b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
Size 1.5MB
Sample261027-e6lems1wcv
SHA256 b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3
MD5 05c417a00b05eab33b8b6dcb0f7b9394
SHA1 2bb2ead39c9ffa9ce3cc74e6f0d294a6909f4086
SHA512 84b4c59fb29584d67f1f994261e9bf249b8cf9d53218658cad929cde699b3424e2eb84d541ea40b254e46a49c653638d601dad1e5fd27d72193c780e63ad3ced
SSDEEP 24576:HmQIjyJafN0QNd0x4Zo6VEXzaXsKzMInMXvGRsqjnhMgeiCl7G0nehbGZpbD:GQEGa5H0x4ZoqWIzLnMelDmg27RnWGj
TLSH
T1F27522107592843BD5B3083205B8D6FA593FBC315A3459EBA3E52A7EDE302D18636E73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1592	alg.exe
4812	DiagnosticsHub.StandardCollector.Service.exe
4240	fxssvc.exe
3764	elevation_service.exe
4556	elevation_service.exe
4876	maintenanceservice.exe
1156	msdtc.exe
3752	OSE.EXE
3040	PerceptionSimulationService.exe
1080	perfhost.exe
1512	locator.exe
3796	SensorDataService.exe
3056	snmptrap.exe
4468	spectrum.exe
3120	ssh-agent.exe
968	TieringEngineService.exe
2820	AgentService.exe
4248	vds.exe
1916	vssvc.exe
5072	wbengine.exe
3728	WmiApSrv.exe
2208	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\wbengine.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c5ced98d5ef7726b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\spectrum.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\AgentService.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\System32\vds.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\vssvc.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2260-0-0x0000000000400000-0x000000000058E000-memory.dmp	upx
behavioral1/memory/2260-70-0x0000000000400000-0x000000000058E000-memory.dmp	upx
behavioral1/memory/2260-307-0x0000000000400000-0x000000000058E000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030518550cc65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0a07450cc65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002aa7f84fcc65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c88dd50cc65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ff40650cc65dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012a51750cc65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001b56850cc65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4812	DiagnosticsHub.StandardCollector.Service.exe
4812	DiagnosticsHub.StandardCollector.Service.exe
4812	DiagnosticsHub.StandardCollector.Service.exe
4812	DiagnosticsHub.StandardCollector.Service.exe
4812	DiagnosticsHub.StandardCollector.Service.exe
4812	DiagnosticsHub.StandardCollector.Service.exe
4812	DiagnosticsHub.StandardCollector.Service.exe
3764	elevation_service.exe
3764	elevation_service.exe
3764	elevation_service.exe
3764	elevation_service.exe
3764	elevation_service.exe
3764	elevation_service.exe
3764	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2260	b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
Token: SeAuditPrivilege	4240	fxssvc.exe
Token: SeRestorePrivilege	968	TieringEngineService.exe
Token: SeManageVolumePrivilege	968	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2820	AgentService.exe
Token: SeBackupPrivilege	1916	vssvc.exe
Token: SeRestorePrivilege	1916	vssvc.exe
Token: SeAuditPrivilege	1916	vssvc.exe
Token: SeBackupPrivilege	5072	wbengine.exe
Token: SeRestorePrivilege	5072	wbengine.exe
Token: SeSecurityPrivilege	5072	wbengine.exe
Token: 33	2208	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2208	SearchIndexer.exe
Token: SeDebugPrivilege	4812	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3764	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3516	2208	SearchIndexer.exe	111
PID 2208 wrote to memory of 1140	2208	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe
"C:\Users\Admin\AppData\Local\Temp\b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1592

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4252

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4556

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4876

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1156

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3752

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3040

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1080

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1512

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3796

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3056

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4468

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2896

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4248

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1916

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3728

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3516
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 31cc0906c5e9dc73cd302ffee5b2bf2bbf283217c4fe1484714c9e0e9ed67a0c
MD5 d8ac782126c7ab5a02b3d30c6463925c
SHA1 c21c7e36fc21049e4ba11f57c5cff52ba3d6ab51
SHA512 2d65d7a66185ab0fe3501f8894b67c2b4116ee3c5041e83e04593df69cd67e7b8f82e669e931c4c9572370f1f10a9aae286c0c766d0718f2a71542140d9b6f69
SSDEEP 49152:6b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnNDmg27RnWGj:s3q6sjBmD527BWG
TLSH
T12DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 2aaa505ed6a4c014bcac652bdf4aebaaca1395ead61b169e9998304fecdd88cc
MD5 562933d9b79f476dc106587ca8f45c19
SHA1 d4de33df0bae8c78e389444826f0e7b3effa1bdc
SHA512 b9d6e312f8b24554d3e165cb61f0e2f0ba04cf077039f233504e4d9a9adc67c382bbf831b976c4ddfdc28c91d4b0679abb7dca0f6b5c063cfeb8d624905d44ca
SSDEEP 24576:9XYfDtczAesqjnhMgeiCl7G0nehbGZpbD:otcLDmg27RnWGj
TLSH
T183050128A3D408F9ED67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 923cd5c42c25fc071b9de7108f9ad3617c403c34d6a2baf8239cf9c47c7ae3e6
MD5 48f8ba470b626a646baae1031d488b45
SHA1 c319df12357e26b7ff1a22a285bef869702c1250
SHA512 da4b7c486ebdac9bf09fe4ef923b83b17daa7d2ba4b62ae808a0c4718120f27837341fc2f52d13f793c3e0c59c745f6609791c0210305b2ab7d6b248324999a5
SSDEEP 24576:40Le5ji0hmxxrMBsqjnhMgeiCl7G0nehbGZpbD:4Pji0AjcDmg27RnWGj
TLSH
T18B359E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c418b0daf1fd3ee746adcc548c2bcdf14e342b3f246b0a0347d3aeb4625c1ccc
MD5 dd7f7431e93a6bc1c5c1d3e09d1aec61
SHA1 5de0021d8b9e48b3905c16451330cee96dd3291e
SHA512 758401ea3017500a6e836f833deda640aed292d28e8e7be353392c358e34c94754d617cbc22a622bc78343be928f4c67a0f9a08f6ee22fc186972203451c50b9
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWn6q8wyuHsqjnhMgeiCl7G0nehbGZpbD:2/ezSC6vUzPveHjy4Dmg27RnWGj
TLSH
T1BA755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4e3737d6278e3af900336454d651f1f47040c251f342e488d43b72fb732d0b3f
MD5 6226298d32c2b6a54c3da366e01ad7d7
SHA1 140006ba3bc76ee68e9396c08f931b818ffe8ce1
SHA512 e69b0d4ea05f62ee60238c1f2ae962a4592d8d8e8de0c7c1ae13dbfa2395799af2e8e280a1640c89b05d9609700b92e478ec175b5518f3eca4ea11e108b69570
SSDEEP 24576:SVbqPb88hv/l+YysqjnhMgeiCl7G0nehbGZpbD:SVO88hXl+TDmg27RnWGj
TLSH
T155559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 3ad124112f53c147ce60cd85dbacc2e62735e9671bc41f9ec8d289d561587029
MD5 988426f7b76c7f8934e572bdfe3ec76a
SHA1 323d7955599314dbc784597cf6b228c6c648a745
SHA512 2ff4227521180b0428b32ed7bff475eec3dccc84b282a87673c2957efc8a041bccacffdbcea1e72a5c2ddd87dbc0f2428bdcf9123f02831720400f0df974fdcf
SSDEEP 12288:qL1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qL1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T164C423BE824C11CAEB7708B5C3E9F11DAC177E5699200C42AA637DFDE6B5458CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 e7ae24f3a8a0a0df1c6032d93b1c92062c20c76468f390e8bb808343ae94c700
MD5 dc1ed24c7a6a05b58e1cb9b86338f137
SHA1 53bf1deb1ed516cb7d6f3c71455205ccf1df645b
SHA512 d1c27ae87a976aa85a1af6f516c8ca0350a4daba3fe7687e3b8718c3e2c98d1cced81a5ac12bd8875cec9717ccf0c6c769837a2ad4fd2bc02ab7e93a5733f758
SSDEEP 12288:3TeBNUbTVO86UqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:3TJIUqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12905CF7BEE28FCD2C27A8DB95791C600E76278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ad0d8e1d32a1fb3a762529d5084ac9adeed8fcb0168dcbf5b9afbbc2c8225fd3
MD5 a2997b156cdf23b78d31068847f7fb16
SHA1 1793df01f542a05c9c58fc93bca6b6184384afc2
SHA512 f9b34db4822c1fe357dc8c8cca22526c8199da607e2b379ee54067268da96b558c31691ebc7db5239291debb3b1b627c2e227b24b9a960af2f44f898d58d70c4
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THd:XQvGAdlCEL8c/DRNw5CrD527BWG
TLSH
T1CE266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 db65ffd9ea6a9b2e93de89d1427ee17f0015e0ec67b2985d63aff8c315dddcf5
MD5 21d101cd7afec1411cf741a86955bb19
SHA1 c97b0231ee988d5a25068221ce51a75cda47a4a5
SHA512 2f8ded8562fd9eecc2901d43458f9cb576aadb974e6505ec468c0b223441923cd4b77addaaacaab8d1b6ca8424ac3b1a0b6088d1311062d771d723b4c0bb9795
SSDEEP 12288:zAwSfxL/2Dc3RDLLmt0LDQewsAjwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:s0ewsAjwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18B15E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1696d856c74fdb769dee6b5bfa3d2c99a5901cdddaa443d3693f296bf8589807
MD5 582a0bdd4879a4ed4a8f97977046e1e7
SHA1 a21c52f59b17d2c415fc649e0fec4f54398d88d2
SHA512 30d6633312792d28c9e14326c7b53ee7cad134a8ab2b2e190f9e76e41629050cf79b27577357e4e63c41b93f20b55cc7077270cf62772ea6d6b487bce83e3f37
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHkVQBWG:dUEtQevvqc2W1cpV2tI32rB
TLSH
T181474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d9fe63985c1c9817f3bf07efa48821131188c143dbc48041ee8b7d15da701913
MD5 600938a250bc326bc4351491f9508b7a
SHA1 6bd926bf24dd37fe396616f7052ea3142556c37f
SHA512 6752dd818194719784faa954ee4372b5f57ba6a28db2d4e54db8a7722f637de669a5052e145053652cdd3b8a5b1c94581a17e1680253f952253dd13e793f9dec
SSDEEP 49152:yCbRquA/m2yL5zQfFiV+XenmE3/zMDmg27RnWGj:XoqtVjnmHD527BWG
TLSH
T12FD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 300507521a1ab64910652977dacba09ccc97e679b94233f4206de4d878c09709
MD5 46703c0c6d36e18db96058a2a4d25c38
SHA1 7babf6a1a260e3b01582ec4788c58797ab97f578
SHA512 6a5a0fc1d7fe113d6b10d177f2c726023aea1307e6443b9420e89a61eaf08f0aee955850aace40aeae89dc95a58e28fb2037b8c3785dbb5688abd59305413a55
SSDEEP 24576:XAhGL3IFoiwtA5l7S53jsqjnhMgeiCl7G0nehbGZpbD:XAMUFoiq5XDmg27RnWGj
TLSH
T107359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 6aec38e9e848133ce949c90fb55f8658567f1ed2e3047e9b3144c55fbe541632
MD5 5e319be4bc5f47c7e431089f2bf4acf9
SHA1 b9c95e439084bbfa5ce719065b41319d5a346970
SHA512 21c6703a7c7a0e37a40e48c44e48bc031cefe7de7904a9b7666b82d782360f656524be274849dc3be43ac3908824ce8a05efa351f593c438da5e3e3170ceb09f
SSDEEP 12288:Imw5HEjsChNVBFgl0WDm+CnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:lwu4OWssqjnhMgeiCl7G0nehbGZpbD
TLSH
T14905F15A72A81CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7bba02cfea8e1653b08774f602da40f3bcf362cf5ac748bf5ac4af583ed45e05
MD5 17ab79f1887b85e311fe963bf1726fd5
SHA1 76d80f324aeca67a716fdb3a3c80ab3005f27bf6
SHA512 bf6ba4dc6adb525f62034761f1df5493ac1e21d344f9383a722877a1a56faa42a419ae0355d5b87d7da65ce0824aeedb55e17ac2f76b2dc688809b13f064518b
SSDEEP 12288:jeZ1IyAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yZuZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T107E412AE239820FAE5634178C6E5D609EB333C53673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f22406aac6a39de9ea324f8cfe30ae070963ca22766e2195bcc5f7f95186a5df
MD5 f6b60a5d977e0cfeee8e00eaa2140110
SHA1 defb7fd8100b27a05d4fae98a89102e7351c7ac1
SHA512 4d9875429bd31d220c253c3d3b787be913f04dd13c570f82659fffde86dd6985619c2d19c2ac1bc257006a32f6e086b2eeda972ffef4a908520a4b45a12b47ff
SSDEEP 98304:aQRQyi36YOcPbLvw2gAf+PN3aD527BWG:RQyiKa/X+PNKVQBWG
TLSH
T118667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e25bf4b83f63365645c908cf67c67b96e4855cf5c952c8b1b8c7110e2d66ef44
MD5 aab6d8534837fb9d7bed800699a73444
SHA1 3698bcecd403fce73183b39b6452ccca5ec430cd
SHA512 47298686cdbd2ac5c835ea8e09fafe611f8a7d0b0f93f4e7d919f2d73d09efc4473f1fd83829c30f9d6dfa74bdc0625e7e4d924027f745a569b4084b306d46b2
SSDEEP 98304:AQRQyi36YOcPbLvw2gAf+PN3aD527BWG:XQyiKa/X+PNKVQBWG
TLSH
T10C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9b2bd279c8c062633d3be6bcb11b7cf9386bd8e4bacc961d901c8d43be7e89ca
MD5 49873af152375f77a7a8a6c879c165fc
SHA1 51fb59b2fd51a29ea2bec64107f900a7b373e4f6
SHA512 01ec3f5ce06ac60f65c279adc8228ce6a0238a857fc17eb96d5594eefe109ed043c71e9a6b34ec89dffc53be3f948af335af3d2ed4fbce6df1ab1bde3d6e1d22
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0JsqjnhMgeiCl7Ge:F68Qg55nhceWu7PNU3/cDmg27RnWGj
TLSH
T1DAB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f613873b50b2297fd74d752bec5447fba56e4ca2ac8cd2e658b3b72b0347d580
MD5 96d80de69a22c90eb53096381d0d4c2f
SHA1 bff0f0c6927c02e65d534362ea8027a67e3e4bc4
SHA512 efa183fb2fff9b94ca6899081a7046c7c546b54e0b60429705d2419fad5ab6fde3a7e5857a26bb989fce560a894cc3643de40123d9e50f72cb4fe09f32333417
SSDEEP 98304:fy5112gYy5azzVvt69nLKnhZpD527BWG:SLIHEWh/VQBWG
TLSH
T1C9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f9910ed4f3e7a832019ec87cc832642fed7c3adc581095d9f71e27fbbb936c95
MD5 cb0324c2a2546059cb3e2eb937397e19
SHA1 3aef0c8f94be30586662d2eab89f69b31c3bdf27
SHA512 5fa89fd38e23e0ead7a67790e343ae97ad82a93dc31a3d2d6defd00eedf32db35c35d26bf2c760d6dac37b26244f77b39ac1c2950ff9e02c5b8e089608e8ebbf
SSDEEP 49152:CB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gliDmg27RnWGj:wu6Jmdxd2diD527BWG
TLSH
T187D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 509092fadeec4648c0bdcd115333c605fb6339d7cfa9fcfcbd5cf8fa63f0044a
MD5 fa8d7aa18b5cfe6466cf7261121b82df
SHA1 5af6c8d25cd8dcdbfcd829ff33dba08f1e5919cd
SHA512 a6d044e60b3e9cec32391dc2558777f6299c446a3cc703c318384f52bd9d218964e02da5e7ff5eac70454d9e5c0f05630193fa63e201b38ee409d039a32fafa9
SSDEEP 49152:41hpsNoJpF1A63U44CwH7R4xeDmg27RnWGj:4mifPWRHD527BWG
TLSH
T10DB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c6563280e58b139a2be3e55ca7695b97c8483bc0e408277c363ec1be8a4abe95
MD5 53978ccf3d4c0d1d8adda8550fdd3753
SHA1 3616806302577e0c3486c620998fa74b7cf7e2ae
SHA512 99dcb57dff836eae8b75aa56b12aeb79bcca495884cb5b3504bf3b557219759300b6ca6cf999c5f57b23ff335ffdaa1d96272ac998e0f4b393f4ec23a6df89e5
SSDEEP 49152:RSuZQIY0Be2KcRVtOnks6NMHqdDmg27RnWGj:/5dKii61dD527BWG
TLSH
T1B1C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7620ec4aa811093bf0fe61c23ac5b8a83e0448f002e78017c61de25e6e35a761
MD5 8c1f0e5ee39a0c08a146aec417589890
SHA1 dd0eb6156f31d3ffd592cdafe86cf2e7e1f9fd98
SHA512 3284c7adb50a64f4092807df4e792563c1d998273185cc377fcf1579fae2afbcba01c04287cc959e03c558467e8eba4c3493b9a6cb424e2ece7d4b5ab51418b2
SSDEEP 49152:OhtSn8EApI0fig3giDn0AP5wyDmg27RnWGj:PX2imphjD527BWG
TLSH
T1A195BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 1dc980d0cb4f3bdbbea8655d602be098f7dfb2b57d857555c2d13f199acf4010
MD5 6dee67b062a79196bfcf0f3394ec3572
SHA1 fe9e1b5ec9b267476c2e72dd0eb40cb97894d735
SHA512 239e9bf255fd73b1e6d074fb6e79f9e5c47ebe48af9aef4dd960a9a0b8e91dc88552349df7486e12ccbaec44ade0d8cde408c9772cba819422f272ad4dfe0740
SSDEEP 12288:+NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10AC423BE914C01CBE92244B5C3E5F15DAC073E5BE92004937A5B78BAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 52070b8796524d76bbbcc2f788a8fcb22d092022241280310003fcf217e67631
MD5 22e95d612144d2e4b19c9daef73b1b39
SHA1 29ea6a0d9bbc154596fbb18f4956538fa20279cd
SHA512 a78f7b9e888b7bfaca5ddeda4b20b6d6e84b2cc1541ec0bae21bac2b1c62bc761617ce17b218804908fbfd105fb7cf3a8f7d61b37cb98370c9bbe6cdfde19fa6
SSDEEP 12288:CUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E1C423BE914C01CBE92244B5C3E5F15DAC073E5BE92004937A9B78BAF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 589ea91777878c3efbd280385607463eaa5fb49599ae8058b39d2c6fd2ba39c8
MD5 583dffb275e79ce83c3c6af02711140c
SHA1 85460dbf441ec0d7ecb1fcbd1cb17f821d9e5dfe
SHA512 8364361ba91523be500e17675f621b4d84f2de5a524c3ab823cc698ae42d96f1970d7dbe475b0aca4a4874364a068fe70a46c9b4353817519f3529c157c903d9
SSDEEP 12288:UiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B5C423BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 dd198e9e09f6727012686359518bf4ea30b9abf85cb697549bc77f4e60580d38
MD5 e145c8f4ab41ecb9a78a090dacccea9e
SHA1 4ea8189d43fb8916100444e41011bb0f37cddc0f
SHA512 fb74ae3e3608001e27119ea97c67162acf6d30a31f3aa728afa605917622ea5f7e74968e6b1996f99cb2ca5b98e2a0db1e80163cf1bca6024e625e08144b7e28
SSDEEP 12288:3VDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T175D4236E535C01C6D83285B4C3E5E11DE8277D56E73005DBAB532CEE9FB26948F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 5009fc4339782e1f676d3d775510dd553f4ed51d4a4037e464c81877280f834d
MD5 0ef5be6d85126a1ef161257967b4743d
SHA1 5d96e387e559d7f31b6adf24931e6ce0b3eb577f
SHA512 2739bbf22890cb961d5606e667b3575ff446229655c831b5e41cbf6d4a6d17316d464ae78a9640222c7d2b509429e6b46ccf525141672653191b8e4def863caa
SSDEEP 12288:OrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FAC423BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 cdd4cc67e61b261baac7c1e25210b13c52fd3291ec71e966d203de5385020949
MD5 ce24eb86df7d608e82834b8d6c0f3a25
SHA1 e3253f3d0d388632f75853c01161b308e242d8e7
SHA512 a3665b7615b6ec5c8158bc0311f0a9c0a0acbb1d33861932861d93ccfd5ebf70527536d407c662b147329658143c2a452cd207a3c76dd1fcde7c203e46caa740
SSDEEP 12288:+IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T192C423BE914C01CBE92644B5C3E5F15DAC073E5BE92004937A9B78BAF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 b69131217dd3084191c8b236da85ca752d418fcd0a2dd16cf0c55032e033afa1
MD5 47f1a2c52d674d2948a1ddab6ddf5f01
SHA1 2a28a43e625c8670a77e6df7c4d9abf567e1d965
SHA512 54ee243c90b5944b38c710065195a1362cb499c20fb3ed619f99cf3a5740d9d187ad198ae9af57398513bfbfcaccf3776f8258eb835e53614ad09bc5f020b407
SSDEEP 12288:TcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T132C423BE914C01CBE92644B5C3E5F15DAC073E5BE9200483BA5B78FAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 24739a26f47bc778ff2ac81bb2228e25e63b7878845a330997544ca87a3797fb
MD5 c670befcfa8945675290eadd9c62290a
SHA1 5b1848b5ba35688e2e37dc7c72b1d908f82eaa9a
SHA512 e2ac8c505db99d15b0636f56deccd961e08c2daf2c2eb30c6b8e1baa99d1f0d33a75a8437e144fb252e98ecd3fbd72091f2978cf4cfdd3a861b0ec03901f95b6
SSDEEP 24576:2ZMRzFVSO0sqjnhMgeiCl7G0nehbGZpbD:2ZMRzfEDmg27RnWGj
TLSH
T1C30501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 da4e43562b5f05e49f716016825f651d01055f6cda8a4da21e5bc198f8d0be66
MD5 c29f1d98314ea973ddc6e59cec492f36
SHA1 b8b78a6f67636dc6ad13833d09d3fda8e49d69a0
SHA512 61be663973d11b9ad856744df621117a85eecd7c9b262fe243b8f093f397ce4570a76b6cc5eb052fc9d2a063edbc6d3402bf516362fdd6a7bf6441dec08f1614
SSDEEP 12288:TpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DFC423BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 637e1159949e571650a4c276ceb39f767fc82f4f09fa5b5811a56ce5602f43f9
MD5 612beaa4368eb144d7537cd1954a7396
SHA1 157de758b02967163e97f386d7765bef796228a1
SHA512 43e5bdccb4e296833fa09eb5dabd7cf9dc8299fb271fdec8c455990b3cb5499f2392e51c0532e33bcebb19c07022ec2949ed1d332bd48c1b7f15f535ebcab0b4
SSDEEP 12288:VFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DFC423BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA5B78BAF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 92c96d695a62abe075299394e61977b4133e71584118b2e73c7524611ce469ab
MD5 438d9e2622ce32bed00ff292400b22c8
SHA1 566eee8c494a09e8b07b5991859effceb11acb04
SHA512 17ca987ed92a179c245019c9a7721a8baa24ee854b3c41dd3513daecff0972a0210660613e7636ec2461bf1cc9d477382ede7a12f7be48ad76063f1eff329c1c
SSDEEP 12288:cyPz5L8AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FzyAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AEF4025B73A530F9D1368138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e0cf66afd85a74ba758bdeb16c0b7c62fd7e850165aa00797ec111d9cf320fe2
MD5 b01043d5e00dc9e770ade25413bf4521
SHA1 39a972ebc28844d3f936eccb3aa916fc53edd538
SHA512 48b3b303699bf6003a9e5824ea9ff8173a1bf156953f9a5b1a6f526bfcbb14b0230eb222201a1eeaeaca413f7c2814f3f571ac6fe674d9ca71c55652105e1017
SSDEEP 12288:IpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13EC423BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f00307fc8a777f93425497a5b3efca7100a47929553422714651b075b70bdd40
MD5 b9078ce7d4298573731ed648d7716c40
SHA1 f2feb6e0fa6b7863b712a224dc6d226d42a6c906
SHA512 7c80c272ba5e3dd8ceb0d2a5602632b9a97efad6edbf4ee8e8c9c03436131f6abc0c9cd3ab2ad966767957eb4378b254aee0b230fb499879b0ad54262475ad08
SSDEEP 12288:BpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15EC423BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 e0715a82a6d5452774ae37b72d1419263bbec3309b79d3eef0bfef303ded1d54
MD5 cf1ddde77e46953b5f16041bb87ff6fd
SHA1 1312a41570686814f881ef7d86f564e486b85125
SHA512 d57d3c7aa00bfd78343dda151b251de0034fd5f2af9fc5d537af1aaaef9f0c4fbcf395f500679c0e10c839d3ae0f77a4f4acd766c83d253f6646fc2dafd3c146
SSDEEP 12288:dyPz5L8AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UzyAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T174F4025B73A530F9D1368138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 180f7a5ab1d0c4319a756a0b1e0907118b53c070241302c648a8b1f456c97130
MD5 32e849b3d861ecf5326bf30553822255
SHA1 c0c5cc468cf2a81bcfc3d6bf163b62cdfd1cb998
SHA512 5c648728f1fedf4059ab8ad52ae23323e04aca5d1f2d60ede716a2be1279517cc69e3e4151c3772ca8fb46d330fd92dbc4d1a30fe891ee83a05e2d2a2580b845
SSDEEP 24576:PTDaLl3z0zDSsqjnhMgeiCl7G0nehbGZpbD:PTuLljbDmg27RnWGj
TLSH
T10E0501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ebe7349b0e59349c953c8d6de36f916c1e01e2e006728d1ab66337f1132a79cc
MD5 25a404870c3a57e3283204bbc5e96afd
SHA1 b72263f56c828a08a86afb2527a800f1cce41fd2
SHA512 edc3e9a7e87a682a0ec5f011bba7cec8cfd663fe0ea75059188089eccf3e75d662fe8321fcc9b3bd7413ad10752a6efa7f7c48b44ca26c38443243f66d825eca
SSDEEP 24576:CcP4mcvIjkGOxhKP2l71nNKbrh/8KBxsqjnhMgeiCl7G0nehbGZpbD:tP4m4IpOO67W8KrDmg27RnWGj
TLSH
T1DF65BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 bf175a6bcbfb56d8ac893a14049d48800d31c5869d2aeafa4cea27591367b95c
MD5 841c2767f4519676667378df44d2c701
SHA1 32cef7491570f29e092bcb42a40e13e32c52b549
SHA512 7a1020f149fc1ae759226650b06ea5abbca5439bc8b3af86da650754b84a3ea8e48b734308186c5fef5a4ec184d1f37768dfa969faaf675a2be48f964a401c74
SSDEEP 12288:qbsfZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EBE4011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 159e4ec7e081d1724f4ffcfb22ca60388105fe7307e5e68aef967238941be605
MD5 5c15a93c1350769738e07e8de2f33a1a
SHA1 7190eb1b63b415f97a50e657b3b13821f4db69e5
SHA512 cbd5ebe42cb5833a3176c4d38881d7e6190f318d36778b4213aa03782a174d715419e32bc5f5800cde8ab15758124655bdb39f9da142ab4611ccfb20c962823c
SSDEEP 12288:b5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:b5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CAD4237ED34C118BE97649B083E5E12D681B3E669F204483B94778FDF6B18A48F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 220d2b1da5b77e8284ec89e9f38990c618540b25c482e05851a3f199e724a475
MD5 9c7dd4d08def3bc01c40ac50b4b0ac23
SHA1 4474c39c3719683466524779ce2048f3a6f7906f
SHA512 b7eedaea0362889744a33d0ebd6cc91713f5c6d7089685416284c507fc879f84c892dab9633827442c2ac490985a6a7a3a2b0127ab98b7cfd6d33fb041d3be18
SSDEEP 49152:Za0h2GEkuAe73q3pp46zwwQfDmg27RnWGj:Za0hNYG4JwkD527BWG
TLSH
T17585AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 dc2f8d2bb97347603be4ef62401d46970810efe1f034e43d14b3eb2319e153ea
MD5 725f061baed0f1e65f6eebce21176db4
SHA1 75be6e9e2104d99b8ba7d944bcbf7b4a817ac6c6
SHA512 1c99d1c3ef8db84b20779af68d9b0d849bc6740d92237c4c4afa2081002f17e896cd5153bd5000963e836e14240ad15665901f83565823cbcdb4721ae331b01c
SSDEEP 12288:nhbHjfXEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nhbHjPEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T198E4127E12AC20C9E572A1BD8296D10AD632BC26172053EF27D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ee3939e4c4bea8b7db35fff67a3fb5bb43bb55c95036910b2cc90aa79202cc00
MD5 3b4f1a162d26812504240024b2ac087e
SHA1 32cc66ff74765666f21b55765d020c91cb151cdd
SHA512 4913d949a126d6667f4d40f2d0e37aab7a5d627bd417b51d56ec74e92984f05ef723b90c4aebb3611c0f656461645ec0b4261a98450ca9491c1bcae41d94a5a6
SSDEEP 24576:o3YgnJcRTk4yti+R5dBR/ssqjnhMgeiCl7G0nehbGZpbD:oIgnaTk46pBR/YDmg27RnWGj
TLSH
T11945BF2EF2B910B9D8A6D136850147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 01773b742c4498e9fbc59fb4d46672c4d81846a38eb81767ee9a1de846c8e787
MD5 b4774e8ebc40a4c0ad137533f4fa59ce
SHA1 f333b4ecf75484dee7e1d0f32d33437cd91035a8
SHA512 a9cbe5d2ad1fa91d351b4fea69eb4d9c73fc1ebd2710e66fa9c9fc9ec9825b21647f6c8c236996f8626239085e7c6e5568473db5884ed36d28e68fc9ae2a675e
SSDEEP 12288:AVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14EC423BE924C11CAD93645B5C3E5E11D68073E56AB2008C3799778FDE7B28E88B39523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 9c029e24895f675729c17547176f9e45a96308172989c209d44c38fe0ac7727c
MD5 3fdebce2ed4f0fb3072672e356fb008c
SHA1 80f7681b24efa39e4159b70a937bbf949dfa11cf
SHA512 d6aea9d3e937fc2797a1c2df13d263a516a16cd9a35ca5495f81f47f63f35cfdde182fe78a50635df8b357522181e6522e4ad1cebf44e1fb8a02012c12438839
SSDEEP 12288:OObfA4LWOsvAYFTeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:3bL3UTesqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E250159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 364f0fae4341105e1bb6728a7a78d20cd43ea4b63f844cc5612a7e04a2d318d7
MD5 091fe8074864eb876a2d0ae6c305507c
SHA1 25bc496b66fbbe76ed26dc3843a31ba37f35df58
SHA512 b67759312b3402cec83a8b7c03eeb433ab7afb44dce9c5e24069edf01951bb8a5252ea3d0a3e386189971b3e9c6b8f9c231dbf804512e8d10a574558ab1b49ca
SSDEEP 12288:9pFtIOKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MOKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T131E4022E32DC10E9E536917C8692D20DD6327C661B2117DF06D180BE5FB3EF85D3AA62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cacfc4faffdb77104df8740c2a9dfcc7b89ceb8016705fa620166f097efa7905
MD5 32afe6ddf218dd6fb7d33ef27cbd6579
SHA1 dc46b40562204d0a22f0dcb751e331d54a4f4f7c
SHA512 204509e61a6475cab823ee3a81b6071ab704035fca91347d1528e63873ac1e530164185d69fa69a2d4a4e080b043cafc8b3e99292a57df8ebf68f2633fb28da3
SSDEEP 24576:D7NM9YqZqmWMUkPjZM48Mv6bEhspsqjnhMgeiCl7G0nehbGZpbD:D7cBWMpPjN8DbEhADmg27RnWGj
TLSH
T1B765AE2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1b9eeb153a9572000e608bf2587f9297fc56cd3d039e37f95495118bf8949366
MD5 3b782faca8d344b5123a003d289bcd97
SHA1 7074b37fa76fd2a88617d56f6b1880738bb4d061
SHA512 c60a99647e2aa849974a0ebe06db1b453af107389f72bb47d3e9bb8c6f01b84da1085bc9fbd5cc74e1af16d21801a064290d0785deb0b99e2cfef10b4efad158
SSDEEP 24576:KW6BApg2YuyuNDYTabvcdvNYf8km1vsqjnhMgeiCl7G0nehbGZpbD:KF2YuHNETovAvNYf8kmNDmg27RnWGj
TLSH
T1DA857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 dea52ea74c2b726a7ba8711104476af864e28bc96bca66aef252b5233bc08ecf
MD5 abd5d7e7f98a4b6f8526acbf3bea43e8
SHA1 ccdec38acd311b7ef8d78599d515dab40bedb591
SHA512 f8d8622b87325f8ef574fff14091ad5ec7d1c6aac5368d0eb3066f2ba8c4f37fa43e72fe457917c9472a6f70e94f20013e073af98e2cedd0eee6600e6aaec0e8
SSDEEP 24576:cAFs06+OmlfkNXEbTo2sqjnhMgeiCl7G0nehbGZpbD:xFs060lwXu/Dmg27RnWGj
TLSH
T16265BF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 8ef7c9581e6ede31e7845d1b7d6a67f3ec5cda59b68a9fd6bde88d0c0c432ffb
MD5 83263273c06a9654080adee93f96badc
SHA1 bd34b8e8aaf8123dda8bef2d62305e91205d9651
SHA512 765076fb662cc8d8033e8dcc469c65482f3fa944005f7effec71dea5453de2ed692445cc20b4bf131ea126b51700d76ebd9ae333ace565d6854e93690ba47da6
SSDEEP 24576:FJnJ5D3WXLsqjnhMgeiCl7G0nehbGZpbD:FJnJ5DGX/Dmg27RnWGj
TLSH
T12915E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e13c6b3a399e46f18f79287a274258839e4febd18a91a3b127e73cef185f6746
MD5 f1c7b8484b82a217418308d0c5902f9f
SHA1 dfdf02b5581fd0f81bc88867d464bd277f834b55
SHA512 7b389753c2e840c6b84276a9aad67ff9af4723313695893f13abb510ac7f8e4a4fcb8a1258eb7669080646d53920155c64731326965b4fb78c6fba9c5dbbf787
SSDEEP 24576:7EPghm6/7IIXdwcXrif7qQncjlP65i3VussqjnhMgeiCl7G0nehbGZpbD:8g06DIKdwc+eQnSt65aVxDmg27RnWGj
TLSH
T1E2955C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 92a3d822ed8fceffb1c62c7d8723412596529bd1537da2d9ef9f03515a031ebf
MD5 de6a1e555df70d74232a2f78818a632f
SHA1 26998d9cac92530c34da9bfcc3aa1df2f05b5eed
SHA512 5d36edd7781e59360c45f0b956fd020ddcb4f6d3732c5ce5c29cff4c7f02ea2c6f0ca97bc8a91e8fa0860d83b432453766ee134fd67be24fd0e8264eba52e486
SSDEEP 12288:CEP3RnnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BnnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T185E4126E679C60DAD536907D8291C209D733F4716B2127EF66A2C17E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 5d2805c97fcc261397e48f0693e5609df251352639f1f6b386079692974a32ad
MD5 fddc5e6cf61d4f9a6312ce980054268d
SHA1 7d1e6db7dac7771c88daf5b41248e2bdf15abb98
SHA512 e1bf3511d0f78c7c3ecc0d47797b74996dac6ffcf496e0a481ce09d2162dfff3a564b75e51346770bd171f5e7f2c7fa1a7b887e9f738dbb4752ba1d7d744674f
SSDEEP 12288:8jkyUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8IyUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T166F41219639C50C9EA760578C6B3D1589C36BC31AF2046DF6191FA3EAF73AD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 a179c8a80c96042503491e6c73b4b7e4ef56c128d5c8d7bb346bf312f05daa79
MD5 70ed80beb9fd23b3c0210d30b49d3cd6
SHA1 a245728dc38624ae38f3e57681ddba9d8024881b
SHA512 d8435e8db98f5daf1d1fbe869243cb7fb5e1b946b5de7206351483f37745f2810e4d7534740a1bd2eb97d08944526ed6add620a7786ee640849e3c35d6efd284
SSDEEP 12288:8yaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pasqjnhMgeiCl7G0nehbGZpbD
TLSH
T16DD4237D525C20CAE93245B4C3E5E61DA8133D366B2018E779E7F8F9EBB24D44B39812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8651eb0e6afa99c000d3c0710ec3a0ad80959b927ce3f5f36f135069c6bc8726
MD5 d41e0ae2e4a68953f530e13b6e9c2a5b
SHA1 2d1141a11ffdad5001710a2f679571ea66f838d7
SHA512 c049de996616769840473ad3253ec84ea220b0c88c1e3b25d952eaaa93093b6809af457e943125ed056ec419006616c04ccdecba54e3f6be510b1e86df9623bd
SSDEEP 24576:wQ9MxZKdcz9dw3hsqjnhMgeiCl7G0nehbGZpbD:wVKZ1Dmg27RnWGj
TLSH
T1D9558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 db674dca6000f9c444ac52fb1cee31027764b032dd632d416eaeb48d92e94f6e
MD5 1d268ad35b8b117154aee5822143bdbb
SHA1 e4842c18fc335bd51eb47dbe27f0410291ecb1df
SHA512 e109d4a326ad7d66ae38fb8d4169cdede971fab09cac7d5b02e0c2187314414e6ba5a54ef43a691c56f08694530b4e7fcfd03030f2adb48b198f9d6788652a85
SSDEEP 12288:nyoKo2JRple9pwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:nyocDApwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T163F4E01FB76D40E2E176813C8985C249E673B4315B2157CB6692C73D8F639E8BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3df8c1c74cd505ca1c0edcab43d85e1ed8e1a1b14624ea1744b7e8bff65335a9
MD5 829c9c9a61ca293181c8354d2a59ef40
SHA1 ee2cc034b5917d1d51c805968944fddf3cef3ab3
SHA512 b5103d9173ff0ec3bb2d2d0d6fd49f8daf1ea85a7a7252b9ed3b88f7903fc7b7c3384b00d752601f46bbb40ffa49100cfd3f7bbf4307cf57e517669ac5f02d9b
SSDEEP 49152:XWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKsDmg27RnWGj:P0zuNIyD527BWG
TLSH
T16BA57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2c70380e94985ed60fc984e6dfd165b0832745158b941e65eaa9b06f548527be
MD5 cb4f178f983c6b4c8d05176cc89f347b
SHA1 3d4e9df5f65f2142dd6353ff4fa7f9d51f349e9c
SHA512 d00c1e9f108031387278a3e5a5a9d2cf4c747f71ae8107490eb04ad519090dd8c4b6ce63bf24da7e1d6617553ecece15a3f7f32305fa8e5524a06868fff7b361
SSDEEP 24576:11QT7EcpfxR+N5AWAz3ooiYujMqbnsqjnhMgeiCl7G0nehbGZpbD:wTDxR+N5YzT4jM+Dmg27RnWGj
TLSH
T1C555B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 ea3d186073e3e4102df4e6b7d5121e21fd6a4222d48bfe317f4d657368745e9f
MD5 19036363e6cc677f51ff929bd85cdb87
SHA1 597377669f0a870781794ec5fe0a7e1d28399610
SHA512 558814ca350895f0918b44cf63aabd57b066ebec47b245bac015c3535c7a9e3cd6bf0e7b62835c0937caed8e5545e44fbd82e6a89d2c45527a4d4e6c627b7fa9
SSDEEP 24576:kTMdOz0FFS+bmSLDsqjnhMgeiCl7G0nehbGZpbD:M0K+bmSLHDmg27RnWGj
TLSH
T10A15E17EA36D14E5E47BC17CC653D90AE9733862032166DB0690C0B97FA7EE47A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 9e733a5238760bcb1b99a3fe4aedb11fa359776c098c20bf3fc68823ebc7de0f
MD5 93f496832e157306d54754e1d5837b6b
SHA1 52ecdc8bc60b019353af38dde22e4b1fb20493f0
SHA512 5cb5c5883e4a7ee75d90a5dafc18565afb73e4374a1cf599c37f631ad5a213d179612cddb9034c08a60058b33c5a921153a10e934d58a10fb4a73fed7b8feeae
SSDEEP 12288:M4KeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qesqjnhMgeiCl7G0nehbGZpbD
TLSH
T137D4126D53DC20C9E4329174C3A6D11998327C36672019FF39E2D9BE9F739D48A38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/968-155-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/968-426-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1080-108-0x0000000000580000-0x00000000005E7000-memory.dmp

Download

memory/1080-171-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1080-113-0x0000000000580000-0x00000000005E7000-memory.dmp

Download

memory/1080-116-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1140-450-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-455-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-465-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-464-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-463-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-462-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-461-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-460-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-458-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-457-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-459-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-456-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-448-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-428-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-454-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-429-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-431-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-432-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-453-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-452-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-451-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-466-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-427-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-449-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-443-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-433-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-447-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-446-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-445-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-434-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-444-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-435-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-442-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-441-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-440-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-439-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-438-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-437-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1140-436-0x00000235549C0000-0x00000235549D0000-memory.dmp

Download

memory/1156-79-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1156-158-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/1512-175-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1512-120-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1592-115-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1592-20-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1916-168-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1916-508-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2208-424-0x000000000CEA0000-0x000000000CEA8000-memory.dmp

Download

memory/2208-182-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2208-511-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2208-190-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2208-224-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2208-206-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2260-307-0x0000000000400000-0x000000000058E000-memory.dmp

Download

memory/2260-70-0x0000000000400000-0x000000000058E000-memory.dmp

Download

memory/2260-1-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/2260-14-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/2260-0-0x0000000000400000-0x000000000058E000-memory.dmp

Download

memory/2260-8-0x0000000002B30000-0x0000000002BB5000-memory.dmp

Download

memory/2260-15-0x0000000002B30000-0x0000000002BB5000-memory.dmp

Download

memory/2820-159-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2820-161-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3040-167-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3040-94-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3040-103-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3040-100-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3056-127-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3056-289-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3120-152-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3120-420-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3120-143-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3120-149-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3728-176-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3728-510-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3752-89-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3752-83-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3752-163-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3752-92-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3764-48-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3764-138-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3764-40-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3764-46-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3796-181-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3796-123-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3796-419-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4240-49-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4240-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4248-164-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4248-430-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4468-130-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4468-418-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4468-136-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4468-139-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4556-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4556-60-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4556-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4556-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4812-30-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4812-24-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/4812-32-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/4812-31-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/4812-119-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4876-72-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4876-76-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4876-74-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4876-69-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4876-63-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/5072-173-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5072-509-0x0000000140000000-0x0000000140216000-memory.dmp

Download