38008836e75a6302e8a1a4ce966eeebd32504c115babcb8c22d581a22a545be2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
Size 1.6MB
Sample261024-s8ea1avxew
SHA256 38008836e75a6302e8a1a4ce966eeebd32504c115babcb8c22d581a22a545be2
MD5 3e8bf2913931b22ede8ebaa9b98b6d14
SHA1 ac47fdad0ca3fc0d686d0a3715b6a201c6a14e86
SHA512 a722811835356e0593f76e83e1347f08cd2206ec58d23237e500328f82ff914e25ebed1ac6f366a29a30e78d2b8a0d1bb6d35dc8d6a50caaa7f4eb40793327b4
SSDEEP 49152:htCXoPqjQx79G1poWl9ddLD2/s8+tgauhwbR3P8wT8:htCXoPBx+b3LD2EPgaPJ
TLSH
T1D785F04C3165C07BCA930FF285E5CF231014FA813B27A52EA6952E997A31E964BF7137
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
640	elevation_service.exe
1752	elevation_service.exe
5784	maintenanceservice.exe
1828	msdtc.exe
1056	OSE.EXE
3400	PerceptionSimulationService.exe
5492	perfhost.exe
1020	locator.exe
5888	SensorDataService.exe
5132	snmptrap.exe
2544	spectrum.exe
4068	ssh-agent.exe
3168	TieringEngineService.exe
960	AgentService.exe
2332	vds.exe
5668	vssvc.exe
5576	wbengine.exe
5388	WmiApSrv.exe
776	SearchIndexer.exe
4344	alg.exe
1928	DiagnosticsHub.StandardCollector.Service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\31252076227ba850.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000100000001700a-414.dat	upx
behavioral1/files/0x0001000000017812-422.dat	upx
behavioral1/files/0x000100000000c53b-420.dat	upx
behavioral1/files/0x00010000000233db-419.dat	upx
behavioral1/files/0x000100000001742d-417.dat	upx
behavioral1/files/0x0001000000017bd0-416.dat	upx
behavioral1/files/0x0001000000017047-415.dat	upx
behavioral1/memory/4344-598-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/memory/1928-626-0x0000000140000000-0x0000000140166000-memory.dmp	upx
behavioral1/memory/4344-632-0x0000000140000000-0x0000000140167000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001171b607cf63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa82e807cf63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8d70109cf63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000976ff08cf63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026915808cf63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002933f907cf63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000254aaf07cf63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2d1d707cf63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9f8de07cf63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d096dc07cf63dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0df6608cf63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ffe5cb07cf63dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9f8de07cf63dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
640	elevation_service.exe
640	elevation_service.exe
640	elevation_service.exe
640	elevation_service.exe
640	elevation_service.exe
640	elevation_service.exe
640	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4524	2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
Token: SeRestorePrivilege	3168	TieringEngineService.exe
Token: SeManageVolumePrivilege	3168	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	960	AgentService.exe
Token: SeBackupPrivilege	5668	vssvc.exe
Token: SeRestorePrivilege	5668	vssvc.exe
Token: SeAuditPrivilege	5668	vssvc.exe
Token: SeBackupPrivilege	5576	wbengine.exe
Token: SeRestorePrivilege	5576	wbengine.exe
Token: SeSecurityPrivilege	5576	wbengine.exe
Token: 33	776	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	776	SearchIndexer.exe
Token: SeDebugPrivilege	640	elevation_service.exe
Token: SeDebugPrivilege	1752	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 4360	776	SearchIndexer.exe	114
PID 776 wrote to memory of 4560	776	SearchIndexer.exe	115
PID 776 wrote to memory of 5956	776	SearchIndexer.exe	127
PID 776 wrote to memory of 1708	776	SearchIndexer.exe	128

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_3e8bf2913931b22ede8ebaa9b98b6d14_elex_stealc_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5784

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1828

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1056

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5492

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1020

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5888

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5132

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2544

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4068

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3384

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5668

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5576

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5388

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4360
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4560
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5956
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:1708

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4344

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f23b61f5a42a0bbec9b2acbca5979abc51580896c16becad8badcaa75dcee1a9
MD5 6717d5b58aece003b1c68ecb1ac6ef07
SHA1 c6324f941ae4f89985b2542a74b5fc592882b3f8
SHA512 f6f87422414805f030e60d28f66060ee5d273825300918367dbe2ef8d4a30f08f9a8111fbaff6ad632f7ca3d212dd1a066da17e8e0debb361b42f8ae8f58e0ae
SSDEEP 49152:kb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnW+tgauhwbR3P8wT8:e3q6mjB8gaPJ
TLSH
T1CBD59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.4MB
SHA256 a7743151b568eec2504ec9da79bb056500ead4b446c5797cb6ee2fafe48f5a56
MD5 d9ba04bc8ad1a52b5afb2e1d247fcd62
SHA1 439bc19016c0205b870365233636bb1f14d09dcb
SHA512 6f801fb3420cd009e2a08cb07323a238761b5ed6b618d9c0e733f504914ca13442371ac61886595f7817fac0f6cdb50e4dec4fdac34b1b4f88a8ef2c6a8d4084
SSDEEP 49152:Wtcs+tgauhwbR3P8wT8ejQx79G1poWl9ddLD2/sK:W0gaPJQx+b3LD2EK
TLSH
T136C51228739448FDDFA78279C9B28411EA337C4147A4E69B43E8DA661F336D84E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 bbd0d00c2adc5fe8a9ff3222b6ebc0d2820cd60d52eb921602c8bcbdcca65a4e
MD5 c9351e5dccecc95a86aec00e0c0c0cdd
SHA1 bcb06dcfc41dd5353c557b0aee1fac8d6009b93a
SHA512 fcfa906e78e7b837ff3d4859e5123a34548f3bb8502dc92200b1f06e19d0e6e4bcc04c22afecf0dc1aec973d5b2a284ccd2d0ed5bc1f6e085cd482597a46d031
SSDEEP 24576:BXYfDtczAl+4ZAgayjhwbmY3MaReFeDvSP3b:Etcs+tgauhwbR3P8wT8
TLSH
T1AC85F128B3D408F9DD67823CCDA28511E673BC9547A0E78B03E4AA654F736D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 6fc76dbf8e93c0e4a8cfe6e7991e8e9c3d2bff0e6646c2873945d9297a3b59bc
MD5 38125fd3e82275fbeb6d19934f722a7c
SHA1 f44cb198702c5b06c9973ae44527b7359dc94190
SHA512 d1a4cd8280ed49a615ee03f5d3d015635e589d052adeaad9af0c7b0f142f55b5826b4c2fbfe645cdc2bfd45a0392341d08521bdfd373f70b41afc5a50cb5c201
SSDEEP 24576:I0Le5ji0hmxhrMu+4ZAgayjhwbmY3MaReFeDvSP3b:IPji0Az3+tgauhwbR3P8wT8
TLSH
T1BF95AE16F6788335D073C0B9C5D2A69AED7134821B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 789b0dacf5405a40d7e20db302c29b440a44a58ff9ea6b1f707ebdd28522a345
MD5 3d03234368f407c10e4d9e53741e5fbd
SHA1 d0436117ec8c50ac3d0f917072220de5cf5f6e23
SHA512 63d33f0e11df6dfa447566f04eaffa9e9611fe41cf5eb932ac88469ecd805e4373c4681376097d291acf422ec41e02228483f782798c5365cc0e16e9dcbf0003
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWj6q8wyu8+4ZAgayjhwbmY3MaReFeDvSP3b:f/ezSC6vUzPv+HjyT+tgauhwbR3P8wT8
TLSH
T191756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 972d0d16465eeb203fe598a938441573353f985e62ec6bc5a869ced331815a09
MD5 54ce314519ca6623760bdceb48926b27
SHA1 e6f68e40655dccdcc93766f4010959cc4dee8334
SHA512 f0d45131ccb2daec0fd634502d5e2795dab109f4ba1d0e195a9b01e6c58b39375e7af190c53a243592b559371c3442b8511c3c4c8ba12be308b52cb2ed8b566f
SSDEEP 24576:eVbqPb88hv/l+BZ+4ZAgayjhwbmY3MaReFeDvSP3b:eVO88hXl+X+tgauhwbR3P8wT8
TLSH
T137559E66F5748331D073C0BAC5D29A9AEE3234425B318ACB1246D76C2E77BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 a6bf229dc55d32f1859ed39de5e5d608dd631262a1bac63b35c8845d8148e9e3
MD5 0b67d1dc2b9e3e5e111e4683a609f348
SHA1 8329b71c691b578748f14e948284c5978abd6cec
SHA512 5857ad84ae1c8b10e98afd93914129dcd90ee3f83faf6e82c4bfdf94711d7fbeeb55223a88f8a53eb31250bde5b36d4a5fb10f7a8616c3748fda27d37e7f5253
SSDEEP 12288:JGreH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:JGi+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T182652381D30C98CACB7B0B348B7A0D706699AFC51E85A504E9C97BD9CCF0DADC6B1395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 8749531bbb0f581a6a34bd3bbe4ddda8d94d17c559028b24ef40ab6860474c27
MD5 1487c76da898ba061f1cce67b4c39b36
SHA1 d3e675d24bb29d3ca48f0f72ecc322789de86674
SHA512 8f6797f0fde1ea5cf826ec053e9cdd2933d3c647b0f59527d53f4da16513b211a6969ff1251f26f419424c522bff533cb79fd896fdc94c0ed26477825ad1e63f
SSDEEP 12288:seBNUbTVO86UgeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bw:sJIUR+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T15485CF7BEE28FCD2C27E4DB85B918600A76278704F52A3CBD165830EDE235E54E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 75aeaad74744daa3a17ec51d721d6f1409a9c800825ff090990338da67080e98
MD5 fb5d0dfdbdc5900765a56d91f5f64a52
SHA1 73ba60ea005701f62dc20b58df8c7195b118dea9
SHA512 49e36e8f41df47deeaf4f260b62ebf3cfe18738fe2054b257d6534388497438f3beb656386f8dac49f8f5f82e23ab9671440ee10631c8709961035cd51708c9f
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THz:3QvGAdlCEL8c/WRNw5CfgaPJ
TLSH
T153266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 487e6ac585a5d68836f6c2fdc05af9099c6910a6bfbcf43927abc0f9dbdb6217
MD5 c3b03a267511494ace0df0556ffe0533
SHA1 e96ed9068e3f32e25af9a457f409ba24adf1554e
SHA512 d0ed6dae4b1b9aec4555d74ed8ecc34f533f2b5719fc8e1e47b32dde15daa3d6b56227ae73b48c7ded4b3573cde9bfaaca1c043f3ece0250d44e8b0261f03923
SSDEEP 24576:pfewsAjH+4ZAgayjhwbmY3MaReFeDvSP3b:VljH+tgauhwbR3P8wT8
TLSH
T12D85E031FA74E436C27B0DB21B36C712146DBE604F511AC3E3E89E9D99706D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a3832f58c14b141c508417646c4aade62bef07ce809b5893e0f0c7cfb4bd9f7b
MD5 5781939f626bfdba02535a2c75c6dcaa
SHA1 f32afd166a40849e2a7015d56d9ba56429a61931
SHA512 b70185ef0721128752f84781811e636bcfc1bf57a222a6cf6451a1a5a6f7f468d7df61c0c8ec96087732cc86f345045fd364ea0cdf4877b84f2624a61a7c31aa
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHBax:QUEtQevvqc2W1cpV20I326
TLSH
T1B7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b88ba04b780126edf51bbfd7f28f7f49310fde553e68ff909efaaf76c37cee67
MD5 faedf649a2468f165592449b7bcaaa6c
SHA1 8bc677ee24c015f65e63cc7208e093ea2c4a07e1
SHA512 5429fc2b289fd6d342642ae243dc825e92a429eea13283611531c4a8adc8e4148bfda3e2ea537b8c8fd50299dce97c9fce8d7fa00b7d6ade0aac898d8070a7e1
SSDEEP 49152:TCbRquA/m2yL5zQfFiV+XenmE3/zn+tgauhwbR3P8wT8:soqtVjnmLgaPJ
TLSH
T17FD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8873112f79e086de0ced7e9bfc2b372d0a57c23134dd32bbd00e578232ce2565
MD5 10b88b756f8b4823791c2aa9d76c5b9c
SHA1 0e302d6808e8e55ed514dd94d8aed9ced5574857
SHA512 6d4dd74aa4b201d496f3c8fa91a5ddb553dd0604778ce0ed62590b6d7e7f092588672819222c57caf546a9a661e2390554c202afa25ce83a546a62c2f5f3ca14
SSDEEP 24576:SAhGL6IFoiwtA5l7S53I+4ZAgayjhwbmY3MaReFeDvSP3b:SAM5Foiq54+tgauhwbR3P8wT8
TLSH
T1B9359D80E7F955D4F5B3AA7899B68570EA76BCAA5E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 169a872483cd63a9c46f57789b5c7729f29e005775eaca84f37ec19482cf6d30
MD5 a14786013781a4cc90ee3b5885a3ab11
SHA1 93d0cbf295b7a0571757a89ab2c9c12c98153581
SHA512 0a2c2763b58f5ea71b7893ef81d7157332723aa04e5e32e14fefe3ddacd8765130990000bf24de6ca5e03f2f2a3a0ca272abce43415d1b13a766898e41287330
SSDEEP 24576:VwuROWz+4ZAgayjhwbmY3MaReFeDvSP3b:VwSO0+tgauhwbR3P8wT8
TLSH
T1FF85F14673A80CF9E9674238C6978532F7F2BC022A21DB1F57A0C75B5F73661AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 db503c3b05514ef5bd19d5e39e0d202b2d2dc55f696eaf4e32b0be10013adfb7
MD5 d28619a758ab5c0cb431fef17e766fd7
SHA1 0c5ae6ac857d248b7a9e4e16cfd9ea5e41e3ad18
SHA512 2fe17c566197fa0fc23c12c3bfbc46b5fe1bb5038cb2f9b8c0629d5b3588da2c114336b26d3e9ca535a982aaf2dbccde062625367f6125c57666a039118334fd
SSDEEP 12288:XyZ1IyieH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:CZum+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T19B751285239860F9D1A7033CCEF60A10E7B2BC922B7243CF9595679A5FB2ED54E35321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f121faf932f04062a699c410a199b74a407bafb804bfd22b3bab357548a4b075
MD5 d0f8c046739b6efbc3f7b08d7d54da71
SHA1 b65b500ebea356ae40ec3d59c5e163e6efc75204
SHA512 fbbb71959c56d34ad41b49c2eeea28a06fe710f42261b999c6dbd0dc73dadc6ffa0828cb043e2a6fb96f9cf82799742dd37841edcdd12ec3fd786a67f0440458
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U3:MQRQyi36YOcPDLvw2gAf+PN3wgaPJ
TLSH
T164667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f11f25687345ae822a79a8316708475fbe9b2014ad464d12549ececafdcee92e
MD5 bb57dc9d633f7a49a3b5b3b36d82b171
SHA1 14d0899df9214ce1811155e9e748124484605e58
SHA512 e7cdbd03d85722ad1ec44531c5a6139020b2deda91d30fdb00aac32fd052756b78dc92aeb39487837e73c75703db2d408ed2f38e1687a4cc979c9afb89fa1ab5
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U3:lQRQyi36YOcPDLvw2gAf+PN3wgaPJ
TLSH
T1CC667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 778d37bdd6e3292d10369afa150aaf661ce7c8c360da725954d5a1db907e58c8
MD5 4544b09ca8b0a9176a5a8d602e86e0da
SHA1 ff6cfc22d6f0df1dcc368f97b914dbe75d474bb6
SHA512 ee883ec3b4b2280855395771ff6b8a9a0b69983d4807bbac825596d832ac6505d472d17ebf93a3f72332567f24dbddf665c2d861863f95176a31ede277f4110e
SSDEEP 49152:A68Qg55nhkeWu7PNU3/3+tgauhwbR3P8wT8:6thTRc/qgaPJ
TLSH
T111B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8545720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 97c1d3ce4231ae31a08ea9223de47a3ac342f2a510b8f0ea802aeca44c862c90
MD5 eae9a972a2df9da8fab3338ef094f37c
SHA1 a8fe696901997feb9c8c988a1c12f4b624d8d645
SHA512 483c7a231f367efd82d48abbb0b0f926ba7190d68277b0f9a2454e4697c97f0f698a9156f7d1a7d291cfbfeced96d0f419e5f6818653a1e109e6ecce0d49f187
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99Z:Vy5112gYy5azzVvU69nLKnhZlgaPJ
TLSH
T1E5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ae552d34aa1ba7fe9933606b24349a32e9853c910f14abff8bf0b7afe32b0d90
MD5 39055e13718f0582c90e9925fa087881
SHA1 64e6cb1942e04652da62e23eff0fcbf06656612e
SHA512 f069e064479ab36fa451a70e3bb9773a35ec4f1e39a2a7db4ed537a76e4789b322deaa4d20fe2fd7b5869ee9d8b3eae0a6485b7960d14b4975681776e2633054
SSDEEP 49152:WB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glV+tgauhwbR3P8wT8:ku6JmIxd2d4gaPJ
TLSH
T156D59D13F1DA01E8D06ED578874A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a3bf7479094d388e23ba7d17623d47bb3c8d2182cdd2c5b1eb785fba12ad8e37
MD5 818ad8d0768e94368869f12ba890373e
SHA1 0d1f42d0fa1e83bc10d53c6002cc805757519e1a
SHA512 288488c2229173ad98e7bfae41f7f2babcdb0236dcaf43d81373b3b2695ffeaa4b30b4308587a0dc1b19656d99e0d10e0bce3be8118d041531293165984a660c
SSDEEP 49152:D1hpsNoJpF1A67U44CwH7R4xx+tgauhwbR3P8wT8:DmifPqRLgaPJ
TLSH
T1E2B5BE13F2D800E8D06ED17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e048960141cb22a12a6cb7572d8debfa3c436053dcdeef7bc9e885c03ac1843f
MD5 2efb4e4c32f323bee1332bf728a636c5
SHA1 c545babb4ae8fac453b41a546441e120ea1aeeb4
SHA512 603cdbc51f3b83b46aaf9e2e70839e2ff6d5edeca5945bfcf35875d4deac06f3ddce8a6f8caccfe21047a9b260412448f70adb8c059a911499cbdb709646e9f4
SSDEEP 49152:ESuZQIY0Be2KkRVtOnks6NMHqm+tgauhwbR3P8wT8:W5dKqi61pgaPJ
TLSH
T192C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 14e948ed48930dac7e386250b5b0dfe9dc8888f5efe04828400f289a93f37fa7
MD5 56f00e77422cb1369121c795da854e75
SHA1 8775bed95396931ba397a04823c2ae4b6d9461cc
SHA512 4994bea2212ac21ddafabe045d4b95824c78766bc87b9e9c61844a8f1979430cfab6e73eeebd0c0666971bd3673147493a0748d84740368a4f5320a4f057f3b0
SSDEEP 49152:XhtSn8EApI0figjgiDn0AP5wl+tgauhwbR3P8wT8:GX2iWph3gaPJ
TLSH
T10E95BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 d32298198fa0f6276c884cbb91c6cb18f7b121390d9f985b3c8896408b775401
MD5 72924c412478aa5f827dabfc4ff65cb6
SHA1 ac11ec4ea25b9dad1af16c11d6db6cea406029be
SHA512 54d1f5513393cddbae7a957ac9f9141a7655f482fe559ee02e6929400a571fb2d5bee3efa8fa6d9609e26db93e0773e34b86450e9c2b78219b78ed51a5e1a5d9
SSDEEP 12288:JjeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Ja+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T101652381D24C88CEC62B07758B6A0A606699AFC73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 61993eb1dcbb4ce9ed1e8baf0a12fe44bde9a274a4bdfc14193caba29d9be75e
MD5 e09005585c6f5ce13f240f8a665546bd
SHA1 7c667df739f61eb94a0374cd1b79582446664b49
SHA512 3d52bdd62390dbded4248784c223336229828ad969114a6ebb885b655d79d3e9596b4d8970359795d12a4d0d9c6e2ebe4a9225ce2371e697647414e562417622
SSDEEP 12288:fWeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:fb+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1A1652381D24C88CEC52B07758B6A0A60A699AFC73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 3d38c40e0b02db3694182b07fddbff63d878d81acf7298450bbe5522fcf929b1
MD5 4024f30c7f25633f534506ebba1b929d
SHA1 a0b60df24e70c6bceef65dd30f06bb78aaa74ae9
SHA512 3c03a42d24b2cd970cd6da830535c323e8e097ed8a7776669aa8db53d1ec16e27d1f2c61fb37d59a459124aa41652e467434452f4cdc717bb09a15d4803e3a9e
SSDEEP 12288:I4eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:IJ+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T14E652380D24C88CEC56B07758B6A0A60A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 d8005eaaed18a91e9877a41a73f11f24d035e4c0b3ee1fcb30ff43f12514b822
MD5 43e4e741d2f6b0d972b01ff8c89af368
SHA1 0d01396ee00315ac847f5cc5ccb0a8b6b7f39fc8
SHA512 1c348cf2662c3ed4a87d12f81f3269143183ad041e37b1e9e7eac87ba6c106615ee8a302f1f524d34776242bafda56598da92b6e258cbb0487fbd12a4b46d820
SSDEEP 12288:/VteH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:C+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1AD652341A35C44CAC9774734CB760520E3E9BED66F62628FEA853B854DF0FE88A70794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 16e93a468cc8cd9c2bc6b683421c98d64874d32fd54bb6beacdb298a49061332
MD5 771e6a3127c9578173ce6dab2fe6fd5c
SHA1 f409254db4d303d792e7e7b3a0658461316b3d44
SHA512 e8e9dcb0e18e6ae00f323cb8646381563d44c07deed8bee9d1cf543405fe47d0e101462a521755cb0ad1fdadd622ae873622686d9493b29fad520032060d3e2c
SSDEEP 12288:iVeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:iw+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T103652380D24C88CEC52B07758B6A0A60A699AFC73E866144F9CE7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 235c1eceebd7688527436aedc7d58092606aec7f0b3762b6933cb2abc5037c5a
MD5 ecbd981315575a1318dfe883c17a6df1
SHA1 ed9419e510044f0adf1679857b6097ea3c993ef6
SHA512 e7618400cda61be40ff09388765a989fe74a1063737b183adb635c4dc4ffee582f695079985ab571e854f25bffa9b0dc6666595da1bc6ed92759dee8fca0bd91
SSDEEP 12288:rKeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:rf+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T106652381D24C88CEC52B07758B6A0A60A699AFC73E866144F9CD7785CDF0DFD46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 2ad77266488f0e845f83768fa3fa464c0279afe80f7da39a993cc2c8b7cd632e
MD5 ad0e980e6a4ca001699cf91c2c21e7d3
SHA1 f5c2ef2ee6a3cb17c569c2108cdf45be2c937659
SHA512 808590ea820bb81f1c7fe877c6818e5254ad7388931e67d3321ca389d4838ecfe65fccdad054068160a3f94b1ea0e1e77e4d22b3cfb4c056d1cd70a58573848a
SSDEEP 12288:zeeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:zj+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T14E652380D24C88CEC62B07758B6A0A706699AFC73E866144F9CD7785CDF0DBD46B13E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 f218b6b24fef52d983bb6378daee24384e7f0f4b21e7f3647478f5a337c6599e
MD5 eb9a816898716b953eb1da67eabc2ca3
SHA1 9592f51d7132ac7bad38247dc55e81fac4875ce5
SHA512 03803469d04eb7d4d7923d0b5400cf8a31a0d037c72babb2b2769d0476619e58150f72021d3a23e3f444efded4340700029bb34e9b4d4c75529d628f7b8b3c71
SSDEEP 24576:6ZM3zFVSO7+4ZAgayjhwbmY3MaReFeDvSP3b:6ZM3zfv+tgauhwbR3P8wT8
TLSH
T1A2850194B39418F8DC67423ECE264911D6B2BC5A0B60C60F53E837665F737A10D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 f20bb0f63a42e6476056f978f2c72c862e0ad4996adaf0f7f14a17d9d9087f16
MD5 0f782832c44544eba64693e90ee60c04
SHA1 e6c1b39d5fde049c22568665c12455e1a5c1ed38
SHA512 067a2135b7e15fe3f326737fa81e634b7930d221f845d9d45cb7fdee229731b73dcf424359c3eebd63301a766743833f8f9197140c1591a161c9d1da6dec5e88
SSDEEP 12288:L/eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:L2+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T114652381D24C88CEC62B07758B6A0A60669DAFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c3a05dd3c672ace52974719f0ea7dd67435644ba513b336ab9750b4d75a69ea0
MD5 01315d25c8d56b79e8af696b3edec4df
SHA1 79fe8fb66e74382fe16afc71902e3e6c594301cc
SHA512 1a93f519490683dfdb5a1c920278a4e525028da8034bc36333b083949ef79dfe672f004f91194eb98a24b441d47b1ce8acc663eaaf301d82740701db06558ec2
SSDEEP 12288:YbeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Yy+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T139652381E24C88CEC52B07758B6A0A60669DAFC73E866144F9CE7785CDF0DFD46A13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 4b430899f67785970e0e6b257d0f39d37c326b51e9df60d3b22ac75d5ea57e40
MD5 a0424ee62583bf440e4f3b8319aa912c
SHA1 a4cbe6fba125503eb3777c15506c9540972c4cf5
SHA512 821505bff14d995c5cad189fc4f8a3e84a1f0ad0792dc6781ae44c98592586c8621cd60f6e564da70cee309ca2c6081b8ef677987c2cacd87f14117cf90c24e2
SSDEEP 12288:pyPz5L8ieH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:IzyX+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T13875124773A430FDC1374238CA620A11F776BC721B609A9F979417765E73AE48E3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 945af202cc925ef20bc6d294bd97c9a2f3e5d6afb85d682cbe1e37e4831dd71a
MD5 7dbbf00efbc5e5e74cdffc8f6018f2a9
SHA1 a8624499b93c7b8f0ecbf7bfc508a9bc8cfd398a
SHA512 12efdc76db6e583b275388927c96de70660393d9d8b990b998d0fe9411644909a9caf988f4dfd203dff9471f9207c6f13fcbace2307ae52e9c03001ccd46ab8e
SSDEEP 12288:R/eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:R2+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T10E652381D24C88CEC52B07758B6A0A60A69DAFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 1db3c2d26299a4ab6f079ad4201ddf4a3def6f492a1b2564330a74fa781ec9cc
MD5 1d0d6b595294694caea6f2391f0c69fe
SHA1 058bfee065eca0c95032664fbd2039bfbe39bd8d
SHA512 5e101559d7a4ff23214376e22aa0a2121aa82a561a4e3122d0df2070fd9c8a587c6e3fa93965a972654af572c53cd79d507af4ac66059a25b4953a96b92559b5
SSDEEP 12288:e/eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:e2+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1C5652381D24C88CEC52B07758B6A0A60A69DAFC73E866144F9CE7785CDF0DED46B13D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 d9133f99a83e7a031d9b2ac9461b6555e6eb639832d12775b6ea93dc8b116eef
MD5 4540208e762372daa037c1c9e2dc4f09
SHA1 88547b75c5d975410d5ab8347e45c7e72f6c0995
SHA512 0bc33ea89d9f53c15c8ada9938b76a773e6d0582c4ec207d922e19d160d8470d4290deca7ca42b43b875f5652e47d1a4c56bd61fc8a9e625fcd4541ef88ec12e
SSDEEP 12288:3yPz5L8ieH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:6zyX+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T15675124773A430FDC1374238CA620A11F7B6BC721B219A9F979417765E73AE48E3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 4ee3ce49dd101433d0617526df41dcffe06eb9054993785115769d829ed876ff
MD5 edffe1ffbda4208d8df5acff267606c0
SHA1 bba1ee9992d41c994657c2f902cd99a28e61ef65
SHA512 29a3edde4760150925d9aeb55d373e5b1c9b59c5bef49ce7f68cd60dbff975f69b85d116ec48eca8a4ad1cd1b01534a80fd88340de88f1f3400f1191e456bf01
SSDEEP 24576:zT8aLl3z0zD5+4ZAgayjhwbmY3MaReFeDvSP3b:zT7Llj8+tgauhwbR3P8wT8
TLSH
T1E1850194B35018F8DC67423ECE664912D2B2BC5A0B60C61F53E8376A5F737A10D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 2c923d752cb31b2c7a4a26a48e4c3e6b5e60e7acb6ad8591b038a6f382db6d3c
MD5 93e83e5ee61d4ece177beb22039a6fed
SHA1 bb91aaa2e26ca339e92e48f7f6135d69d74e1d73
SHA512 db41f5078f700b63d93c48cb149ffdf63d58532ac5a4ea4d4f665fca045f4151c00f5403564e12ce5a73b4361fa13ddab9a7d98306c4402fe99cfbdd30c4ae59
SSDEEP 24576:ZcP4mcvIjkGOxhKP2l71nNKbrh/8KBe+4ZAgayjhwbmY3MaReFeDvSP3b:uP4m4IpOO67W8KM+tgauhwbR3P8wT8
TLSH
T13F65BE2DA7DC0096D0BB917486658A49FAB1782A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 3610480c82f548c7860b9feaa222f4b304b38305bb4f3a08990099ad3d5d7d05
MD5 2ca396551adb17933c72b5115408e855
SHA1 35c2c7a04441d187de5b7a27ab859ca9ae3a5097
SHA512 f937da4270fff59609e473fdac200975a7d7e9b19c87259ea7279b52f9bc8a0e261667b58847d3cf9196775449ba75c514d0938185de58f37f2bdaa69b44fd40
SSDEEP 12288:cpsfPeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:9m+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1B675F149D29801D8C06E1279CB564A40B3777C6657E2D3CBA6C0F67E0FB1AD48EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 dca4da71b2f6bd704a252233a9deb614ba4e620823b4431a47cc263161a81d38
MD5 e293b7ee7ae0c34e15e81743a2122532
SHA1 457d4aa2b410191735e2feec7fa318bd7beafcd3
SHA512 6deaab2f623aaf74f3b27c0dacc4c7850495c26e6e6d168c97fddccd68ac583b265621cee2b6f238b640c15323a21db5023a3cffd9c378c1bfdccea5b5fad527
SSDEEP 12288:KveH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:KG+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1AE652341D34C888EC57B0B704B3A4930765EBFE62F41A14AF98977998CF0DE98EB1359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f5db01c0decc9af67c35430701bec2b24da4b62b0104a38ac4422069df936676
MD5 e228c99dfa1d3b000f66e9a4e5dea11f
SHA1 6e79a9d0deefd2702149926bd7f2bf7d5c3af8b6
SHA512 e79248aec6f7efb05f55fce28a8ac54cf171b874f180ff5b34edf35f30c935d9b393326e5f49117c0c6b63286b1090b02a2502a845f04fee6eac76b3c76fddca
SSDEEP 49152:Ja0h2GEkuAe73q3pp46zwwQw+tgauhwbR3P8wT8:Ja0hNYG4JwygaPJ
TLSH
T15C85AF1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 5ed657a7e3d2973df2574b526657d8dad700113bd406194c2046439adbeb60f2
MD5 632fd81270b20ebe0b7d23948ed950bb
SHA1 7a3dd0ae7dfd3d27dfc2adef58df36761da0237a
SHA512 cf0545258f38b17b994cd2720ef9b459d27466fdeb6f2a866f3fbd4242af6019d6f5377c20be42c6f49db5c7091177c61d86bf5c506cf36b386de3b88db9661e
SSDEEP 12288:MLeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:MC+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1C9652380D20C98CEC57B07748B6B09306699BF862F5662C6F8C977958DF0DFD8AB1394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 616b87dd3234e7d69a87282ec8b0467741066a1611b0eb9b1dcfcbc7806b7eb4
MD5 3afab23a8ca468327250f6212bac1779
SHA1 8b1aa70e6edd2dd0b4f64039f8f28f5b09146e79
SHA512 411e5af23b569368b29d1bfd42ae399a2ed75aa466852277db10e7d2585335d4037f50e110297132e83c279e3c46245a1f8d3c1adcb22aeecb81acd6a3ea954a
SSDEEP 24576:6AL3UTl+4ZAgayjhwbmY3MaReFeDvSP3b:6AL3UR+tgauhwbR3P8wT8
TLSH
T17A950154E79400F9D87B823CCAA68A12E272B89D0764E7DF43A84B651F737E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b2d2a56d093f453b2c55720393238828eb3bf78d8121c9ce7fb99b0c3cde838b
MD5 868d346481c344a9707128886f789f45
SHA1 42619ffe63cc9637249f301687c926760cc1dc18
SHA512 34b4c48036073fd8e01ec78a07f0f6094f2b04d55aca0cbc9d5bab09ae5bae64d41895326a3e8f71ab85e0c51ae5ec396dc531008417aca8f9e0a3a82b938757
SSDEEP 12288:MpFtvOAeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:0Ox+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T11B750219339C10E9D57A523C8A974205E3B1BCA61B1253DF86D092BE4FB3EF89C36B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 034ce9d0d32987b09d7d7b90ed24a0c2bfc22de64061995b7992663ca834a18d
MD5 e3714e40137cea2cdea2516bef430ae6
SHA1 44f6ac71af10cfc8346baf669946384f7a0ca8b5
SHA512 79e00c15dc75039dcdc8e08d779e30d27dc5a657ad44fa78d985957fafa9dd871a87a9f32c2ea56872f52821ebc85fbbcb5727e0988694eec9e3ef07020b8cd8
SSDEEP 24576:/7NM9YqZqmWMUkPjZM48Mv6bEhs2+4ZAgayjhwbmY3MaReFeDvSP3b:/7cBWMpPjN8DbEhr+tgauhwbR3P8wT8
TLSH
T16A65AE2E6BAC81D5D477D13DC9A28205F6F2B8611B318ACF5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e25006da1abc20be9f1c4219ba2aeed8b20b5f83eabc691f10332040197de052
MD5 f1f440d517931487683724203c274020
SHA1 e9045f1955f09b13f71eb257e2be36e3ede5fd4c
SHA512 9f0940b3d364d5b631f1a454dc8f6ac2d28af6c99f4e0dcc2a98904444782930cb96ad78dfcff4cb49c693fbae179f352840c38c1a3885b5249f0c5d2c5305a8
SSDEEP 49152:hF2YuHNETovAvNYf8kmW+tgauhwbR3P8wT8:k6BCf8kUgaPJ
TLSH
T13F858E2927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\SgrmBroker.exe
Size 1.7MB
SHA256 e61a9d6c2824d7fed49ea04fb34ee5bb2776d2aa3651a4c0489be45702bd2881
MD5 320c3491e86e573ac5e86df037bf65d2
SHA1 9ab6c02db1b75f60f95af03dc1e224a1c161ab19
SHA512 6282f3a69cfbe50fc0316e34d3315df6eb5b9c6aaa4a46b17ea9be7108ae03a65327726e2666305c21316c7abb7fd512bbd12b2c71447f2723d40b112f8cac2f
SSDEEP 24576:9TMdOz0FFS+UmSLo+4ZAgayjhwbmY3MaReFeDvSP3b:H0K+UmSLo+tgauhwbR3P8wT8
TLSH
T15D85F17EA36D14E5E47BC27CC6538902F6727862032266DB46D0C1B92FA7FE47939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 d0629bad441cfffe4ddaeb743daa29bc56bbeb480d57a3532902241d692ab23d
MD5 aeebde730a67e637d15c27e4f9485468
SHA1 68219ede1799d8db392d4ce401ceca4a13a9b31d
SHA512 1dcba7a2a98f1619db3be2ef04418556a1c84a3b84acf2ca3c9549f4e53a19631c9cb6d0a7178650e4a942b2642a6a9adefbbc40020c49f8dc0cfd5b3bc8931e
SSDEEP 24576:9AFs06+Omlf8NXEbTod+4ZAgayjhwbmY3MaReFeDvSP3b:yFs060loXuQ+tgauhwbR3P8wT8
TLSH
T1D865BF2F62AC00D5D07ED17D8A97C916F6B1786307255ACB0260867E7F6BEF81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 d58cab50acaabd91b15857d41fa6473fb3855bd09dd5d55f0ec55de9b2e2bc79
MD5 6175558583a98cac2da47a1846835cba
SHA1 b522d26c6f2fcbc7c1f85bf4dc5e7f776af405fd
SHA512 f5824cc24ad5961b71e53afeb2c6a4e2f3e896548aa8801d07867d8968455a46f341cf60f1d2c7f9554f1ae95356254cf592d2335460347c2f59a5a6a0f3e1f2
SSDEEP 24576:lJnJ5D3WXQ+4ZAgayjhwbmY3MaReFeDvSP3b:lJnJ5DGXQ+tgauhwbR3P8wT8
TLSH
T1E885D02DD2A810E8D4B7C374825A1B51FF72386D2F226AC768B4D5357F22EE09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b0e3a6a0ea866240843526bc12b4eb027176910291170f101cd0b4a69b503dc6
MD5 c04f358e802ee2bd26ea82a867cfa3aa
SHA1 53c68544228825b1d8d6769818b756daea6075d5
SHA512 c0bd860fd7be67f91e4c4135093b2f162e6c845af2e66c26bd8ecd77aaa5453d81d7e33f1c2498f661c9d3cbf9eb1616bc4b73139f87964559907a103750b3ec
SSDEEP 49152:ug06DIKdwc+eQnSt65aVa+tgauhwbR3P8wT8:nHgaPJ
TLSH
T148956C16B7EA5294E8B3CAB1CA6295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 0db71c49074cd59bbf650b77dd9b067f19ce8fccde6360cacc1bf4fc70793f0f
MD5 4e6c15ab78c1b4ea8b90d0847f337259
SHA1 fc23ba23af0ef125cafe622990c96041d75d72ab
SHA512 12ea3a59fac75db0f64c3e6da9c45eb6c994c265a6dc16f7799c4aaae95b81d466a003b0c9fdb28abaf41e7695ea63b6bcd300d2c22d9507e7fe905b5a3b28d2
SSDEEP 24576:Ki5h68APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKK:Ki5EjQx79G1poWl9ddLD2/sK
TLSH
T17105122D375D60BAD7E1817A84B18105C772B82177A91BEF16E6C67E0F339D62E3D600
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 dc97b30146dab74a996a32414c69c777d7136dbf6020da7311186e7608d652eb
MD5 215af32968a0e3ed5c0cd1c9faf35d42
SHA1 0b1fd13a34114d17898f2622797959770f0fc729
SHA512 c0f8097d49b7a56d1d9197a65311869cddef23e4d32bd59db33fa8a6c6144ee67c4efe790ae49ed5cad57f6386ce6ad44607606cd001dda9441768065527a720
SSDEEP 12288:5jkyWeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:5Iyb+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T178751244A39894C9D6BA07388B7742A09A75BC612F1193DFA0C0F73E9E71FE89D30B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\System32\msiexec.exe
Size 2.2MB
SHA256 c50b8e1f3c286765fb07084757d7456a11865812d235840ed488834dc049109c
MD5 2af059dd1ddad1d6016afa66a214c53b
SHA1 3f51a911cf4c0f92c144414a337bd46f5c9fb741
SHA512 d9a8babf99734705fc1bd064f3f4035734598bd3a2dba99a5884157e464fd40a05ce0c498d5e73710132662461e5e612918e49a2b265eecb4f97713a9d410027
SSDEEP 49152:ql+tgauhwbR3P8wT8WjQx79G1poWl9ddLD2/sK:LgaPJIx+b3LD2EK
TLSH
T16DB5230C339C70AEDBE283758A7A01204534BD5237A915FF75EAEABA4B73DD58678340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 50b3eac660269ddd8287b2b62f0c73f896926f1f03be3ea4b0ff46f6da15ff91
MD5 1b0df4ca6741ee420ae47c64e37654bb
SHA1 d3e7663c44c276fa654a7d3ea135d2794cc166f3
SHA512 59fcbe658f6d43c0c26ed0863764d1e8ddcaee902cf189c05711e25947672e53b6fc72fc0c42a67ccee274740f635e95dbed48b4b7c3a91484c080afce8ba8ef
SSDEEP 12288:jyweH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:OB+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T124652344921C64CEC92B0774873A0A606265BEA62F4271DFF4C9F7B5CDF0DE946B1784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a4e2dc0934c98662f2410f72faf868af5ebe8ad91c0be1ac6e117e5210ec5669
MD5 461326013f610b23eba9e75ceac10332
SHA1 85743cb2e610ca359f4f10819ef6f610f3e83c76
SHA512 07d3fb491df274dee91a79c9180d5877349b6f94ad25b7cf6714f00f6bb10df4c3f11addc086e165677d569efad3958de03f6ec546778e6b8bd08359e2c8406b
SSDEEP 24576:zQ9MxZKdcz9dw3O+4ZAgayjhwbmY3MaReFeDvSP3b:zVKZO+tgauhwbR3P8wT8
TLSH
T19F558D2DABE9058AE177D235D5A240C3A673B4311B31D6CF2448D13D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 f9979c375e8dcb4f6b58c15a963393e73a8cef54a336c262a6322399f6ebaa6b
MD5 8dd7048503874868326e222f8da2354a
SHA1 4312e05717e0ef64f82d6d7788cbb188ef2d557d
SHA512 8459e7e5ff149e6e6fd1b1ea360b13ae03da8acbcff425224c61606a8a3a54c65fbcb50e1c9550fc549facd76d78533e01ffea057e93d66c21edbdd597b3dde1
SSDEEP 24576:vyocDApH+4ZAgayjhwbmY3MaReFeDvSP3b:qocDApH+tgauhwbR3P8wT8
TLSH
T1A785E01FB76D40E2D176823C8A858641E7B3B4701B6263CBA591C33D8E73AE9BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2532005b150a804c1def074f325392be0281aa9c4743e69e99442472c5ae2e26
MD5 9fa1fa56960e3ae17dea21d7f860efb0
SHA1 a178ea96c049387d433eb0f598b44aaaba869c93
SHA512 879c7305863ed4fa5b2b6870858fedfc607f1ec514d4dc49cabe4f5837097a1086e0f3e4959d046387d44eea873d19d4a31dc77af9a216d762211b1563f67eeb
SSDEEP 49152:HWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKH+tgauhwbR3P8wT8:/0zuNIIgaPJ
TLSH
T1B5A57B3DA2BC00A8D9AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 5377d3ea563d5a98a6440afec324dd68667f2e859f743a68920ea264ec5086db
MD5 062bf84031d5d9817fe2adfa29aa0f13
SHA1 9f2666fffe75f1083c6c1827ad44c52f419f8559
SHA512 ee1605e44d0043fef7d0fbd61ff5b2e977e2bc77781df8ef79bde43dd7a77daaeb3505369d165a638b310c161537de4f359f5d7c523a630aefa1af1fc2509677
SSDEEP 24576:D1QT7EcpfxR+N5AWAz3ooiYhjMqbV68APIx79G1EGpkb9hYeu9Am8iioBvjVzi/j:eTDxR+N5YzTTjMJjQx79G1poWl9ddLDC
TLSH
T1E275C02EA7F915E9D2BEC5798A338512FA727811133193CB42A0C17E1F279D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 848KB
SHA256 6f955b86d06a834e9ab6e23b7407a22fa7443d8a83cca95d9087cd57be0519a8
MD5 6d792725e63d8bfcfa9583aaf795a52d
SHA1 082f0351e7592ed63294ca23618678493cbe8358
SHA512 74e449228da860388a9673b4af19e4f8f10646102b02780981526e651445c6b7c4e60bcec1be21e4e863ee321cfcb263ab20a574c04a6cc77f94d89f0fb97f44
SSDEEP 24576:ShbHjP068APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKK:ShbHj5jQx79G1poWl9ddLD2/sK
TLSH
T12F05022D336D21A9E7F0D27984B64106C631BC1267A957EF23E6C2BA1F33AD11D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 2.5MB
SHA256 4e6b18d3bd5ceda275f9063b995cdb8a8cfb82d8e31f395226c5ece535310ca9
MD5 812dcaa6919f8c4c20f6f74843471fb8
SHA1 0e6d59bebed10ba81acd36c7c45bfc9789c076b8
SHA512 e1311d3c9e913005b60459cfed66b7e57a0ed07f29eac2f67e46ef13a4082005ae4ee7666cc93e1659f8a194093e3c904ad09df418ba677d92d457533e4f2c10
SSDEEP 49152:20K+7mSLo+tgauhwbR3P8wT8UjQx79G1poWl9ddLD2/sK:F7gaPJ+x+b3LD2EK
TLSH
T1EBC5123D735D14E9D6BAC27DCA638902E5723C62032165DB06E1C1BA2F77EE42A7DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.4MB
SHA256 465061b3196f7b6462fa5a35d2b8fe97a9ab88903cbf6575f23f8efa8dfe4d12
MD5 40489a87f6916b7bb3b06a9d40b15461
SHA1 ea42d444b2af13c4376dbd134283d077598f0d14
SHA512 29b13b5156d6cec4b01364f21ee6f24ca90e93abbb01df8e9a230ca5d350f4afc2ace7ade9227dbe3bd1d1b4d9fc93b25e46016cbbef96e2384266100ecc9f75
SSDEEP 24576:itYgnJcRTk4yti+R5dUR/T68APIx79G1EGpkb9hYeu9Am8iioBvjVzi/NKK:iWgnaTk46pUR/WjQx79G1poWl9ddLD2L
TLSH
T10A65CF2DF3B910B9D8E6D236851143B5AB71782D1F209ACB0174C638AF16EE85F39F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 2.2MB
SHA256 f70a99335fb633b7098ccebace96a3ccc0f8cf9064b0fedf1fe81faf985f73fb
MD5 ae2e3f638add2249379a9693ac705a9b
SHA1 53dce9fb89c7c6100aa3f0c41ff4ce6117e0e42c
SHA512 49ae6df5aae63bcd196ea200b3baac37f684b16ffe70234693c180b952a4666fefaadf367872f290d4ae31b4234aa19bad16bd6ed41d6a79c327461d73330a1d
SSDEEP 49152:jl+tgauhwbR3P8wT8WjQx79G1poWl9ddLD2/sK:EgaPJIx+b3LD2EK
TLSH
T134B5230C339C70AEDBE283758A7A01204534BD5237A915FF75EAEABA4B73DD58678340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/640-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/640-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/640-33-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/640-42-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/776-183-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/776-189-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/776-565-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/776-224-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/776-464-0x000000000D320000-0x000000000D328000-memory.dmp

Download

memory/776-205-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/960-161-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/960-163-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1020-124-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/1020-177-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/1056-96-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/1056-87-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1056-165-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/1056-93-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1752-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1752-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1752-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1752-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1828-95-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/1928-626-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/2332-430-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2332-166-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2544-143-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2544-135-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2544-141-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2544-346-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3168-406-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/3168-158-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/3400-99-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3400-105-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3400-108-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/3400-169-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/4068-155-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/4068-382-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/4068-153-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4068-147-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4344-632-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4344-598-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4524-13-0x0000000003030000-0x0000000003096000-memory.dmp

Download

memory/4524-0-0x0000000000400000-0x00000000005A9000-memory.dmp

Download

memory/4524-2-0x0000000002460000-0x00000000024E5000-memory.dmp

Download

memory/4524-7-0x0000000002460000-0x00000000024E5000-memory.dmp

Download

memory/4524-418-0x0000000000400000-0x00000000005A9000-memory.dmp

Download

memory/4524-1-0x0000000002270000-0x0000000002332000-memory.dmp

Download

memory/4524-20-0x0000000003030000-0x0000000003096000-memory.dmp

Download

memory/4524-66-0x0000000000400000-0x00000000005A9000-memory.dmp

Download

memory/4560-496-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-485-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-500-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-502-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-503-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-506-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-507-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-508-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-509-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-504-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-505-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-501-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-484-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-487-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-471-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-473-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-481-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-480-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-479-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-478-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-477-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-476-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-475-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-474-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-472-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-470-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-469-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-468-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-467-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-466-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-482-0x00000142F75E0000-0x00000142F77EC000-memory.dmp

Download

memory/4560-490-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-492-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-486-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-489-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-488-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-491-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-499-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-498-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-497-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-493-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-495-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/4560-494-0x00000142F6680000-0x00000142F6690000-memory.dmp

Download

memory/5132-132-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/5132-308-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/5388-532-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/5388-178-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/5492-173-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/5492-113-0x00000000006E0000-0x0000000000746000-memory.dmp

Download

memory/5492-118-0x00000000006E0000-0x0000000000746000-memory.dmp

Download

memory/5492-120-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/5576-483-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5576-174-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5668-437-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5668-170-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5784-67-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/5784-73-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/5784-71-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/5784-68-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/5784-58-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/5888-127-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5888-182-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5888-380-0x0000000140000000-0x00000001401D7000-memory.dmp

Download