSDEEP 49152:IB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl9N/j2U4FH:Cu6JmVxd2dTj2jF
TLSH
T1B6D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2e829ac78878e09e11a89800431aab555b4ea3793635a7f0b83eeaa39ad6b2a4
MD5 70fdf1b67e09ca41ea79d04bfe79ef65
SHA1 5ce1ca4da21a1a37004fe69a4216fd7a4edeb23a
SHA512 a8f44421710e106b6afc164303f82eadde2f036f1fefd4994c46c11ce64258f734fdb18cd00f0b3a1b289219a7cf5cc6fff75d0889572c3d8921f54e15d45f15
SSDEEP 49152:L1hpsNoJpF1A6UU44CwH7R4xBN/j2U4FH:LmifPbRkj2jF
TLSH
T133B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1eec64f7a53c7759afc96396f34a53190df9cf028992c219268d0f92131de1bd
MD5 5ba6b4a9bb479c97dcca107b7582235b
SHA1 e1bcdef06ae404f1dc006f6786487bd350800e27
SHA512 2067249fad672d0a3e559d6759d58865a6b0a0a4bac2fc187f3311711e7ac7892ed5a47f9eebe6a2d359eb056ff0261b9955747d7fc9928ac33a555d57b8e2f7
SSDEEP 49152:uSuZQIY0Be2KRRVtOnks6NMHqeN/j2U4FH:g5dKTi61Gj2jF
TLSH
T122C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0c95fe4e1d578662da6f08376816f2c90961d9b6c1d02c712e5d542b57765def
MD5 9fc5ab40a0448fcfc63f2710d074d335
SHA1 589739fb0f1c8f368db4a79dbb3382c7eabe4847
SHA512 9cf9094690fa9338198f4549034fda9a979a6ea76bc0f311aae1ce4a3975441278054a2c91cfb39c4b3dc34de59cb61bf9d2f0e30a1f2f866edbd69b690d3a40
SSDEEP 49152:FhtSn8EApI0figngiDn0AP5wtN/j2U4FH:0X2iyphwj2jF
TLSH
T18A95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 004804df186b5893a49dad242e456f4c37c9b9dc317182da0c1c8b8c3c376ecb
MD5 e8995690abdc03b518b8b868a5cbdec1
SHA1 856a3043810e260623d988ea84b76adda8b05021
SHA512 3290aa61f82c364a99528c80c71b2b5e9afeaf1f571ef4e27e7b75343812688d22bc4a5cc95aa606b1b1037432357a2e5674fe916264badece79dbd073571e07
SSDEEP 12288:ShJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:SVdCN/j2GLl3iFSE33b9
TLSH
T168C42364E9F6B669F15BC37D43A9DF515200FEE8F6264487828526EB537CFE88033062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 f80fc3cc369af69f16620af86f7e68e7698dbd09e5c9832ff4d9935ffd1851d7
MD5 371a3bf6a9cd0d6a151c8c5743c6eb67
SHA1 6c7fe6a0aa8205e0bcb8e55f8d7e3741ea681e41
SHA512 13bd3ff661bab17f7dc3a527ee6032fe6a8de318af85a91e2e28b08434942ad57e1932a77e6a529adc017dfbced29d261e708823a2bdf28e52e8ad231c79fd56
SSDEEP 12288:pAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:pwdCN/j2GLl3iFSE33b9
TLSH
T147C42364E9F6B669F15BC37943A8DF515200FEE8F6224487868556EB637CFE88033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 0b921eba67a0ca5aae6b273101f6c8ca6dd997d9b1c3353a3c9a867cad0bbf16
MD5 8318be815bb60f5ac6bd15957a85d7f9
SHA1 076a109198e63de9ed257d6952b574603e3246cf
SHA512 2ed3788c7252e9079e0ed636cd4bfba48960dad3604c93c3866aa8a03778b86587ad45ef4d6e197e1e5d1ea5c96da808a52af0f7c295e36d2b2f14f9797770b0
SSDEEP 12288:gaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:gmdCN/j2GLl3iFSE33b9
TLSH
T1C6C42364E9F6B669F15AC37D43A9DF515100FEE8F6224487868556EB237CFE880330A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 e47addc8152f50fad52f023a6d7bb527be217f91b1a07770c39c202af183841b
MD5 23cfc92299db2063bc51562028aff8ac
SHA1 ef33d7aef864106a09d1174a42539ccd5980cc88
SHA512 087fc76934a3e50a4aed84968fd91af73a59d08a2bbae4abcae01cc4895de881499ce077f077c349a8029eadb6a5b973b1ca639e7af90e9425d30b8b9bb09945
SSDEEP 12288:aVjJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:QdCN/j2GLl3iFSE33b9
TLSH
T191D42360A7F561D5E46BC37C83B5DA21E220FDE8F732458F87400AEB1B75BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 23a03b3b49420585596e16e1313566266a15ab35fc938091f68d94a1b0cdcf43
MD5 e6f1b42a41fe022f5144b68037854479
SHA1 05a715ec7cc1b8c9553109b3b119dc33ed061a37
SHA512 f0a8d859ea447d52e08b5005b682a8de4430a1079329dcc24f25001d2509b0ab9d48d8cbc8d2add18d2250a09c9602e1f3bfec6358796d6ad95ef98dd575b873
SSDEEP 12288:5LJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5TdCN/j2GLl3iFSE33b9
TLSH
T116C42364E9F6B669F15BC37943A9DF615100FEE8F6214487868566EB137CFE880330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 de7d240d3f2c3157801ce64a848d708517308d5b8fde55ed6ccfc0da0765c9bc
MD5 d8227ec834c4316c109dd6329d557485
SHA1 77a67c827346977177d0758134dcb8c9aeb7e60a
SHA512 c9d622429f295be8bb1ed9daa1971d9a504cb6a0706177587db13f80e9eb2e398476882eff1161446376e9914388c68f1742777fbff77a8fd69baffee6190a09
SSDEEP 12288:hUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hcdCN/j2GLl3iFSE33b9
TLSH
T13FC42364E9F6B669F15BC37943A8DF615100FEE8F6264487868156EB637CFE88033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 c89b372e17b6568e2674dce2784cce6901a43d6363d234d878079e620bf43134
MD5 2f7f94a4765b74e7cef17537e017ac40
SHA1 e54abe4aed556717234a7497ee38d8c825ed92f6
SHA512 d225454f763522967a036bb87df0a6be97e5c5a68ea54438dd25c25497a1bc5439f77fb0aa94da09bdcb019980e1b2e0037b8220f1549a0415f8d1b58beb3858
SSDEEP 12288:RIJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RodCN/j2GLl3iFSE33b9
TLSH
T1E3C42364E9F6B669F15BC37943A8DF615200FEE8F6254487868156EB237CFE89033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 0fd6cb429ce319b06d5512a6422430bd0af361d934ad100ee047bdefb2bdf87a
MD5 3e3153ad37c8d34cc4306194cac13f97
SHA1 719c810b6ddb9df2ae7acd071fd5f841501d8a1d
SHA512 b238adb7dacd13d3e9e323058a39b62fe8a56d59e9c91d47d4b4410cb18b990a67c61241496f8ab6ebaf94d47fbca4a4bc6ef4675ebceabfab8257920df0ded2
SSDEEP 12288:LiZwb6zzFEoS2cPvygJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2ZMSzFVSOQdCN/j2GLl3iFSE33b9
TLSH
T1290502A4B3A018F8EC67823EC9658916D271BC595770C60F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 f0873e8e8510d696d34220a9c07a05714c048d184f54b5797b5ecbf1f129373f
MD5 324eed60b22b1a1615dbb8c62fd8f244
SHA1 f8447720b34dd6c4056f54f2d0e9f3bd8e7df806
SHA512 45e2c3bd6f78fb14908e3c5f26d30ab9028ac736b355fd96c2a67655527f2e2e78aba2b2436aa9c3c2433327b3968952e679bb777bae79cec6725cade3799033
SSDEEP 12288:8tJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:85dCN/j2GLl3iFSE33b9
TLSH
T15BC42364E9F5B669F15AC37D43A9DF615200FEE8F6224487868556EB237CFE88033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 513df4f4f60c4e581a8e932de33fd44d6e9b3b9d210d0a0697db81329f1b6775
MD5 5a168db43be4009c4b4ce54df737736c
SHA1 af67d775b5676eed1ae97a86904494eeb58f2fb8
SHA512 b81730f20d854ecb9c2023552e65b59783171ef6c0a4d5ffc780e7eb2abe3631362a21b985d0b9386fce51bc6e073fac0bebe10ee2c93ebc6e19e063a6ffb66b
SSDEEP 12288:t5JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tddCN/j2GLl3iFSE33b9
TLSH
T1E4C42364E9E5B669F15BC37943A8DF615200FEE8F6224487868556EB637CFE88033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a64aee2cee340a549f7841615284f63261ccd33d24cb5ae8f2341600079e9737
MD5 6d4ceefedb756cdcb30d006f49afe543
SHA1 7035a65e9defd8e1cdebf9039775a4ba321f2a59
SHA512 97fa7f23816f8b4ed90fac6a47e222186db88c8453ed7faf86d91e528e4adcb40528511f7c5a3acdd8cc022530c4645d25bb966b1f1b228a2c7cbb1cc2cbcc8d
SSDEEP 12288:NyPz5L8MJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kzykdCN/j2GLl3iFSE33b9
TLSH
T1EAF4025773A131F9E177823889A55A11F331B87597208A9F43A007BB2F377E09D3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 8573d78cda76b0e8e77bae6657ecd395c2619fb60adc57b6939511b7cbba24d1
MD5 3e2ab75a4bb802ed82ae8af738cbc3de
SHA1 4961a5ad44ae5c1dbcf1e1031f4749b358874a0a
SHA512 f5049c1e61a1887529bae6d107c8380c19b358ca39be73ab5b572f1def208b4e13a12a2ae7f5837075027b110c78cd686cb95617d69888163cfb91c34b22d8cb
SSDEEP 12288:vtJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:v5dCN/j2GLl3iFSE33b9
TLSH
T165C42364E9F6B669F15AC37D43A8DF615100FEE8F6224487868556EB637CFE88033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 9a0711d9f5f345e6b6e313d9b6249f3a376d23b1341700d2dde19536b44fec8c
MD5 ed798c0db999491f11f675105157e558
SHA1 01f826904c32e58a2ce89f7a09e004be1692cf3f
SHA512 6a246b8d69bec6222e29882e04aa4cd057f99278454a288e3716e10cc9ef9182ed0be88799dd3122b7d7636e25c1668d8c6fb3a104ef844ea775d1994a4bb772
SSDEEP 12288:PtJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:P5dCN/j2GLl3iFSE33b9
TLSH
T180C42364E9F5B669F15AC37D43A9DF615100FEE8F6224487868556EB237CFE880330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 15603c71a09d9e42609ef82d6a4940df1e003ceadf36e4c6c6075453c155a9d2
MD5 26d06a90a47193a0437d35daba9edfea
SHA1 e2592914b46678c1362b6c321c111be4510445ab
SHA512 02129b0e33de338a3825ed33740a2946e185daf301970624aa3b4237d79b4e86fc46f0dd9e2e1b213f835b68462eab6962129db7ade3b71fbc5b5453103713b4
SSDEEP 12288:ZyPz5L8MJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YzykdCN/j2GLl3iFSE33b9
TLSH
T154F4025773A131F9E177823889A55A11F331B87597208A9F43A007BB2F377E09D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 910c4bb1a13df7acb39706bb4815775d32188719d39f3412e98df7ca4f353f9d
MD5 e5c3872ceafab368151a772f294a912e
SHA1 bf2f63fa1ad9c4c50e8d6c60bfffb1b5f406cb77
SHA512 c7fdd4305d940efb7652cc01426155ae2d6fb11e2e8f5e4c34ca9f32e199bf0e203c74618c6bae1dc62bfea4df9151a6c078a35b31786921f4bc339507427b58
SSDEEP 12288:yCd9eWYoaLHF3z0z04PDvhKJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:TTHaLl3z0zD2dCN/j2GLl3iFSE33b9
TLSH
T1610502A4B39018F8EC67823EC9658916D271BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 18bc3d915c6cffca4978dd40ee2c1d91641b3def45bda8c7e53e1f85b5f4a7be
MD5 85ee56fd518bf17a7487fddca2119e95
SHA1 1e1f52efa1bdbb7de3d000ebf631ba480060e60b
SHA512 3e64ce4d1642850e41b12ecf5453c50fe9b5f7af2a21450c8987582aebceef34510c8e606cbac0b296b85662088c1d50be5c69059abb3bbade8329af424e27c6
SSDEEP 24576:QcP4mcvIjkGOxhKP2l71nNKbrh/8KBxdCN/j2GLl3iFSE33b9:7P4m4IpOO67W8KkN/j2U4FH
TLSH
T15C65BE2DABDC0096D0BB817886658A49FAB1742A1F3286CB1160937D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 dc28806cbe0a8dce8b7c4dd1e6acad2e8abd9cbc5329701daa6425a2b92ed083
MD5 90af4dd75aa264107d095ad870309eaa
SHA1 6badb0a8e4b0395f85ee9ef58eb8fd0a9e4fe4bc
SHA512 e99440b3c8fc5578d18c36e7d1f75f703e03e985701eb045e5715c250a7cdee344cd83e56a6e2ebb17f408a0f9a08bbb39f11604a13ab438356d1229db7ced8f
SSDEEP 12288:0NsfdJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FJdCN/j2GLl3iFSE33b9
TLSH
T184E40119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 03d83949e5ac3cd381579af4b682a17bbe761c7d4a2807cf6138610780de130c
MD5 5895573a815fc3975bbee13ce28ee5c1
SHA1 f8b8d7def478ffd506862adce8e2ffd582cb11c3
SHA512 57bfe84c0473c629c32d296f58d5b5f603a43a3c40825ed9a82ceb25b68de49b2879d9a3e311cda32f2f75608854fbece2b22341f28149d713ed06fc927b1977
SSDEEP 12288:79JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHI:7pdCN/j2GLl3iFSE33b9
TLSH
T17DD42364D7E9B656F17B83780369DA316200FEF8EB258487C58157EB5278FE8D832423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 da890be5327321d61c7a8d07746d6ca8c8ccd1021161b5d04d93869ea2598231
MD5 1341e7d1e343c5d35e2551681aaa4184
SHA1 9b2132098f319e3dadb9f3cc15e48766de87b80c
SHA512 59b1c1362fc1228913983a8f7e68dc7ddab516e7c29dfc7dd691cde32d88938318f8d42590a7825f0b39f96f1805074c9c113c767322558056045f1a689fe069
SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQQN/j2U4FH:5a0hNYG4Jwpj2jF
TLSH
T1C285AF1D67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 04eeb3b01206caf0229eb4ecfa71050fa7ed5eff5c2d79feeadd640a0a91469a
MD5 ae6d8640ea97dbd13ba6b52a09eb7839
SHA1 8c77beceb0f00c4a75b126a04e80b0fac7f2d4b5
SHA512 b3ef05733383a2c0b0345573a17da1424142d755ee471e79b3646b7a5654017b785c782ebb0660c14e92b26e7b8561b255ece9d723f613a3f5fe251730ce85f7
SSDEEP 12288:DhbHjfXwJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DhbHjPAdCN/j2GLl3iFSE33b9
TLSH
T139E4027D66AC21D9F176D27D86958A06D330FCA4572183DF42C182BE0F3BEE85C36A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 90810254e0ea8db6ccf0d346a0b7aebc2a739f4e928964b4a692b03b63d663da
MD5 ca5c14f21d68222a3bff4762fb3af55f
SHA1 85123292be30582f234ed15717350fd2030b8b10
SHA512 7ed34790b27af10aa4cf24e833558e5e938bf47c6524ff80d89d6f404106d4dad8c9d5174a5fd25224dcd4f7d1f2726966f9b048963379336eafbe8312873359
SSDEEP 24576:Y3YgnJcRTk4yti+R5dBR/YdCN/j2GLl3iFSE33b9:YIgnaTk46pBR/DN/j2U4FH
TLSH
T1E145B02DF3B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 c1146d8beb6a9171c0fbc8018c1f789be8f5fca0067cacc24ea0a68bbcb091c2
MD5 8bbe2fe229b5bcb18608ad2e1ac6deb3
SHA1 a456aabc5c3f606e55f5530c44d3c5601ee722f6
SHA512 82447fd7c03d03b52e6a34d6f865cb05ede665280b88d3826d12673dda86894177ef04b49e44b7631a91c8175141ac3bb39db4ab0b627835b7271919d1b37c89
SSDEEP 12288:BJJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:BNdCN/j2GLl3iFSE33b9
TLSH
T169C42364E6A5B659E16BC37D43A9DF216200FFE8E73645C7858166EB137CFEC8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 30c78b605abb19c7fc5909364b537a0a54cebfbd6011dea560d3a37258e6ec85
MD5 9cb3eee29f25c7a990af54d32497685b
SHA1 d20fda5ef16f63e5b0dc290bfa0fe72a6b493f35
SHA512 90fec05d8ed4a9ff679afbacbeb9ff54d49b65c1d2897c7c4b91427ea9b4a9a6104672bfc0467c6eee7a61ed7bc318daf1b2f6bf91bd98fe1321d64b638f0ab8
SSDEEP 12288:WOb9A4LWOsvAYFTmJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/pL3UTKdCN/j2GLl3iFSE33b9
TLSH
T11525F154F7A410F9E86BC23CC5A68A16E271B89C1724D7DF03A84BA61F237E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 08cf28dd5dd477ba161106a449936b98727c2133c096bca81da0834d0b58dce2
MD5 22ab11e69d6d416249f0f08379fdf2a0
SHA1 a3c815404fdff8608a126592270de847d70b89c8
SHA512 2291f65643b30d0c5fa83bba20f436ab83ecc886d2d692e2df3402a8d4b3665274b7336704ce4f0441825f60b0ddfbdc461cfdce65b9f8a73f74bb34ff5f977c
SSDEEP 12288:ypFtpOiJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:gO+dCN/j2GLl3iFSE33b9
TLSH
T164E4022936ED20E5E07A923C86968709D331B8A5572247DF42D081FE1F77FF89C36A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0d20e8fcd67312663fed775bb85a1167932dad5365de71473b000900aea83130
MD5 7daba59da0e20cc2a2fcd2111f77e796
SHA1 f9c07d910b12add840d96e7520e866c9d3ed6d20
SHA512 1d0b52038962dc1a5a707f946c4342c6cbee22cf8669423d5515f767ba51f4f5e155b75a4ad9983cf828e9ad9dbf6f166088c12f00dc4a6bc4b56d9ef9037e1f
SSDEEP 24576:j7NM9YqZqmWMUkPjZM48Mv6bEhs5dCN/j2GLl3iFSE33b9:j7cBWMpPjN8DbEhrN/j2U4FH
TLSH
T11065AE2E6BEC81E5D477D13DC9E28605F2B1B4611B318ACB5162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 336797f0222a010e2726c32bb8fb3b36620783081187114e077e02a55b2845cd
MD5 f27f5fc372962588eb6d4b6ce6999afc
SHA1 3772010b2c8ee5331b7de516e9a8a2688e91e79c
SHA512 6652504f3557b72d2b003818ae0cf891e0f0f4fb9139799d66a201fcb3e40f8b303d71673f0f97dedc3810edad5d01ae40c653e71e5ed9e8870de05589bc6765
SSDEEP 24576:2W6BApg2YuyuNDYTabvcdvNYf8km1/dCN/j2GLl3iFSE33b9:2F2YuHNETovAvNYf8kmuN/j2U4FH
TLSH
T187858E2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ecb3c56a59248533c360242d25f7e95dcc175892f1eca61d06c9dbdc1e9a24a9
MD5 3a399feae7a71618b464b3cd63db0fa8
SHA1 76ac7f1e2ca35f5b73f8a7dcd4803998ac10b783
SHA512 7d078174f5fecf6e4176f10604a6b74f10a6a6611dd70c3da5ce308643f2a28f7a7ad7ddc93714d5437cb92933d569d36b88b9e3f60e0b461b3c63a6c954b998
SSDEEP 24576:XAFs06+Omlf3NXEbToydCN/j2GLl3iFSE33b9:wFs060lVXuwN/j2U4FH
TLSH
T1D465AF2F62EC00D5D07ED17D8A97C91AF2B1746307255ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 5213b475e7759e8a7a63e90e52a873b7335e005fb4a04374fa5262adaa3f61ce
MD5 82bba5c7204c233e8628f71d33c79643
SHA1 a145b1f2f95fc82771dc37879a8b7ca9b067aaf1
SHA512 892d5ee9194f2590a4b6505378813ee1e4cbb6db3f661901965c8234724c25a32de05356ed99e27cb0f7c5e8447f6d2d02cd29d5de4db8225209137f22b8a348
SSDEEP 12288:lCJnJ5D3VkrDzxNJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:cJnJ5D3WXzdCN/j2GLl3iFSE33b9
TLSH
T1A815D02CD2A810E8E4B7C2B4829A5B56FE71387D2F2269C718B4D5353F12FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7c03f0d835f0eb840850e38471cedaf8eacba56be1d0e528c59d39e2997e6104
MD5 4f0d517d81c38802a3e0a91f1b4ed3a5
SHA1 01f6085d003458cd57c1edc47aad27e79698996b
SHA512 c781f6f9e5d2bbd157d4366359d51c215ed063e5b4bb70d4c6d7addac0dc5136bd28667231caae2db1280472e215fc9c23b092d62c435a56ec3ebf9a28694c1c
SSDEEP 24576:cEPghm6/7IIXdwcXrif7qQncjlP65i3VuYdCN/j2GLl3iFSE33b9:Dg06DIKdwc+eQnSt65aVKN/j2U4FH
TLSH
T1A6956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 483d1a1034f32dc9c8f0087e9d7a7f522e1b3a118b0afe306e504272f7a8e6db
MD5 d6641da6d08dadc3a962e743df034073
SHA1 b1f9569d756cb91d9a2fcfe2ea84ab3c613d5851
SHA512 59945e486321eee3a69486ca63c906d8e589b2e2595196542ede6c558cbbf3b9e4ee0638e6d6951cd1ba278ac9a287fc9d2378c5c51fc6a13b5bba4667362fa1
SSDEEP 12288:zEP3RnnJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4nndCN/j2GLl3iFSE33b9
TLSH
T1F7E4126D67AC70E9E12AC13D82A18605D331F4B4AB2217DF42D1C2BE4F77EE85D39A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 7c80acc1c543729a32c58e7fcda33b7a75635c455f6d46bef4de40964f04280b
MD5 dedc5e0154520df09672ffcb7a99baf9
SHA1 54eee4bdee61a7fe16e3e97032a9226dc4efbeae
SHA512 67bbd892d0224c22c309f8a834886b7cf89e583535d63e6321c6cd88feb5e5f21c7d3a674fba3276c5f835deec03a5920a3507603bda775fe1faf1394642c5ae
SSDEEP 12288:mjkyAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mIywdCN/j2GLl3iFSE33b9
TLSH
T1C9F41214A3E4A595E5BA423C86B686619A30FC70EF2146CF41C0E77F6F7AFD49831B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 9a2240944d3a6a3f44e542417d4d8a75ab70ba9d2a09ac4d4fc7db91329d2f56
MD5 ce67ad001287f2b0222125b7430c4708
SHA1 b2662e1c08f8c502d7f63e78455d27e478bd740e
SHA512 477e6aa6df753e33ba889ba80b9f7261e86d4a674806fae18b27e989bdb8d7b9098a259edd31dcd5d39e88d94d7d6ff804aa096dd58b85c8e141725b8cdc6a1c
SSDEEP 12288:wyyJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NudCN/j2GLl3iFSE33b9
TLSH
T1D1D42368A6B5B569F42B837C03B99F215210FEF8E72144CB41D0A6FB5779FE88033852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a85ba96004cc3707a3d9413837128b40da6842852212b0c4b4f05bd3ce7c5bfb
MD5 0c6eb4a2b20622bd29cc3f57c0d5bef6
SHA1 13a45baa34415503a03d8db3c900c5c80b83de41
SHA512 6f9f447cae1f77349b6fd1e259be1fa599e4c776be8cdc02fa397dfc400de80ac57f729830a16edb3159410f9f17d9e09a0b1a496cf23d0f6f70331465db9110
SSDEEP 24576:1Q9MxZKdcz9dw3BdCN/j2GLl3iFSE33b9:1VKZWN/j2U4FH
TLSH
T1E5558C2DABE9159AE177D27995A250C3A633B4301B31C6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 4e9a93af8fe79ac840e5a126e23ee28750fbee45dc9b24f0cf6d93ff53136f52
MD5 a9ce31ea53d153de91ca3341b939cf75
SHA1 c4e13d181118da7ff2659c3b0e8d1857ed49b6ca
SHA512 11165d3996742714560fcb2ef57b160efb0c78c5cc2daa0f3e5a16dc79304d289b4001b9d7c4d19867f4bd39cebd8d2d27e32aa68b47851c314872c6f85877d7
SSDEEP 12288:GyoKo2JRple9p8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GyocDAp0dCN/j2GLl3iFSE33b9
TLSH
T18EF4E01FBBA940A2E076823C89858745E773B0705B2253CB5691C37E4F27AE8BD35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0ea9360d4e72c09e2365daddef8daba90ee4eca209b14433a02e6f21226ffae2
MD5 1a9bc3db2c951790f9992d18c7eac61d
SHA1 954f9fddea019240eaf5380ac1f96399623c9d1c
SHA512 ed36d7248781c4ef08b62f3d99bcab392d0cb8a5033e7bed6cd77133c4364cf1ef7f707bf040be0996bd611a75967fa02b163ec0fa8921106b589891326c9356
SSDEEP 49152:ZWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKfN/j2U4FH:B0zuNIDj2jF
TLSH
T14CA57B3DA2F800A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a5d2833ffff84ac376ad1058d06c3819aad4e0026d4b49493860ce3fcf2cc75c
MD5 3d97e18126f6a31880cb4df883dc740f
SHA1 b7bf98ba21859375d3c5d4fdc78be82a54f1c5bf
SHA512 85353ef232f744f44e58703939f1df5914e0fc0a20c5d1f350b4750418fdd7ccb2965574e3edc1591051d5bad09806fa70cca982c576f16c77a7ac2f5d5dc241
SSDEEP 24576:s1QT7EcpfxR+N5AWAz3ooiYtjMqbndCN/j2GLl3iFSE33b9:xTDxR+N5YzTfjMhN/j2U4FH
TLSH
T12A55B02EA7F815E9D17EC5798B23C512FA727861033193CB42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 1c7112bd68b4d5321f61f8dfccad75b3f9113220215bfa3b11e4c67351255c7d
MD5 0f22d05f3319c59ff1397d5ef3f80d49
SHA1 658bceececa4afee1a3ae39e221d70a05ebc2884
SHA512 a0d09db53c92fe1f1593e1d21db877a1c1392d6a4631249e145cd09cc68314fd9ebbbbc97566de5b58b1dea79b2fbddb2638706ed5b8d416d5d36daec703296b
SSDEEP 24576:cTMdOz0FFS+imSLbdCN/j2GLl3iFSE33b9:00K+imSL4N/j2U4FH
TLSH
T1DF15F17EA3AD14E5E47BC27C8653C906E67274A5032166CB06D0C1BA3F5BFE4793AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 2cfa0a7e8cef7d2d45b7b512713b17aed54ad99c7ef1bd8d8e3bbba738f4e2d0
MD5 36b649e9c33dd3b8055e27ea882450b1
SHA1 f448d7f73bb49d1db3f290fae0f8a6b82fa1ae5e
SHA512 76f06547039525248c73917848fe99e7e5146f1b0755688744935befc15147974f244aee985a295bb62847e9d4c1c2140006b55dc0224147068c2477c8475ff0
SSDEEP 12288:H4KmJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:bKdCN/j2GLl3iFSE33b9
TLSH
T1FFD4121C63E870E4F4768279877A86159220FCB4A72146EF15D0CAFF5B3ABE8D435B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-96-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/436-102-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/436-168-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/436-105-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/688-121-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/688-176-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1220-173-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1220-118-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1220-116-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/1220-111-0x0000000000520000-0x0000000000587000-memory.dmp

Download

memory/1364-110-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1364-22-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1372-159-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1372-81-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1912-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1912-62-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1912-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1912-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2072-310-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2072-128-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2528-78-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2528-64-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2528-70-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2528-73-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2528-76-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2624-424-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2624-156-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2804-422-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2804-181-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2804-124-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2836-328-0x00000000027B0000-0x0000000002833000-memory.dmp

Download

memory/2836-10-0x00000000027B0000-0x0000000002833000-memory.dmp

Download

memory/2836-327-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2836-18-0x00000000027B0000-0x0000000002833000-memory.dmp

Download

memory/2836-9-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2836-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2836-326-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2836-3-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/2836-72-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3036-174-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3036-427-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3096-448-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-465-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-486-0x0000027F14480000-0x0000027F146FE000-memory.dmp

Download

memory/3096-469-0x0000027F14480000-0x0000027F146FE000-memory.dmp

Download

memory/3096-451-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-452-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-453-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-454-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-455-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-456-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-457-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-458-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-459-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-460-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-461-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-462-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-463-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-464-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-466-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-441-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-442-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-443-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-445-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-446-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-447-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-450-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-449-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-444-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-438-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-439-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-440-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-437-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-436-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3096-435-0x0000027F13B60000-0x0000027F13B70000-memory.dmp

Download

memory/3412-165-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3412-425-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3428-160-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3428-162-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3444-428-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3444-177-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3480-85-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3480-164-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3480-94-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3480-91-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3584-144-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3584-150-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3584-423-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3584-153-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3916-169-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3916-426-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4016-80-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4016-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4040-42-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4040-139-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4040-48-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4040-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4488-137-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4488-140-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4488-131-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4488-421-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4988-434-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4988-182-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4988-209-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4988-230-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4988-193-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4988-432-0x000000000CF20000-0x000000000CF28000-memory.dmp

Download

memory/4996-26-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4996-34-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4996-35-0x0000000000690000-0x00000000006F0000-memory.dmp

Download