728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
Size 2.0MB
Sample261024-jalsraee45
SHA256 728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce
MD5 800ba1daed182f9f1d1a2ee5a3f5d518
SHA1 4a71e67bba11191e3e813f766d0507bc70bdcc09
SHA512 2fd126dfe628a1d9aa715f00a29883664a6cff983744dfab7885a1cc4ab23e2be01904e23e0feaa853040adbb317f4d927bb8441e7293b847e16ff26e61bd19e
SSDEEP 24576:ywsqjnhMgeiCl7G0nehbGZpbDw3Ic4HdS4zRTAv+CXm8PRUMKRhjwfZDL:ysDmg27RnWGjI4c47z+GCXm8mz3jwhn
TLSH
T19F95236AE8842130D99C49B945FDF491501D3F208F1C20E7F1F76FE9ABB65C40BBA4A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4240	alg.exe
4720	DiagnosticsHub.StandardCollector.Service.exe
4592	fxssvc.exe
4740	elevation_service.exe
2716	elevation_service.exe
1680	maintenanceservice.exe
3704	msdtc.exe
3960	OSE.EXE
3472	PerceptionSimulationService.exe
4500	perfhost.exe
1324	locator.exe
3212	SensorDataService.exe
2404	snmptrap.exe
4144	spectrum.exe
4904	ssh-agent.exe
1072	TieringEngineService.exe
5052	AgentService.exe
3484	vds.exe
2272	vssvc.exe
4604	wbengine.exe
4328	WmiApSrv.exe
4940	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\wbengine.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b97922359b11239b.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\spectrum.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\AgentService.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\System32\vds.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\vssvc.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4280-0-0x0000000000400000-0x000000000090E000-memory.dmp	upx
behavioral1/memory/4280-65-0x0000000000400000-0x000000000090E000-memory.dmp	upx
behavioral1/files/0x0001000000017049-429.dat	upx
behavioral1/memory/4280-444-0x0000000000400000-0x000000000090E000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052a02a428963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0d863428963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e63a0c448963dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000522094448963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089ea76428963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d49fd0438963dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4720	DiagnosticsHub.StandardCollector.Service.exe
4720	DiagnosticsHub.StandardCollector.Service.exe
4720	DiagnosticsHub.StandardCollector.Service.exe
4720	DiagnosticsHub.StandardCollector.Service.exe
4720	DiagnosticsHub.StandardCollector.Service.exe
4720	DiagnosticsHub.StandardCollector.Service.exe
4720	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4280	728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
Token: SeAuditPrivilege	4592	fxssvc.exe
Token: SeRestorePrivilege	1072	TieringEngineService.exe
Token: SeManageVolumePrivilege	1072	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5052	AgentService.exe
Token: SeBackupPrivilege	2272	vssvc.exe
Token: SeRestorePrivilege	2272	vssvc.exe
Token: SeAuditPrivilege	2272	vssvc.exe
Token: SeBackupPrivilege	4604	wbengine.exe
Token: SeRestorePrivilege	4604	wbengine.exe
Token: SeSecurityPrivilege	4604	wbengine.exe
Token: 33	4940	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4940	SearchIndexer.exe
Token: SeDebugPrivilege	4240	alg.exe
Token: SeDebugPrivilege	4240	alg.exe
Token: SeDebugPrivilege	4240	alg.exe
Token: SeDebugPrivilege	4720	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4544	4940	SearchIndexer.exe	109
PID 4940 wrote to memory of 3176	4940	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe
"C:\Users\Admin\AppData\Local\Temp\728883ca5f01e1d04e1ca977f22653ca2038f5217f3549943c335cc00f3c0bce.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3976

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2716

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1680

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3704

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3960

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3472

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4500

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1324

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3212

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2404

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4144

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2860

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3484

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4328

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4544
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b607b93f1910f7b6a8e550cd4d371a12bae3c8ed36f4ede335f11fbf22b04846
MD5 e1898edd1dcbf4db25806304a38e27dc
SHA1 d8f0243b6517d644ef2f1260adebc748a22d01cf
SHA512 4083fa88e73cedfed78c893390f3cf9433f254d3670d6c163e85400d23d1086b64af19f78aaeca189b466001e25ba6db050a76922619e0b14e3780b18ecdf285
SSDEEP 49152:yb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnvDmg27RnWGj:U3q6sjB0D527BWG
TLSH
T1AFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 08178c938d3c5788a5cd12b1862b0eea3da718eac4323f8a5fbfc8e03ed65d3e
MD5 7348fb1b0430d286c49eda03a14a641b
SHA1 d6a116437a9da36ee57aaa0eb70a6401df8c72c0
SHA512 cb52daf182f2fce7c49f5ff1e278cf168937d70fb2070c940853165567cd2fc8e75076093fb436fbf0136c87c2352e8eb8d26c982aef6ac296b328b13b6f5a6a
SSDEEP 24576:uXYfDtczA0sqjnhMgeiCl7G0nehbGZpbD:ttclDmg27RnWGj
TLSH
T145650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 148f2af0bf65b97a13c55e4b12c410446b528fedfb902ebe5d6620fc3acc91fe
MD5 5d71cad0f551d2e27204978479af2dbd
SHA1 ca7de459b9600f49523ec9c7421e840890e5731a
SHA512 f23256591c0232b5b6d83a00fe6a354382ed68ffeacaa452beefb00bcad6457a69cbd0f770ab4197e5b44102f862c33504e68758d18c6d2d3e20b0459a1223d2
SSDEEP 24576:50Le5ji0hmxxrMTsqjnhMgeiCl7G0nehbGZpbD:5Pji0Aj6Dmg27RnWGj
TLSH
T12F859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 388c5ca8a6e584e6675b68299b85a325dbea08b95a2a690dd899e1f4398b75c4
MD5 e7c265be30a3ab2c2ad9003fe2eac6c7
SHA1 957ddfcfde473d292df9d279d3c28b8887865f68
SHA512 fe15844d4d38e964e1f2fe03584b5b5be220cb0887f98e99ba644d708abbc62520a47a075d179946b6c2d29030bcf507adc7685ab42e5afd0fa31d18d2a460be
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWn6q8wyuhsqjnhMgeiCl7G0nehbGZpbD:m/ezSC6vUzPveHjymDmg27RnWGj
TLSH
T147755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b19ae337f9ae0931b805d8a3bb37660485e6bb42101031143249c6c2ec7668d4
MD5 cf07a1d20adea02d1695d72dee225d0a
SHA1 870792f50231bd6cfbe83b4e5f06cd067b7945d0
SHA512 1aca577ef03de0f20076711b883cbebfd9a43cd3d2b101a0ab3b933332c8caeca32c97703e80786339753e8e8e07c760b73d6ff7e32b3867ca30669a2ca681c0
SSDEEP 24576:gVbqPb88hv/l+YYsqjnhMgeiCl7G0nehbGZpbD:gVO88hXl+tDmg27RnWGj
TLSH
T1A8559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 60033760e518ab0b955843172f014cee247bc86f88c0f8d179d37bae906a7eee
MD5 402366525ade10992a8696e41b2f2069
SHA1 839e69c2937f8c5ffa40bc37adf310ea6a26aaf5
SHA512 303336b3b25202812231acd865f5500daf025320d15eeb2852c85964506edb47ccd556610b893e025be86771a9eead28987d301fc77d836dd74b079f410e1558
SSDEEP 12288:PL3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PL3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF4523BF864C50DAEB7608B5C3E9F51DAC137E56982008536A637CFEE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b583c5ee61981d73cea25e932f732d5945dbd7aa41e3e2534c1a97092c9c9214
MD5 936872344767479c935712b96ccba57a
SHA1 c0dc78f4987566fee87d06db554268458867ed40
SHA512 1a9e0fc42d26780993280f135e5823cced897d5b5740bdaf79e9c706d7e0122d7a3d96b90fdf1f3fada75358b2366d0173675bbe0d380f9095b5ad6481f44ae8
SSDEEP 12288:KeBNUbTVO86UQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:KJIUQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16965CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4952c94210e87571e996952191dfa6ba0f083074da6d8e78aa364107abdd612f
MD5 d4161512eeb1b6d5b049bc405216802a
SHA1 203dd842911b5398aad3f70c18c1650d5a20acbd
SHA512 c2c17830d03dd78c63d8cb0f97887a4713954934df64579793c1c1996a61998154da7cfd0194741890117f2b5c24cbcd31da2b51b63fd9e874204c5da3158bf1
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THv:9QvGAdlCEL8c/DRNw5CFD527BWG
TLSH
T184266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 2ff0c60964b11d0bf4691620a831f8ab3dcbe3aad47423081397cedadcec6bbb
MD5 77ed5e02a92373ba2eafdec46bd5cc1e
SHA1 9957db039e8e8e85705b80b351394811ef0f8cd6
SHA512 cc4935358da821ffcbaec551fc30c506bc5e21b899ca3f1b14d4a838cdeda3a3a6a0172cd74f5771c060da245d70112218110b89deead56da7d88b4c6d7db806
SSDEEP 12288:JAwSfxL/2Dc3RDLLmt0LDQewsAjGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:60ewsAjGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B475E031FA74E036C77B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0109034a21a9f7172f1eccb2bd86da232afb4f422cced82934f374edc8ec7af1
MD5 1d7981414787d55b70113d8007abbcab
SHA1 e7a76727ddca67ee1816db401d7aed06e0db1ffd
SHA512 5f63a6a9aaa292fc4eb85c5440d0b29b9c3f7d64de585058e9bd00f4f1e0ab60fd2cce271fe331dc4f4c2a562fa9219a0eca0b37c9721c1697af37547004fc3d
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHiVQBWG:AUEtQevvqc2W1cpV2tI32VB
TLSH
T192474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4d99c5b1fed42ecc69df66a7f381254677232dbde2d440131716c8948b0dd2d7
MD5 774cd7895a4da4652e0b618d63373133
SHA1 5434cad2daa0d20e28d6cecb0e0e001818a4981f
SHA512 7632cfa6bca0d0c221940443cf7530094bfce360f34d34bd5d0a93ea2a2cea73e47aed776e86d7714606deb7387e7be4ce7c6cf2c2f1305d811acee6f7727ff2
SSDEEP 49152:7CbRquA/m2yL5zTfFiV+XenmE3/zqDmg27RnWGj:koquVjnmxD527BWG
TLSH
T108D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0b6b6659d418a51486662fa685324e35c7c9380eda95c20eb04a18350057b393
MD5 398cc5a6d68059f95735004d36600b3f
SHA1 79084a186344b6c40b13d460bb647fa726074fd2
SHA512 af1efd88c67c3b6a2eee81ab79e00d8caa395bf34931b296b757828a48656bdf218a83bd29995d8b1c35c3fdd02504472e473977ae4732c0f7efe880d0d8b208
SSDEEP 24576:fAhGL3IFoiwtA5l7S53tsqjnhMgeiCl7G0nehbGZpbD:fAMUFoiq5BDmg27RnWGj
TLSH
T11F359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 83614790fd107729a871610b5a58b915d04d89c387164d6586fd8538b3d915cd
MD5 a2314862fcd4c32ac0f105d55fc1e230
SHA1 1d372707ea665092eb67a964268442b9e14b0360
SHA512 b3f672d4d9d8abb13765896a783eb02214113c6b6b9feb23bc05cbb62b7633928c28794da475bf853dea13f4d546531f3746ad146691448e7b11423f24b0a796
SSDEEP 12288:rmw5HEjsChNVBFgl0WDm+CBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83Li:qwu4OWCsqjnhMgeiCl7G0nehbGZpbDv
TLSH
T14E65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b66221a88d5fdbc51701933e2cab2f57b4c5fbfccc2578c853504e1720ed0771
MD5 e6d72cf705d375007b604d6f91d83606
SHA1 13c518aac21a63a8254f56baad1606821edeea0c
SHA512 b2eefa2325bce73d9888533062c21bea70f448629783d481149d029620196118eff58f9deb197e914a3af993ff02c8c32f173db669007677d3884a146aa827f6
SSDEEP 12288:SeZ1IyWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/ZuLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F5512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 66e2f4346822142071451d0f990afde0c165ebccfe016337c12a69ff1b4183e4
MD5 1eee6243918ec31911baf1a83d69d56d
SHA1 417dfe998573579f41c068985541eb8306ef1bbb
SHA512 1ea3ff55c9ca1fd06afa3ee276fefa769f23fbca04ad63c4831a46a3d1fba63e7b484434adb0c1c560e1eb6970ca6ed435358b829da38d3f1ecad5de0487620b
SSDEEP 98304:GQRQyi36YOcPbLvw2gAf+PN34D527BWG:tQyiKa/X+PNoVQBWG
TLSH
T118667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 eaa9c4e3944d962c945446b13d35ba0804cf316ce11bd1c162a0d299fca035c6
MD5 f8040194531e938c96e8b7b4b7f72faf
SHA1 504999b9248c1cfa9b0b699be8e98fadb01b3fc9
SHA512 40873a96301971de5c070f131a8c2701a6520240bbc38281bc9d7296594b23afd23771d47445b7514891a8a9cedea86bfeeed493ca4b28b518f9eaf2895331c2
SSDEEP 98304:1QRQyi36YOcPbLvw2gAf+PN34D527BWG:MQyiKa/X+PNoVQBWG
TLSH
T12C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 93ecf4c574e809fa86d160bc5b40b053ecd6c032045adaf54f6c188a6563ddb8
MD5 e0dfb5d0c1c1e157c15e31db5becb3af
SHA1 42e3d81ef3624eac418390794b16881d2e915bee
SHA512 4d6225fc7d61a7019b3b75e21a733bee18a9e45dc163b8004e33da7f235da1a20f06192bf71ffa5cb90457b32b3c9003f8b52bf4d16a7dd6b7588458bec5de2c
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL07sqjnhMgeiCl7Ge:368Qg55nhceWu7PNU3/6Dmg27RnWGj
TLSH
T194B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8b725476a30a0268bcdbe1d877e0e175f7c2ddcda007b840f33eff4f4bfe1d1a
MD5 6d34ade9ca134595c0641c6d8414cdec
SHA1 41d1ed770de8b03ceaee4a2ca4d37b4c77d2c7e9
SHA512 023f5a71d167c27eb3cacfe577de98c2107f7133485cb97d07e19ea2a8a2d51a64cf8224ad456b739e5ab3ef3eda9529fe76cc5a3221bf845f92bda5f310b957
SSDEEP 98304:Dy5112gYy5azzVvt69nLKnhZLD527BWG:eLIHEWhpVQBWG
TLSH
T1D8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7dd94929e6d3c390fcdc39f7e460b33283012827f0ea5d736e8060aa6d8ba4b6
MD5 b593209a3dcb68b9961a77c8f8e51ded
SHA1 2b4b656920acd77669eb65cae1e434727dd0d353
SHA512 83f5ccab685b691b5db3f1c24fc1b2b1570d85f93c510a2f58a185381215a7a8b0980274887e2ad4c0d3c36d8c04f5466399e151646d8632ef1e45d148da61ef
SSDEEP 49152:xB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glADmg27RnWGj:nu6Jmdxd2dAD527BWG
TLSH
T181D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fd87714239e4c066de286007c772217f133919809f9f8753b7f2bc01905cee27
MD5 824e3b4d2676ad9b1d1a41840eaf1185
SHA1 e702794bf2c5541daeac2af1efc4df0c3a8c9a5e
SHA512 0fe2a5c2659d517ef8234dbd36cbf11594a713f5a70a84805d7b3df4afac52bd77f94cab624d6a9d597c5bb19b02e1b2e08da5963684f910ffd6d3199daa509c
SSDEEP 49152:P1hpsNoJpF1A63U44CwH7R4xsDmg27RnWGj:PmifPWRxD527BWG
TLSH
T1D1B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7a2cd9b8a07bd4c60a3752e8e9eeef9221651026d04da45ef366a69ee8efa5c0
MD5 f68bc4295abd22b0a552c1a2f48bac0e
SHA1 b2eeda798586e89d2aced4b893ce50dcaae1545e
SHA512 e34170b2f23295a1a05aaf33653f79cbf0498c18fb281183bd74e49e073f0d04ffa2dfc1e10cf92f33f99ebd2308055d35f4b3b473c4fe092bace18e2e002dcc
SSDEEP 49152:4SuZQIY0Be2KcRVtOnks6NMHq/Dmg27RnWGj:i5dKii61/D527BWG
TLSH
T165C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1252b0d9a5f79299e0af5639809e05efc34864f738957929ccfa814a1129242d
MD5 5c43727d772c7c09aac9d0c32139cb8a
SHA1 d1a3ff95fe304a258dcaaa822e5ca4e02107bd9a
SHA512 a1fb3377bc418867f63c77180c458b81224e15660a8364a5747c69bfa40805aab99222329da066c91272f439f5c0cd4e03b3a83be2c6dbf017565c04df0ee018
SSDEEP 49152:RhtSn8EApI0fig3giDn0AP5wQDmg27RnWGj:AX2imph9D527BWG
TLSH
T1D095BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1b47dcb622b3692fef3f39785b073e68a61234c1361f77c3c83669ee3e25f34f
MD5 29f90c4acd3e23407ed19d0461be8a3d
SHA1 33bf1338bdfcf8c439b312f1bbcc3b05f4c53dac
SHA512 f9948b51f41063f075cf6680456fe6f408c43301da45ea5777c528b4d9805246835ac90b0306318f2834077f42775f1c923651e75a29fa29c32070ba1c285714
SSDEEP 12288:3PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1294523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A5B7CBEFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a7eda003f266d263b60beb7ce7b5c9ced242b4f3bec28d21bf7a47e05886cca9
MD5 99ecb7741d805e049f891c6ad8b191ab
SHA1 2ac96f7b584fc4670a9721cf3f315f1fb51a5ee4
SHA512 2d21f314359fe2744ff6deaa85388d063fe1d24b2701b77b2a67af18915a2da954ccd197e874b4a1339c70c40e2e3b2b33cd3d343317c8d0cf93ce777f982e92
SSDEEP 12288:dKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1794523BF965C41CBE52648B5C3E5F10DAC073E57E92004937A977CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 342cf51eaacd6d90e8d1c045a78e9e09848f07a8efde5ba0f5dcde7229db9663
MD5 8551185ffda93ee119565ba1679be358
SHA1 6a7c91295879a80d180ac84ea3619f095c24098c
SHA512 f7cdf119e1218d63b5904744663728016f4e90de546e2379156f65b489bf753b54b2c301af1073aaec4c8624ddf7abf864e81348b62b0e38258c3ae8b7589426
SSDEEP 12288:3IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1984523BF965C41CAE52608B5C3E5E14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4d582743a77df1e899e28b14902ae7976705306f5891842aaa4913222c45dddf
MD5 049b782078893c507bef03cc75be6190
SHA1 c96377aa1d6f67e46e2bbe942f26f55433a0108d
SHA512 2ba83d715b83cbedf53810df9ad5cfebd3fe8b5b63945c749060800b2346086c954e3d1df105793df4a36103490bb14c73a68aeb7eef310aeab590301f345d26
SSDEEP 12288:JVNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C145237F675C00C6D83685B4C2E5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 36e4f50d15b8c072543a07af07b83b4a704d50dd8f9d14a4f8a913ef540c6492
MD5 3e9509d8a97262ea2bc63dcd6c503b84
SHA1 c904111b2b8c5cac95849c35f10361ac6d58e436
SHA512 f13978d147154b02d4d791fdc5a1c475ffb91acb6986c9c64b83b746ff3c7f0b9150dcc2dfeb196abf1143fa7499eed55765c29c9d271de8a0752d4437328475
SSDEEP 12288:OVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A4523BF965C41CAE52608B5C3E5E14DAC073E5BE92004937A9B7CB9FBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4991791a13d30b0542cdbb7c1ee571bded0796a7399d05a0b41c20a10f138950
MD5 b3f499258c5ca809174943d1bb292888
SHA1 bc67ac794217c73b4b86af790519c653406943f1
SHA512 673d27c3621a8ebb4fbbc431389267494bd73d389ad26564b681d2419a86d4337ae898ab33066eea2e8d30d4abeca9be27943843e403471c0766f5103c7f2d28
SSDEEP 12288:MeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1024523BF965C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b2008b04b13738407b7fdf3765cd978c76e6e4258e533740eda52180377efbe7
MD5 dab257ac2137dec79ec6e94ec1143c91
SHA1 9bc5949c8b21622847c3991f29b6b0530d96207c
SHA512 ffd806202b2f7ef17c5d7b8077845265696c135d2e7ffbbc04f56ea5d5d9ab9ca57516961aec0c1d026c9042154f984a195df54fe36f54de2e92175cf3e379da
SSDEEP 12288:WyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1444523BF965C41CBE52604B5C3E5F11DAC073E5BE92004937A6BBCBAF7B14684B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9b894c131091a25e329fddfb7ba4b3c9d03c95537214f6b3045df21edd603807
MD5 55e6eab271ecda1e0ebf4bef487d7711
SHA1 2bb4566febf64d6274e3eeadf205736a6addc0d6
SHA512 421be5538035a7c3e9d6da6889f1538d782f70136e61e8285448aa17ee02512e84dd5bc19ef55b0b98d0ed65e80cf902b0df7f74cdf97bdac80e686d88664c10
SSDEEP 24576:cZMRzFVSOqsqjnhMgeiCl7G0nehbGZpbD:cZMRzfCDmg27RnWGj
TLSH
T1BB6501A9B39018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b5b7d21d9e83659d54df0163823526b209fd1490ec70a77b1f0e2b866b470d53
MD5 3baf77d16b3db44fef5acc36499b1063
SHA1 5b799ca2180ff4351d62a22acd87679b0fd0f77d
SHA512 0e6bbb48bfd1d1ee95fb23673d2de1bad83d4c9e35f3ac2b1d6e18e12e239785a2deb5e1b66ec539269a8dddb661087c95fa27834424c19249c650a9f89fa494
SSDEEP 12288:7bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 017689a8a821623ee2165ee9439db80105f1fd03c5f0fa86cb5506c2c23be453
MD5 83e081f231401c9a84c94d4bbfd00287
SHA1 1eed9c1877d48d65f7cd6a1ba2e1f4c4c605e18b
SHA512 875594b1e3742a1937c6694f39477d1d8b97a59d5561a384fb0647e8928e2d4c8e1c6b3d7014953f3391f3f20a4a858d8280e647f302742e38373f00a0654016
SSDEEP 12288:oHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1384523BF965C41CAE92608B5C3E5F11DAC073E5BE92004937A5B7CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 6dd7308b9554a0fe367f4fd2cae58c11d52fead1b7b2423fd73a2e895f992218
MD5 5f116a11c2ac8ed174d9926752485371
SHA1 782e7c8b43b464c8d47c6f816cf456d7db233a8b
SHA512 c355b9640844e6ae25ccecf55795e2845ceafa6c6d51592e3f89a01e150ccca6fd0240af55fbd0bcb791e5ab13ed118e14aba66cccc804816003f22e8622615b
SSDEEP 12288:hyPz5L8WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wzyWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18855125B73A430F9D1378178C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7ab7567116fe51dd28c91fe1ae70473b0608cfaa67b153136b1f2477480ec92d
MD5 bb520dd1af30fc34a486ad1ddc5a0f7f
SHA1 da1219575c56464a8567510474707f86d6a2fd90
SHA512 a5b041ac08e6fd0141647445b1fa520aef7088941348a3bb3c5dd67a637197cb1a5a9be85e85e59dbdc87ce1259646b9354c7a47fa28083e4897a915a0a90985
SSDEEP 12288:WbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7400aad0a3ab8fcfed2975dab261a7a9775adc2f259d2163d0afed6b50a4c706
MD5 3aebda3fdca8ac6425e5328e2ac201cd
SHA1 06c23bd09f819a24cd9bef58a948ff3de5da35db
SHA512 9272770cfb6041a135d9d82787a78fd51620a1cdec9075ead773b481c9d12317f267a6419f1c44a5473833d64d447f3c427da5a97fa74f9491932642d799964e
SSDEEP 12288:obXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:obsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1404523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7d3fa51aec9cc5f6fb1d99ab2ce93a274243c13194afc21604fc5af301cd5ecd
MD5 d492468ef651aa08bf457a36baa7e42b
SHA1 353eb99a180337da11ae73b40b28317b89527425
SHA512 bc9165f389063ccea7b71661d7966ac97861795d161a74e96bfab0f5610c892410cc5d141488349487e0ce93b18b3ed9fb73957e8dbe277752155d93268781fb
SSDEEP 12288:nyPz5L8WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KzyWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18955125B73A430F9D1378178C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 450967db06987b44f13164fa654a2c5841d22b35d237fe35775ff1500c9e4173
MD5 5b4a634a8dc36555a6c4395c9c9d7d0c
SHA1 f29f4ad86a27506c66c03571cbc6298b182c6467
SHA512 892ba228821c7299745b1a0be30b65b5dec6b95df657ff91dc32476a38d5ddd8b412f2af78386a3379a2e2bb8287a35a71a9dcaac52370ff54587cc48c4154d1
SSDEEP 24576:8cP4mcvIjkGOxhKP2l71SNKbrh/8KBDsqjnhMgeiCl7G0nehbGZpbD:3P4m4IpOO67N8KFDmg27RnWGj
TLSH
T19565BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 790df0769bc6be7fb8e4a03e7eb83326999291569beedd04a618b6feeb563541
MD5 bca6a65c9b80cd70bdc2fc5e8914c16a
SHA1 63bd028135c725f04c878f55fde66af75a7acda2
SHA512 26d15facadeb95b0cb11f081491ba670d4c2174809cab026311d99bba885ee13698e7470b9382cc20da4242f6836ccfc6b0a9d31f20f87cccdc264d47238d605
SSDEEP 12288:TbsfLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 172570ef5850bc4d66ecd0b3539b6b9e24654493fa674c998f02d8af2cb05df3
MD5 627dd7f0baa12571f681d0787f188330
SHA1 0340d8028de728de06011687c4bdc30ae1f8af60
SHA512 47f76d37f77a4096bc74191c3f5a72787536b7ef4c6be737c5ef7bff072055b08075ad89941747552de7fa6db8b3ebcbec3a116fb28086fc486c4a303a86aa94
SSDEEP 12288:orXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:orsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C45237FD35C518BE57649B082E9E02D681B3E669E204483BA477CFDF6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ce9e15cd8e9f782ed2fb664c29e9ca7ce840e582a917de53ab6132c4324defe4
MD5 06d31c1450295030365d0c2f3d3ab827
SHA1 b52a86d687d7064287a3f1aa2e8ea3626e57bf1d
SHA512 da83e9366cfb9a7d158fceba98de56888fb9da21375ccaf86f78edd8a96fd960c0474084d4f7d5cbc54865b395b9e8c1d2649addae8a8974ce476fc7c2dcb2d2
SSDEEP 49152:Fa0h2GEkuAe73q3pp46zwwQJDmg27RnWGj:Fa0hNYG4JwiD527BWG
TLSH
T19B85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 f37c1f73c16df7f4b7a0c93d83bab92bf7e8b1c6850d494aad21df04de911259
MD5 7a8de162a108a57dd8bb899bb6a8be16
SHA1 91e7535233ac800853598ae52e42e7cd7d5b663c
SHA512 80a1f11896d61a8bf74cf80730e3e9e93364c1f74a8371e23d48331e1b621c65128549c618b81ab83ac9857b72311ca26f40c004394174e297a40c29815480bf
SSDEEP 24576:11QT7EcpfxR+N5AWAz3ooiYujMqbBsqjnhMgeiCl7G0nehbGZpbD:wTDxR+N5YzT4jMMDmg27RnWGj
TLSH
T1CA55B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 7718a397d7086ca5c75d60c8b2d871c6025f4c1f2cd4612e7863420c3bb8b653
MD5 1435e778624152003d1759e9d8390425
SHA1 d755dc56c882794d7aff00f01e362fff9727ec83
SHA512 5575b708129660ac980c06faa315dbc6aba2977f1f09d266c7419c1e5d6bc28133dcc4a89e5ee7c5fa126339c700bf01fc904b48566dbc1fd9b41291bd537f7f
SSDEEP 12288:AhbHjfX6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AhbHjP6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E455127E12AC20C9E57291BD8296D10AD632BC26172053EF27D281BE5F37DE84D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 dcbf968765459d3fe1255352c3e1de60648ecc74cc29d950d1f93c315cc36153
MD5 55d2fab6940dfc9e72e47d3ace51a163
SHA1 b150f36cd3041a08e7456e2d4696876f67dcf591
SHA512 830b4792856f267ca9278ded85e966c4795c4add27d94847e36298ea74343c16611876e4596518d9369d58f8ed92712b99d08a5615b5261c103eb975e3ebf8d3
SSDEEP 24576:c3YgnJcRTk4yti+R5dpR/CsqjnhMgeiCl7G0nehbGZpbD:cIgnaTk46ppR/GDmg27RnWGj
TLSH
T1C945BF2EF2B910B9D8A6D136450147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 246afee901e6057319c33b3991a0c6a9c1c2aa56b583703cb5d8cfd5d5e914ea
MD5 d694f15fb0fad80a742c012283f17511
SHA1 d078c314db6c10238dd66cdea9e5ab4d6977b243
SHA512 fdf3d4fb1bbe991c7bf1f27f638fdc80742450f4551dd65618764d1c0e6386d6adb29186d27a2d9fba963fdea802cb06e379335d00cd973070972ad83d3c63e3
SSDEEP 12288:uXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB4523BE924C51CAD93649F5C3E5E11DA8073E56AB2004D379A77CBEE7B18E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 0c87d92b305f2c7574d99f59f1a8bdbb51423512fb55369dd65abf3714e2c8e6
MD5 1343bbdac7c8939d7a56b420d971748b
SHA1 cf26158c1c51dc0026266bea4054988fd1f00a58
SHA512 b37ebc5eca2e444a1d72a19db2124daedd1258f83407c69f3941a677d158b6ac33e9e6764adf30dce5e54b2cd04e1b6420aaefe29dc07507efd397f7dffbcc13
SSDEEP 12288:MObfA4LWOsvAYFT0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:xbL3UT0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 aa63e935ec2bb91f6462418865caef0a281cd6d03ea02ac8774d3cb33fe91e77
MD5 89bd424a1420f68af732513891642b6d
SHA1 f5bb89ceffa2033e1c22cdb2ce8d4d727f0907b6
SHA512 fc29fa47f7bfe3377ce15a5c15a519db9854534c6fa2caef0753f06ba23dfa51cf130f6de6434d0eb7eff9a0289181debf0b1bf8a9f1c720dfa80613247db4ac
SSDEEP 12288:fpFtIOwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iOwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18455022E33EC10E9E536917C8692D20DD632BC66072117DF06D184BE5FA3EF85D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 07acbb658a57ef3d2d986741eea19478b23df657d3b779d52c7c424ce51078a7
MD5 0872e2351a32f0808d359d3cb9a40ac9
SHA1 0092ea20dd502cab8cc3a84f608d543c62c6a598
SHA512 5e5bcf30c12622c14f284ea1694675c9ce3871920ae97b12a6856a5b422ec6f54d4efb685478217cee3ce696cd265efb6d747e55dd2bb5ff2f4aa54d13b89574
SSDEEP 24576:Z7NM9YmZqmWMUkPjZM48Mv6bEhsbsqjnhMgeiCl7G0nehbGZpbD:Z7cBWMpPjN8DbEhuDmg27RnWGj
TLSH
T16B659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 03085965352e7d98487f463dbcde4a05e2d7a036b9e64f62aa48bf2a265b5d20
MD5 a96fee5cc3352b994e553040046925e1
SHA1 2072f7b9cc771f0fd0aaec91632cf887ec36ec81
SHA512 dd3cd843ce637d0c1db4725537d4f8cd5ccc1d7bb72453cced8679c79b93c23476e9b59a4b3c0b78c3461053678e73411aabf390437bc82c0e5a602f5df34244
SSDEEP 24576:tW6BApg2YuyuNDYTabvcRvNYf8km1psqjnhMgeiCl7G0nehbGZpbD:tF2YuHNETovcvNYf8kmvDmg27RnWGj
TLSH
T1B4857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 bbf780fbe38471cb0c256aa70aa49275a27dc522bf4625f75bfaee75e9db1775
MD5 15dbc527248f85557cb1cd80267060ec
SHA1 0dc315e441d2b900450f40698d8eb91bedc41a2d
SHA512 8ea8afbe3558abd50223595d367e85ecfad7760df75b7edb5a58650588752eb9f337f10be207ac85f0155c9a8c384af8f4cef7ea87b4f0844ec1c17fdd1d2298
SSDEEP 24576:VAFs06+OmlfkNXEbTossqjnhMgeiCl7G0nehbGZpbD:aFs060lwXupDmg27RnWGj
TLSH
T11765AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 1cde14df57678059bf635e2f38069255381f10dfbfd12b22dc6d0e9a2fa4902f
MD5 22b920bd536c915774d99bf50bbacade
SHA1 514620ae4a4e934c37340dbc7e7cb86ccf5c85f4
SHA512 6b97a3dcab6e5ba343ac18f87ba1759c6710335b3ba99ef0ccbd0b40aa8c7458bad70911d5aef78986a0f5c374261f1ed33b5e4268e3763336e65a1a812867b3
SSDEEP 24576:YJnJ5D3Wt1sqjnhMgeiCl7G0nehbGZpbD:YJnJ5DGtpDmg27RnWGj
TLSH
T1F975E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D5357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4d39c2f0d405bbe308905fe54c97e049456bc9a83a956732543b97498a548516
MD5 c0f5d9191498705cd1f6d4f9fdb897fd
SHA1 0bc29856e9720f410a6990946be983dcd3cc5c2e
SHA512 eaf53044685d49ae934f9a3c03a00170d4caa67ad617572bfcb5e891a229ddb4c4f63f0f64617d6141a876203cfef4b636ce79e3718bfc0f7b238131b87ff909
SSDEEP 24576:4EPohm6/7IIXdwcXrif7qQncjlP65i3VuCsqjnhMgeiCl7G0nehbGZpbD:3o06DIKdwc+eQnSt65aVzDmg27RnWGj
TLSH
T166955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 ed055bb1a1bd18ecdd0467f646b5a66d989ab99cfd92798ca592ac7ceceb890d
MD5 88d6fda97f7064803d4bb9522267c3a3
SHA1 05131e2af7d75fc8ae5aff9ff0f72f671119c860
SHA512 ede0d5e847038004a56628bf3db4f4ae5f64d899329c8362ad0938d1d317c8222c6feea9be1031df458e92cd8c778be798abcbc74c1aa3f98a98c9c98072976b
SSDEEP 12288:NEP3RrBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:urBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15055126E679C60DAD136907D8291C209D773F4716B2127EF26A2C57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 adb6c0814fc40ea091769bb75c9440039d11c3777e505d15dd8951905c66c0be
MD5 632b612be424d10ffa0cbdbff61788b0
SHA1 d6d2074cb235bde0dc937fb69b6215a95283984d
SHA512 9d772151603e776a7d2c1be3ca7d4d567c2d429b242bdd641e93d59efdd3fcc6a7e44edd8b3b0fa061cc9bd82388062eb0df4eac718e36876b5e3f6a79e182b6
SSDEEP 12288:jjkyKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jIyKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T170552219639C60C9EA760578C6B3D1589C32BC319F2046DF6591FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 0ae217091f77502ef16c032beb7a4b385599f0f8f8023196244651fb4645b483
MD5 75d42a236e2bd855a6e9ec984f88c319
SHA1 3a0e51933b23f03da7d30c4b9b6d3c1576e8bee3
SHA512 c75f22be82dd19113a1ff5348269a8744b32ffbfc0353d34568afc0d370909b5aab8d70285aa145c94b7020d152a07e58abd2fd83d56dbd4c8785b97d5ac466f
SSDEEP 12288:6FAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4AsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F545237E525C60CAE93645B4C3E5E51DA8133D36AB2014E739E3F8BDEBB24D44B39812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ae2cd52381899428bd69a48f05bc7fbee2f8b10ea6c024ee900bd966ed1bd98a
MD5 95989c98333ceeace03227f6c279240c
SHA1 c2302d94307a6b286d90dca0a10596f72a7d3a31
SHA512 afa1c003d76013ac0753a85c341c2481881c25ed192f8c0635e22fcdc878a4d3599368abf5f4d43e2b36ae4ac0af7d2f9d80fef4fde0605049ded817a6ea26a2
SSDEEP 24576:AQ9MxZKdcz97w3zsqjnhMgeiCl7G0nehbGZpbD:AVKX3Dmg27RnWGj
TLSH
T14B558C2DABE9058AE177D275D5A250C3A633B4311B31D6CF2448D03D4D7AEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 9fe9af555f31c92f709e1f5298143ac4cdcf53a8bb15b88626171128bb692c67
MD5 a65b3dfcfc33ee191084b1d08a0df243
SHA1 774c20c2e5f4a319ea3d9f3bb4fa0fb4d7c6aa90
SHA512 afaea94820370f21e6930416ec410daca9634638cc2db56b2c497e60da0ba52c886b8f0da33a1ab85b999ba0bc931b37eae6313c319380e1d44cfc849500f3ef
SSDEEP 12288:tyoKo2HRple9pGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:tyocxApGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11465E01FB76D40E2E176813C8985C249E673B4305B6257CB6692C73D8F639E8BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 cac98815df1ee7bb6959c8a5d109cc5c57743b505139c44b5e6d2a9bdbcd93c9
MD5 11253844d9ef8308b77d17f61dce313b
SHA1 5fc5fbc2bdd6c6d005e92abcdc346ed23e273ed0
SHA512 7bd0b94add732b8c060fe6faf11069b3f8dd332c6d787990bef9121490a247a65912930c3a7b6a2db70c2ae3ffe1f7b0561902568336c9c26a292e2290e79ff6
SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKKDmg27RnWGj:T0zuNIWD527BWG
TLSH
T130A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 935b56fdb25d70d7db120587be640e2b3463bde7b5007898e80da9866457c6fb
MD5 d3b42ab7a68a63a3ac641d7f171fb8f6
SHA1 730441b741d4957783640b48a56b75a425e66065
SHA512 be8e91af2b73f235ec739a880e13dba7f25877fa22f87178334e0457eb1c40bef5c5665d16a4be8dfa3ef416d10e823a82d0ac302bce9e10e4a7d656741dc1a9
SSDEEP 49152:NTDxR+N5YzT+jMMDmg27RnWGjq4c47z+GCXm8mz3jwhn:5u5xD527BWG5HKxmz32n
TLSH
T1B6A5E12EA7F815E9D1BE85788A23C512FA727821073193CB42A0C17E5F7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 52adc3785be2e67164b1c9ca9f0f4c8ac1ad95ce2b424b841c70d8c40631a344
MD5 36e9374dd26168d40427fb0555264af2
SHA1 da0d786759ab623667522c7e8b91af1e6f0edd3b
SHA512 15f252d1e6056830a359f7c3f29e22f33e6fb1e9a9b357309ce3fe2e42ce0a0b2e5d8e3f8d9752b9111d9813d90e1c7c78a1e1ebc560585e1b750034b2d9efb2
SSDEEP 24576:LTMdOz0FFS+bmSLNsqjnhMgeiCl7G0nehbGZpbD:Z0K+bmSLxDmg27RnWGj
TLSH
T10975E17EA36D14E5E47BC17DC653C90AE9733862032166DB0690C0B97FA7EE46A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 601f7647054fa0da0512d05f882f27986bc35ee4f10dd10fea91f14cffc69cab
MD5 37dd83040f858a2908a7eb7ba7e37af3
SHA1 1c79d90bb185c11cc012f1b8a4c536d14b646ab9
SHA512 eaeffb6ca01f8724a7b6b232802b1c9ba7309f589c065dd91ab4f8b82c3d021cf711baa2f92da889a95aa638df6640d6f8f9f25e1ca83bf6ac15c8551f723b77
SSDEEP 12288:u470Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:10sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C655126E63EC30D9E4325574C2B6D1099432BC36672015FF39E2D9BE9F729D48A38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-204-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1072-206-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1072-501-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1072-198-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1324-268-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1324-147-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1324-145-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1324-139-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1680-86-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/1680-93-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1680-80-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/1680-88-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1680-91-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/2272-535-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2272-245-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2272-242-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/2404-377-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2404-162-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2404-169-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2716-69-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2716-75-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2716-78-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2716-194-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3176-549-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-546-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-556-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-548-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-557-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-540-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-541-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-551-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-552-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-553-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-542-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-543-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-547-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-550-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-554-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-555-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-544-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3176-545-0x0000021B68830000-0x0000021B68840000-memory.dmp

Download

memory/3212-158-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3212-281-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3212-156-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3212-150-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3212-389-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3212-392-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3472-122-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/3472-244-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3472-128-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/3472-130-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3484-230-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Download

memory/3484-522-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3484-233-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3484-224-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Download

memory/3704-98-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3704-106-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3704-217-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3704-104-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3960-232-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3960-110-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3960-116-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3960-119-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4144-426-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4144-182-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4144-179-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4240-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4240-28-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4240-118-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4240-20-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4280-9-0x0000000002ED0000-0x0000000002F55000-memory.dmp

Download

memory/4280-1-0x0000000000A70000-0x0000000000AD7000-memory.dmp

Download

memory/4280-65-0x0000000000400000-0x000000000090E000-memory.dmp

Download

memory/4280-0-0x0000000000400000-0x000000000090E000-memory.dmp

Download

memory/4280-8-0x0000000000A70000-0x0000000000AD7000-memory.dmp

Download

memory/4280-16-0x0000000002ED0000-0x0000000002F55000-memory.dmp

Download

memory/4280-444-0x0000000000400000-0x000000000090E000-memory.dmp

Download

memory/4328-538-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4328-266-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4328-269-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4328-260-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4500-136-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4500-256-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4592-54-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4592-46-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4592-94-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/4592-96-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4592-45-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4604-257-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4604-254-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4604-248-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4604-537-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4720-41-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4720-33-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4720-42-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4740-181-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4740-57-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4740-63-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4740-66-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4904-450-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4904-195-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4904-186-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4904-192-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4940-291-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/4940-539-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4940-516-0x000000000BE50000-0x000000000BE58000-memory.dmp

Download

memory/4940-282-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4940-307-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/4940-323-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/4940-279-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4940-273-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5052-218-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5052-215-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/5052-220-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/5052-222-0x0000000140000000-0x00000001401C0000-memory.dmp

Download