8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
Size 1.5MB
Sample261027-e6mbya1wcx
SHA256 8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6
MD5 a9f822e78a141e0d9286e56760623c66
SHA1 9b22e2988e4f3da6e42c1ad023bdb5fdf3a9ab40
SHA512 8768675fcd9ea2078117be7c95cccfc3ce5905725c4a3ee913127e7c01a3f0858f4bbb14f82210de67c688ccab10b3e2592d0b21bb2dcb14f9c204ff4a2a7c44
SSDEEP 24576:4Slw2U5BOjfShxDbdSgkfxJQqH2l5UBDeiq3ZJWCOWkpNyBo4kx929bL3Hnx:7lfUfOjfAbdSgkpyqWl5Y+GSB+kn3Hnx
TLSH
T1DD75F01277F81639F8F36E305C759B69DA3EBC319D35EA6D2A54219E1C38A01D930B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1496	alg.exe
1860	DiagnosticsHub.StandardCollector.Service.exe
5812	fxssvc.exe
2248	elevation_service.exe
1028	elevation_service.exe
5932	maintenanceservice.exe
4848	msdtc.exe
4968	OSE.EXE
5352	PerceptionSimulationService.exe
4740	perfhost.exe
4372	locator.exe
4856	SensorDataService.exe
4652	snmptrap.exe
3212	spectrum.exe
3340	ssh-agent.exe
3824	TieringEngineService.exe
6136	AgentService.exe
728	vds.exe
1368	vssvc.exe
5092	wbengine.exe
2332	WmiApSrv.exe
3480	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\spectrum.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\System32\vds.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\wbengine.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\daea0eb7227ba850.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\locator.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\dllhost.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\System32\msdtc.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\system32\AgentService.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1820-0-0x0000000000400000-0x0000000000580000-memory.dmp	upx
behavioral1/memory/1820-66-0x0000000000400000-0x0000000000580000-memory.dmp	upx
behavioral1/memory/1820-386-0x0000000000400000-0x0000000000580000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107609\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d06db56cc65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d712356cc65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d80b5f56cc65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec87f855cc65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d06db56cc65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fee0b456cc65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038e55756cc65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1860	DiagnosticsHub.StandardCollector.Service.exe
1860	DiagnosticsHub.StandardCollector.Service.exe
1860	DiagnosticsHub.StandardCollector.Service.exe
1860	DiagnosticsHub.StandardCollector.Service.exe
1860	DiagnosticsHub.StandardCollector.Service.exe
1860	DiagnosticsHub.StandardCollector.Service.exe
1860	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1820	8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
Token: SeAuditPrivilege	5812	fxssvc.exe
Token: SeRestorePrivilege	3824	TieringEngineService.exe
Token: SeManageVolumePrivilege	3824	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	6136	AgentService.exe
Token: SeBackupPrivilege	1368	vssvc.exe
Token: SeRestorePrivilege	1368	vssvc.exe
Token: SeAuditPrivilege	1368	vssvc.exe
Token: SeBackupPrivilege	5092	wbengine.exe
Token: SeRestorePrivilege	5092	wbengine.exe
Token: SeSecurityPrivilege	5092	wbengine.exe
Token: 33	3480	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3480	SearchIndexer.exe
Token: SeDebugPrivilege	1496	alg.exe
Token: SeDebugPrivilege	1496	alg.exe
Token: SeDebugPrivilege	1496	alg.exe
Token: SeDebugPrivilege	1860	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2076	3480	SearchIndexer.exe	114
PID 3480 wrote to memory of 5948	3480	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe
"C:\Users\Admin\AppData\Local\Temp\8909b0b8d9ee591fc1c02c086f978eba7c2eb4c46f79f74be2da60ceae16a5e6.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:536

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1028

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4848

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5352

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4740

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4372

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4856

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4652

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3212

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4072

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6136

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:728

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2332

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2076
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0ea4243263b24ac1d15ab08cd23eca3572b08966dfc7f095e52f26c493f89f79
MD5 6519ecad57c41d78e3563d5c54510db9
SHA1 9ef582d853e48c47555b089f599cf68dd252fc43
SHA512 100579030a84e5168f7e33f85ecf257149811f6411880643b9c79025dba455367792bfe087fcf5acd225f7284eaa40da1add0c875652f6fd677daa81c7fded39
SSDEEP 49152:/b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn3B+kn3Hnx:93q6sjBm+k
TLSH
T184D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 940460ae9e459806cee542384485f0b485db958c0a39f59a921933c150fdbd98
MD5 0e8341e2b58f8d34ef6f4875ab4eeda6
SHA1 eb128bf0cfbceeec4bc6da3a1ee6583fb2eeddc0
SHA512 f7531a375204492807c1c457680aa0dcb630303e20c5bfb24459cb28e28afa770b3e75eefa0a5fcc103ef428b5bbdf87fdd08a67623f8e79598a7c316e2fac69
SSDEEP 12288:01XLsswWkxy2lRq2czAmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTO:SXYfDtczAlNyBo4kx929bL3Hnxr
TLSH
T12565012967D409F9ED6B9278C8A2C511DA33BC4547A0E7CB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 7ad572764ab029c5b2c1be3cbbfe5773dcfdeff15ed7a430432894d5976c2882
MD5 fb003bb454a3931611cf2cdaf4a13bfe
SHA1 69079e504fe4da827fef7580348c947b8bae05d6
SHA512 c919b4d48cff4d979cde25c416bff509904cbed9077cbb0f477c04f09997104d423832440f3c43f904f69e8907a8201759288d799e28a54af18622b1bd86081e
SSDEEP 12288:/XZNYVLeyUji0h90ZD0wxpGZIVuArHs/LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:x0Le5ji0hmxfrMENyBo4kx929bL3Hnx
TLSH
T1CE859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4c8cfd4fa55b90640ec060d95f4766292cf1ef623de499e2f655f327c3b166c6
MD5 84a33dde8556bde8f01a2d69f0882930
SHA1 1e7e66b18dcdf711809351319b79a743028cc949
SHA512 d3285c5affc16f2b7a871242b9857d985e02901b7acb3897908ee8570e060671a8e69565935aaacc6441d923ecd3e8db2dcdfb40f3a2409bd95fc2bde563dfb2
SSDEEP 24576:ua7/ezSC6vUyD/aqgrvWn6q8wyuaNyBo4kx929bL3Hnx:p/ezSC6vUzPveHjy0B+kn3Hnx
TLSH
T133755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9718f15c85af88874a7717e09a62962e132fbf00ac18767784d4cd8403063c25
MD5 fd4c833c0b6843dead2c96b5e29687ec
SHA1 23d68899bae84a1e654a05ed5ff3b14e22d2eab3
SHA512 e7458b136565fbbd17988d9c6146d3fc9cab12977b1a2e6a4595b0051dd08f001e70a36686c2ca8ba3616f7397d011e3637cdc18cda32f652251780035f5fea5
SSDEEP 12288:+VJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98aLDAptNyvUgXZ32dT4ePc7N29CD:+VbqPb88hv/l+YxNyBo4kx929bL3Hnx
TLSH
T12A559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ab2e6e3ca01a792137bc049d69305c18565a4b2b9347e05165ae03693faa790a
MD5 b34269af737a091629b0baf3fd4785f3
SHA1 49e0969f1fb4afbb29bf98a58325c7f252b5f848
SHA512 f21d0fab03fbadf101f7a63a2c7f793b9b92a5518b56f5518fde88b59eb057491387d84aa54ebc5c35953d3a15f3628b32a90212d0b872ed7b791c440b709883
SSDEEP 12288:hmzLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:hmgNyBo4kx929bL3Hnx
TLSH
T103452312870C627AFBBD3E70755E8454CC35BC8D0D95DB98DE62ACBB48BCDA2DA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0f4d86d50ab3e77cf8f2a24c1e346ad6d7d1e7776f234805fd4500bdf9ad06bc
MD5 10d1d8db6c05cf84b54666e3bcc45f23
SHA1 c0db7e856e02d6c7ee4aa52bf0a6fbe3116c5606
SHA512 59090bce756821405cde8d4fe64dee2b444dfc5c6e034327f7f52b63a3f0fe40845ebe5cc7d59f70f859852549811392537463d33bd065f95f66ab51036ce865
SSDEEP 12288:leBNUbTVO86UiLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lJIUpNyBo4kx929bL3Hnx
TLSH
T17E65CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0b54697bbac5483ddd20b8175e7cffe88ef369bc4aae789a4c37f66c1840cb34
MD5 456dee501ba9b62e23626fd09a67c575
SHA1 8e7eba443d60105825b0430e8080501de9f474ae
SHA512 c4dc530cb038aa74b7ccd966fac6be5ebc4a9f7e7287b80b14ed42006d39da45d8e650385027d43caaa0a364e9bad9b78e66a7de743bd04a4da014118c155c44
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THI:KQvGAdlCEL8c/DRNw5CP+k
TLSH
T1F2266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 49853f4c142bd21421d92f4fed826ab4a5d1fcfbbea459511cb48e06c9d8ea30
MD5 7c0a0f0c807055669ff0eefacab35591
SHA1 1be02306a544e9d604ffb66ee989f4e862abc9d1
SHA512 95ab28df1dcb04c4cb6712772cc8f1100f9cd756b668a15ade71cdc6677663cb3d83d1d6fa78636b6824a54688ac90bb4dd7637e8e540c750e89a187161465d8
SSDEEP 12288:IAwSfxL/2Dc3XDLLmt0LDQewsAjYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:tOewsAjHNyBo4kx929bL3Hnx
TLSH
T12275E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fb693fe47b71c1d2897ab3dba26e6aec3fd4b6abf65d079892ee2fc0e8c88945
MD5 97a65c19bea87a11eaeeccd52e3e71e0
SHA1 8daacda8d97fca10630ac1a91add2904af3438b7
SHA512 910f931bb07e4a24c5c9af9402e48061f3dfa6ffa8244dc22d35305a033d97d988fc06fa36cf0fc7e014a32bfce6dd68fd64543c009f1409c44e5afb96310cc1
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH8+k:wUEtQevvqc2W1cpV2tI328
TLSH
T188474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b723009ec2852f8a62769eaf6180b7899caec3492fd10eb912474b5696d08d81
MD5 be6d1e07c3e64ea2234b8bb1ec096723
SHA1 486df17f246cc01305b4182c9df1e9ba7cadad3f
SHA512 7b596d8d7fc2649b7ae1fb53670112c62b89105fbfe5a0a296b98bb4e6bcf4f804329b22e34f76f1935f2c8b20236687ee43cf4d7b4b9f21083474be9bbd9016
SSDEEP 49152:OCbRquA/m2yL5zTfFiV+XenmE3/zIB+kn3Hnx:joquVjnmj+k
TLSH
T10DD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b2a90bed115a6b7f6b6638a2f59369cad799dacd0216b81ebabf2716aff8c29f
MD5 4d2efc94e6a53aed4f217f870710c8de
SHA1 b78daa289a93cebdc1564505344ffb9a3d0feab8
SHA512 09c446261f27c63f0e7217430dde360bb7de78e56141f2dd095ea7ad8d1b61764e4c7f1c6f611d099339cdc037a39f267098afdb3faa001fb551cae6129ead76
SSDEEP 24576:PAhGL3IFoiwtA5l7S53eNyBo4kx929bL3Hnx:PAMUFoiq5FB+kn3Hnx
TLSH
T140359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2cd55cb391a7671a8343ab8ec5efe80d6d60cdb5aa2cbf7bfcc9a1925b2caf89
MD5 5dd8198237cc9fef81ed9f165c6cd8b9
SHA1 33cb1698191e8484d56faf0274ed0dcdeec83bb9
SHA512 228a9315d4cd501dc5dd7a5176451ec3a3af37c317bfe82caf679b46096732551b685bcce77e0e05808a99a3cbdd4bd9b1df7046296dce05f77e7450f2a787c2
SSDEEP 12288:bmw5HEjsChNzBFgl0WDm+ClLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:6wu6OW7NyBo4kx929bL3Hnx
TLSH
T18D65010677A81CF9F9A756388547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7644db17743e31f609a2a0c9017c502f62ba2914e024baaf4cee5ea801013982
MD5 5848f477c01009ba32b9c182db610bf1
SHA1 2c6a2eee7096cdce241aa17910c1e1a86eb6d143
SHA512 edd8ea1dadb8efd1f5cc71931ab9333d4f3198429890438730163f72ffd80535f06cf474cf1702f8d73e3eb21d1e5183856725bfd1564377b7c8866f6ba6b523
SSDEEP 12288:0gZ1IyoLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:LZucNyBo4kx929bL3Hnx
TLSH
T103551216239831F9F2AB2678D8E58505CB32BC461B7183CF5A2185BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c36447aaf361872242c7956d80f3d827fbe4ede79b7f14e3529e663b9d82afe2
MD5 bf041c61a6c7a0ed90e3fd72a035ae76
SHA1 272febfb709f06bb0f79846428a0aa8efbc3eeda
SHA512 9e666fe91558cadceb8b4bb6e325947a07960e1782c8b547ff40e1fc4f91f12042c9b333e66c9f8ab09328dd4c9fcb218563484f9d6e219795cda2f411f7f989
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UM:XQRQyi36YOcPbLvw2gAf+PN3y+k
TLSH
T1BA666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7d410cc4e1e62e60d557bcfadd991dd9a97cb5d5292d830861ccb26da2c0112b
MD5 1c996b2ccc0188048f3294f796db601c
SHA1 4682e597954a39618a2d2f829201241798e9f459
SHA512 a67ab8e6a09392ffdcd729100a40e8bde9a12e9c2a0dd9b34f6868ef3ed11783114038bc32ea70276ca6cc788bfd9170fc38511de499e6da2005712f49ae0296
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UM:OQRQyi36YOcPbLvw2gAf+PN3y+k
TLSH
T19C666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c75fde75e56562629fc2ea6d0fbcec326fc92520b03f9c89aa0cfdbc908f90b6
MD5 b05721c01ff451789fc5f5de879938cf
SHA1 a4ad8ab0e071df8b82ad460c4ea40aa49e04e0e5
SHA512 ce8433edd07bdec304f329f332909527da3741468e8dd7e4409848f1bb7446a36867e1031e09254958f951e8083aa4046fae396804b14169060394e24538a70d
SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0sNyBo4kx929bL3R:p68Qg55nhceWu7PNU3/YB+kn3Hnx
TLSH
T19AB55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 51d7e0a6348a0828b4a77f5079d21132cb3c272f99e2eb5defef0db2259f8d94
MD5 f2986fb61422089969b9d0d32140367b
SHA1 65d42c78361f872fa4c782941e4cc534f5d60cd0
SHA512 40e20c4f90b385adf721aca3d6885305aa82fc445bb067f5d836dba948a23bab8d88f4a3ee3d1cf1f17c3a720ed94cac0580b819006ba2834024b749491d40be
SSDEEP 49152:L3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk996:Oy5112gYy5azzVvt69nLKnhZV+k
TLSH
T143167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7dc3c8cab566540a444ddd76b948675b37d3200722e66e0a035f81ddbbc88acb
MD5 85e061ebc19d259b410ce9b2d00f3c52
SHA1 85dd37026292512d79e8554ba36f0b56263acc21
SHA512 a9de9acf19cef25bc91067d92b64bd53972d4b0339022d279a1886759ff5d054e40ca361af43f5ecdce702ff724e4ad7c753197b806e861d23abae7690cd59fe
SSDEEP 49152:EB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gliB+kn3Hnx:eu6Jmdxd2dq+k
TLSH
T173D5AD13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 18bc2f2afdcc8a87212e2993d04887a8e78d3dd5095d5f60253d157de125a3c6
MD5 183d33e74ecd14284a738d39c0c2a8bd
SHA1 67e7a324c0135e6968fb32fdab8e99a4fdf61905
SHA512 945f49ac1829289e9ce17ab274f25198d3b5701633bfc6f18033c3c9c0b058d7c25456a1085789c28cb216a9522bacabf7b0385012990ec56cd3d746bd2360e5
SSDEEP 49152:T1hpsNoJpF1A63U44CwH7R4xuB+kn3Hnx:TmifPWRj+k
TLSH
T14BB5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6a9604cb4a0f7d1fcfbe879dd4379ed32b42656ba582260ce3696cc1718e6114
MD5 b14fe679964604b026a1d087c6d32f03
SHA1 03d789336736307b558bfe6d8d2a17f13d216769
SHA512 b7c9ebe93424e810e78e6c23243066cf4dfbcbb1b1289f44b9bc09929bbe70177cb2c19248099ff015fd844c3483300a8b635d08af05e98a29481ee539a2d5d2
SSDEEP 49152:GSuZQIY0Be2KcRVtOnks6NMHqHB+kn3Hnx:I5dKii61h+k
TLSH
T170C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 41e51aa507efb5de9eea4f67ef76eb13cf1b5f5d325e27ba99896f177e3ac940
MD5 f2677328157d39b1ea30711824d44468
SHA1 435f3ddd054f1bc0ebc29cf54a238fba2372c2a2
SHA512 bd07dc117bf5a4ebe51f9f1bbb7ab3f4adda0e05ea92ef4ad486ea25c3a6fb8d72f732a3e788a6cdc3ba0bdb4fdc3419a665fc8a827f65e0bdb68b374c47710a
SSDEEP 49152:XhtSn8EApI0fig3giDn0AP5wyB+kn3Hnx:GX2imphX+k
TLSH
T10495BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e657c4579ffda424dcc192885908a9bac922cc0a781b2f8bee7dac8107799a33
MD5 38e093d5a49f4b9f68ef02f59c9fab80
SHA1 06f37af40db93ba67df412d0bec2b6ebcae3f0c9
SHA512 e35b7c2c9cef43eaeecfc221cf3f11b7ff6d216bf214e0cb25fca60d98b1f278fa68d93db47ad8b151ade981c44d6d5325cdf6080ab0786617ce2cddf2496151
SSDEEP 12288:ubLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:u4NyBo4kx929bL3Hnx
TLSH
T1444523129A0C627AF76D3FB0644A8458CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0571d7f8ffc90d8bc4da602adbbe39d1c39c34e647d82faf1183e4f6fc3ae8c8
MD5 e156bdecd31f52852c0e5ba8bb7e9629
SHA1 578ec27812b6ebfa2c9c6c7d2ec77499ddc6da13
SHA512 910ee3174e639f2cf30b99397019baad6a713882b95ef06d942c830ec30903ec723aec8706844d7d83a45afd17acb78a82230b3ab397fdfecbbedb465cbb28a4
SSDEEP 12288:bcLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:bDNyBo4kx929bL3Hnx
TLSH
T1F14523125A0C227AF76D3FB0654A8498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c7d729f920e5daeb4a060eaca9d040cdae40a6dbba3fa97642b6339f93a7527b
MD5 f6906096392e801dd735ca9889b8cfef
SHA1 d2567569dff639d1ce165c3dd09a78b379061433
SHA512 0485c4ec12a00c4abff91016afd0cafebe1248c3bd6273fcd3ced69fd66518d4dee6c3c15dbba00b999b5b8a9d775b9cc2b7b60c98d4241ec22ae7a58c66bc3f
SSDEEP 12288:cKLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:cBNyBo4kx929bL3Hnx
TLSH
T17D4523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 842be7ddbe6eab6a1ee56362e18386bacebf295b3868d8b7d80f27538b9735b7
MD5 884b34567f08c6f410582c94cbc83536
SHA1 755d395ef6ebf7b204d9e21601d3711f6489e5d2
SHA512 1ce6008bf54969f1b73e7f4938313b3ed689a7cde7b0edde25039cba13670be6d5fc9a1d22cb0112c0b4abd81085b798452de0f1b83d46c0f3f6a7bd9af741a6
SSDEEP 12288:aVBLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:jNyBo4kx929bL3Hnx
TLSH
T172452312575C12FAF97A7BB098568054C835BC8A5B7297DFDF12487B0DB8BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7bdb228c652e8bbac65950e3bc57deaf12296b7f9841dd23c732a2c3a8c3e686
MD5 ea19d9a90a2ffeae332ee61f64704340
SHA1 ca7af9d433c32674e4fafbb792573d9286e08477
SHA512 b7a08d4ba6ce3cc024f2a2377b0baddab001a0f3ca668b9cbc816445a59d25acea68699b8c740bfcd17f474a99244272ff8dea26c4df9159237ac412f796c6c8
SSDEEP 12288:Q5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:QmNyBo4kx929bL3Hnx
TLSH
T1464523125A0C627AF76D3FB0644A8098CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0737b72653c39eb3929000872439371bc626b715a6eea46454dffc65076006ff
MD5 be35bbb4c3a1148af6333c259289ee2d
SHA1 f9630b33fa6cb50c5dd50fa642d05470e3f4a7a6
SHA512 295d86a2fb5abb4bd20ed81a9ea94dd1aa451bddedd2e1276e9d028102f347df83b94846ee08dab3ef0c434768f3313c95568385210fc472a56819681800d8ab
SSDEEP 12288:wALDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:w/NyBo4kx929bL3Hnx
TLSH
T1654523125A0C627AF76D3FB0654A8498CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 da23cee9bc64857d7bd7f944363a877a2c6d4e1a8e1aa34546ad80e8094c3d7f
MD5 a077a003c76fb7fd8e62d03723c1e524
SHA1 d47a0a927673527bd035561c1445ba57b5eaccaa
SHA512 0c1f10453510d8c60eededb13488a393109ce334d59e0ddf0c357d41c4915da3aa5f084fc64e4c27c86aaa4faf73826b1f6a85808845149a8fb6e722b44e8c86
SSDEEP 12288:/ULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:/LNyBo4kx929bL3Hnx
TLSH
T1414523129A0C227AF76D3FB065498498CC34BC8F1E9597D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 4835a131a93b21e011b8a4dda2a36d9fc85b3cfb4320ce1dd0365f1c9830b9b6
MD5 aa388350a0bbc604b978ed732e9a2679
SHA1 80718f09f67434bc3298f456e09e62d2c1d81257
SHA512 642946d039b80b8b8dc192ab400f31db19a59133fdc2219ecc5fe1642d762a1f20441c8231e745b41adc2a997471e73bae9959cd09109dcdf3816b1bacfc3382
SSDEEP 12288:ziZwbjzzFEoS2cPvy8LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:eZMXzFVSOjNyBo4kx929bL3Hnx
TLSH
T138650195B39418F8EC67823DC8158906C6B2BC4A0BA0C65F07B4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 527060c52af12e1c35a164c8b5dfdc6b86e4b8894d717c2a2fd7ea998b3a1ac9
MD5 284a87dceae9bbe735a6763139e37d81
SHA1 3bce6183ff70612f6158453f72ebb3dc75b3165b
SHA512 c4e4ef77946bfb6704e10a2be49bd2bbb79eab26283d207c889b6b5acc0890b2375107d8ed9de912d561b16c91f17775802ac67cabff60e2e385c9c7ee4b651c
SSDEEP 12288:o3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:oMNyBo4kx929bL3Hnx
TLSH
T11C4523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c75dedaf980081821cc99069fdb6c619713b03cd1355e240e69e1695a8b547b0
MD5 9845b1058d84235433496a1b888b875c
SHA1 fb547b65801486b3984b73a856c54208e69bf809
SHA512 92b781763f730dcdb9687e7868f7c29d40f6dd9b8dc3df8c75c7513e0f7da28cd48c2bf83646dfb6b57956af4e8d1e559b8991c7bd34d7fd62143f1b56c9fb20
SSDEEP 12288:jDLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:jQNyBo4kx929bL3Hnx
TLSH
T1674523139A0C627AF76D3EB065498498CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0f2a310b66c37d7b60cf9d9634d888b4ea1e7c97a66fa0fb8e764a304599f44a
MD5 75e8a473a70fd042d56231d97ca173d1
SHA1 2cfde18d0b821c71d5fcdc6fb4ae1da7ea4278a9
SHA512 477f3227c2e410214af428f2eeb75d2f770fce2dd9dc5a879e5f76e29f3dc8737651ed9455a94d93e282ef1ca521d4f5871838423021dcb836d0790254a16075
SSDEEP 12288:myPz5L8oLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:bzy3NyBo4kx929bL3Hnx
TLSH
T12B55120773A831F9E17A6234C8960905E731BC360B608BEF5760467B1F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 40f1853860765d5adbe113dfcb389346eadee16f06b793ba411de9289cc8ec0a
MD5 7888708b078aed8231408222dea2f201
SHA1 c63af244a8f6997ca6dbddb46377c78b54117c07
SHA512 082c5f0d1ab97053f0445e81caf010227244dd6b1a4a441fc12ed6ad0004805dfb8b955ad1d0a52597a4d2b1fe88187aa15539f1801cf659edf95437519aa26b
SSDEEP 12288:g3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:gMNyBo4kx929bL3Hnx
TLSH
T1004523125A0C227AF76D3FB0654A8598CC34BC8F1E9597D8EF27987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 22a047f08d0269e46f6b690b3040337deb5410f34b40aabe2452d15de0a930b4
MD5 ff8c8f2cb2a6419038b64ada60c7c07a
SHA1 b55f9c36d5dde8e8c8d3a4bf19a1c2b890e8b3af
SHA512 1f75f0a070f8bbc480c53ce7393d400911a1c0bc1b9030add1bd44bf42ccb26c5d5a76c22369697351e5a349d191859ff6b73f81825727be2ad1e7ab386fecd7
SSDEEP 12288:z3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:zMNyBo4kx929bL3Hnx
TLSH
T13E4523125A0C227AF76D3FB065498598CC34BC8F1E9597D8EF27987B59FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 33961a13aac68bcf3acd01ff554b379534e3cbd593a1866a6949d0c17983d82b
MD5 084007201a9d763b8a931096980f98e9
SHA1 5136c316d9278237f7aab0f8f62e10b47daa14bf
SHA512 b492d062732cb2d14626cae7ebc219767790e16af23907633c79f9abc3866e433ea7a4d824c0c58952e1c2a03261e25bb336a0873967624c86251be332fee47c
SSDEEP 12288:gyPz5L8oLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:Rzy3NyBo4kx929bL3Hnx
TLSH
T1CA55120773A931F9E17A6234C8960A05E731BC360B608BEF5760467B1F776E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 58a18fa2b43969e859e56bdecccadc3de7f3abc21bc7ab05fea4673476fc016a
MD5 828ff3d79334f880f815c739a07c08bd
SHA1 7a41cd4d7ad3a2ae845bc8b80f6053220a0ea38c
SHA512 0d656988a034685685be4a142d90e4451b7d3af62dd460cae2fa2ab2e83052ccbd2e22a7db481063437d35e0efa95ef39b544e52b2e4b0febec7edbefc7e3b9c
SSDEEP 12288:hCd98WYoaLHF3z0z04PDvh6LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:cTtaLl3z0zDRNyBo4kx929bL3Hnx
TLSH
T1D46501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 8e5ef1e31aa08a92ff94c60f15ddf8716e8a3b586954a8568916d6fd70389747
MD5 7d1334a809fad9605cb99c7c1c8b48e7
SHA1 cc24e43e8bab7c49cc029b999ac446e4a79782b5
SHA512 e88fc64b976585d82e7d24da5679a2338ea94bbfadb2f868ddb0f7441f735b5cca5d6c452e34ecf69fe3f53888955a75d0c91d429a001be5b7b38b39d2488da9
SSDEEP 24576:dcP4mcvIjkGOxhKP2l71SNKbrh/8KBUNyBo4kx929bL3Hnx:iP4m4IpOO67N8KZB+kn3Hnx
TLSH
T1CD65AE2DABDC0096D0BA917885658A4AFAB1742E1F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 dd1b3c3e9f9d6d419d5cd8a6b85495218020f0a6963ba74cbb510330064f8732
MD5 9564ffbef221f43f8ba0cb2e19b7a51d
SHA1 2766bd824b9a92853fbf8b30590e975fbb68e437
SHA512 731b8669db1c1608f7b034dade45a5dfb632b8d60a48747dfe8845a3f10bbe85dc94f33dbd8c07770bbcb2ffd5c020d687e1ea260a43cd3d70608a869cffc460
SSDEEP 12288:9psfnLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:qcNyBo4kx929bL3Hnx
TLSH
T12655F00AD25812E8D16E6274CB468A40F7337C5947E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 72f845a01f9a9fbe11acaea49c25815999e45f5faab4131612adf4228995beaa
MD5 a50cc8b293b60e89d13ff1ba50d5e8c2
SHA1 8c413437efa33ce6830c280092aa4da83c5c125e
SHA512 a5353474f8f136ccfb7ab7ad1fdef77fbe75331daabf3c528c308b3c1168d40f759a005fa50012a59d40611bb1659e58c58790c58887e896dc7ffddab87a88cd
SSDEEP 12288:1HLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:18NyBo4kx929bL3Hnx
TLSH
T124452312975C623AF67D3F70645AC028CC39BC4D0F55D6DAEE16987A59BCEA28E30207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a933608abef085cc2fb556483b7cecfe83f478dcb91fabb2c45bbc1dd2824a2a
MD5 9f110040a6e6baca084b3399ca1a3b39
SHA1 351b44baae06086eee4e7701a00af21fdf4bc0ae
SHA512 804fcecbb6767280364841e9c1677cf31b500a0da68425189ca4507992a28c4ed368ae24cc6daad5642f4d00b4c7221987cd448c212cbfb7ed4c902e4c836148
SSDEEP 49152:ia0h2GEkuAe73q3pp46zwwQNB+kn3Hnx:ia0hNYG4Jw8+k
TLSH
T15585AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 c3f1bb2d4fc6f884c4bab375ec68ecb100820839257aeb67410bf8ce513b432c
MD5 acb9eaa083443ab8d509ffed42a0b7b3
SHA1 20e2cf79c47f0621f5bc63827257b9d7d6e4be21
SHA512 d3855ff37c00b59b38f7a08a436dc9bb6a1dc95bb3e92f7efebb6ccfa86c0afbcb036ba0b2affa7257a80a75727ca850d5e8bcff631b78f9f2d312ff3d855286
SSDEEP 12288:ohbHjfXMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ohbHjPTNyBo4kx929bL3Hnx
TLSH
T13E55123E16AC21E9F275B67C9546850AC731BC1A0B2193EF6792817E0F3BEE54D34B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 31967ce2ca98c64a69403b47f1c4ddd85ad6dc59f41b8b5dddc466c6df6dc499
MD5 42849a9ea660fee452f23680fc1a42c4
SHA1 c4af35b4d81419a3da5cbc6418d3b14410420a5b
SHA512 e939806afd3a6550d8bf9639473abaa142c8a3ee08c1e9928033b8166a6838aba280f5d43aed2a814e9fb028baeae723b10ff982548db0eca654796cc9492396
SSDEEP 24576:o3YgnJcRTk4yti+R5dpR/7NyBo4kx929bL3Hnx:oIgnaTk46ppR/UB+kn3Hnx
TLSH
T12745B02DF2B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 0a15e623eba377888209a69539ef9e6c223d051aba08eaa4bdfed5313b936ddf
MD5 2add326984eaa016026d8d4e5dd7c955
SHA1 5fa238220f468bcf8f364dc03e233d7774cd4f73
SHA512 32dcc6c0a9d62f475fad90805988be429f399ce8d6bfbd34273f11728e294b689bedc1e897995d5e664ee570ff1060d9c06dfc500ede1013b01536a7f60ebb76
SSDEEP 12288:9TLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:9ANyBo4kx929bL3Hnx
TLSH
T1D1452312560C627AF67D3FB0644A8458CC34BC4A0F6597DBEE67987B59BCEE35A30103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 473b1d7149f81e770e8f0e45e015f7a15e0244a6e5e10e9fd13cd2a39363b94c
MD5 a472906bb4f764c7dad92efae73ef8e6
SHA1 51d9fd195b8a0a47288b53660ccbbd7796a3fb23
SHA512 561c3a66d79536dc71244d7ffaddd4ee3709c0623c71ff31406a5a24363be392f514ca2e8d458be6d0d44cef3bfe43dc192bd85f9e21108bcd94773f7446f415
SSDEEP 12288:lObFA4LWOsvAYFTmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ixL3UTlNyBo4kx929bL3Hnx
TLSH
T1FD750115F79800F9E97B923CC8A68916D672B84D0764E7DF03A84E661F637E24E3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 10b5d5e087fd82873a0d41a5286aec4c33383bf38a827379ddd86c14cc4e474d
MD5 6a8036fab36f9cc1d34b7e492a856959
SHA1 3062cf70b3e7bb9808c68ce855a32908ca0a0b14
SHA512 4178acf1cfa55c277baceeaed57c0aceafd96e73be0dfe8c8bae339383e54aaf8825f19bc91f859391377c968fc5bf172aa986b7fc35d344681983c1c600ed95
SSDEEP 12288:QpFtuOCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:5OJNyBo4kx929bL3Hnx
TLSH
T14655021A369C20F9E579767C9986820DC731BC560B2257EF46A080BE4FB7FF85C35A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1506c19da3f800365fb3a4b5a32a99cffc2089cab7d7d8b0a8fb1f0a7ee80ab9
MD5 045982b44a8dbcbb824cce306dbf3a2d
SHA1 92ea948782adf6187e218e3fc849d837411e9ff0
SHA512 b96c7163ec08895f3d20d63ba1618c752c308bb889f3ef33be5e598d47223446fed127f9490705baa9022de3fa6ba5bdf40c2ffc089b207157ecd922e2fda0b9
SSDEEP 24576:x7NM9YmZqmWMUkPjZM48Mv6bEhsMNyBo4kx929bL3Hnx:x7cBWMpPjN8DbEhcB+kn3Hnx
TLSH
T15B65AE2E6BAC81E5D477D13DC9A28205F6B2B4611B318ACF5162833E6F37AF44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 c8267dc71bdcfbdcf094a888ed2f75cbd72ebd25c716f2406f7adccbb7d317ba
MD5 0a384f9e631048a56660fa28ffc5e08f
SHA1 968b8118457612c9ab554ce9d6dfa80130eab6fb
SHA512 9af7983eb40fbbfa59b1fe9bd8c81321f18975e752f22380d5e50a6db374aff4552dd82382c9dd31c5bf4efdd56a1e53512ae2af6db48a5ceb7436439150bfb4
SSDEEP 24576:NW6BApg2YuyuNDYTabvcRvNYf8km1CNyBo4kx929bL3Hnx:NF2YuHNETovcvNYf8km3B+kn3Hnx
TLSH
T16F858E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 56fbc12c93000237eb47638309e53058006280864232ad7c00217b8a0a6bbb6b
MD5 5291d9c4c04a2dd5119c60102edc8b4a
SHA1 d1ad0176c82813c2177f744208dbc36bea13fc5a
SHA512 4178bd29b84f09141c64c6aec4f6cfb3b1069e68df78c7024334213fe4c598ad26247c5be7d61ce99f82c6f1b89cc37bd938aae23cb9e51f474587df91dc41c3
SSDEEP 24576:/AFs06+OmlfkNXEbTo9NyBo4kx929bL3Hnx:IFs060lwXutB+kn3Hnx
TLSH
T14365BF2F62AC00D5E07ED17D8997C91AF6B1746707255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 4b48fa66d8ccc47d80b0f2fb60a5cbf7b5e5113eef5b1cd18561a8e0c9fbbd98
MD5 d2190510507eec74146afc2cd799bef8
SHA1 7f1053313fe8df6f2b89ad15f2aab981de4a14ed
SHA512 4db333ef2622f315adcf667b887e8a420ba1cb2d02dddcafa13cf0b6e3795eb21d48c2d6341c1193cc35df9fc77710e6fe1d640b00e8df6f9e33038c46b4b918
SSDEEP 12288:7CJnJ5D3VkrDzxXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:2JnJ5D3WXGNyBo4kx929bL3Hnx
TLSH
T1C975D02DD2A810F8E4B7D2B4815A1755FE72386D2F226ACB6874D4353F12FE09A79F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4069f254ff3cd86491849b3b1d97e3e016c7d05f3e5d4e1abc2644b23e657d30
MD5 444fdf9ff785a6626cc232618b0c5d9c
SHA1 ae7e9f2a6eabee473102488059e995d0d1b0bdcd
SHA512 62dd990a468a88377ee2b429ed5e5bd37fad1e995d75c2f5edc1032beaf18427561a5242d3b891318ddfc540b8a048e5321bb0782fd42af1d4b144a77de5f0f3
SSDEEP 24576:kEPohm6/7IIXdwcXrif7qQncjlP65i3Vu7NyBo4kx929bL3Hnx:ro06DIKdwc+eQnSt65aV7B+kn3Hnx
TLSH
T128955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 8db6f11a1977e4138841f31cfe978fa103858a5c58330420d453856afed99260
MD5 67f65528799df9eb202ee81beaddfa9b
SHA1 5c6f2820989eea1a9415ca374fe86fde61cb78cb
SHA512 2581301893872cf08c4cd1ec53ab5bea21c3cbf888a55acfc1ccfbdf269cdf435d29b154522cdcfd25d2b83e6ada5922728152c305cda204adba0927f0b5388c
SSDEEP 12288:XEP3RllLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:cl6NyBo4kx929bL3Hnx
TLSH
T17D55122E279C70F9E13A717C94918104C732F4651B5267EF9AA2C17E4E7BEE61E38B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 8d6a197945bba636660830f6c8179fa61e0827e52dbdf5132c9872b8b9b11455
MD5 6439a8190555e484aadd926a39901544
SHA1 900d1de0952c0200a38834069aa9ba7bd4dc00fc
SHA512 b71f999ca5a9f6fa7f93f5921dbf8cd120be22dbf874e481aedc30f1e5b99131118b41e0a5f20416c2bc4944d89374009a96e95fa9cdecf648042b5428549168
SSDEEP 12288:ljkycLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lIyDNyBo4kx929bL3Hnx
TLSH
T139552205638C61A9F6B92A3899678194CD34BC101F2193DFA591E93F5F7AFE19D30B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 a6951b2b8d68a72203dee5ddf2dbda12778ccbbd0dc827ce2e19fe3ee6ce8658
MD5 a3e0a8ec99715c09a37acba1ee01d3e0
SHA1 485a4ef57acab532da7c1e8b5c249cf038a59aa6
SHA512 07a88fc9bb1736a6fa3c832f8431fe23039ff90317d721b67bd59885301faaca7839fc60941d0fde3d648991de02eb68fc036d4b0d64cd12f3fabf4b43503585
SSDEEP 12288:EaSLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:d5NyBo4kx929bL3Hnx
TLSH
T100452315161C327AFA3D3FB0641A8554C830BC4E1F51A6EFEEA2D8778ABDED25A31503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 90c1b9d2c764d9efc99187611cfe6ecba9cba21bea9d98297141fd29dbedbabb
MD5 2f17af91d2eb991ee442e1c8de1badd8
SHA1 d643b04962260bd78707a688255655172c3405a9
SHA512 ac974d2169320019526c8b858a1d8c85c3e1a30816aecf2cae1afa1421e3fde4c1c8c1017e9b5f8375d09bc2bce307d47c696ffcb887a77dbd2325469cff43ad
SSDEEP 12288:3LQZb3C97GYnZMv5zBcKY97MD3fLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxfJ:bQ9MxZKdcz97w3kNyBo4kx929bL3Hnx
TLSH
T10B558C2DABE9059AE177D27595A240C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 5fdd7e5e9ee4ea8d1c27b72e8f357848320e4c4add5a089f7b03ee4114e608e6
MD5 bd1b1d4492eb65d561f095aec1583dee
SHA1 7ccf50a9a14b1db78d31b3916653705e8697b3cd
SHA512 427506d81b017c0459b907ce1b78e5d607323bf2853e5bb908fc4997c8134bbf0b99ae88c37af8374f3d8c58008fc163984cd861e5250bf2a58595caf2685245
SSDEEP 12288:ZyoKo29Rple9pYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ZyocfApHNyBo4kx929bL3Hnx
TLSH
T17165F01FBB6D40A2E176913C88858245E773B4341B6253CBA691C73E4F77AE9BD34B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9775e01751ba9a78ad0ed3c07a2532ba4f92f175af7b80b0b16b6976c2380dd5
MD5 1db01ee117d4f4352f3733b15f3cc9ef
SHA1 fcc533190de5d0e5ba101b0ff9619dca1c3a3d20
SHA512 852323c5bb11a60e6ac6fb3991e50342021a7e92818dcf1ac00962ca759025309754cceef5019a397e36acea38c982cf397aa69a23ae52e475e0dea1d5ae3530
SSDEEP 49152:BWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKoB+kn3Hnx:50zuNIY+k
TLSH
T1B2A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 daf0518eb70aface6519dc95ebcd80db5bddad0832f840af66758a8d659c8e7a
MD5 e56ea4d807f1332db62acc4f6208b942
SHA1 ba34e88a626f8cbf27c417c98bbbe065a95796b7
SHA512 de96d47e8d4b30636037fc074cd98e2b1e53eed8e4c3b1ac4e11631eafc3dc5855fc58ae2f9f6b25a441eadbfcfb97ea838ab499e9fb12a1e19a6997dd7e6239
SSDEEP 24576:G1QT7EcpfxR+N5AWAz3ooiYujMqb6NyBo4kx929bL3Hnx:LTDxR+N5YzT4jMOB+kn3Hnx
TLSH
T17555B02EA7FC15E9D1BE85789A23C512FA727811033193CB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 0ec0d8531a37a6af3770f1045bc2ee97e651710615a5ba90d8f32dcfd1cb5e82
MD5 af2f15b8f035c7da333a9e359f899d89
SHA1 47c345f80cddd455bbf47f2ec227b39beb8c27e0
SHA512 890154e6daf28141757767f99715d4538f010c4bf51d5ef7ac53f8f40b25cdc728630820959a94c42a9a15afce868565713aed09b0417e81cd4517f33795b802
SSDEEP 24576:4TMdOz0FFS+tmSL+NyBo4kx929bL3Hnx:Q0K+tmSL1B+kn3Hnx
TLSH
T1B265F13E636D14F5F57FD27C96438906E97278660321A6DB0690C07A2F6BFE43A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 4fe9e363c1b5b6a1902b1ae98d1927c8869095e8c3c8738f9ee42474fa2df7fd
MD5 2120caf169718a36eba326a269a48852
SHA1 518d1128ff82ac7bdc534a05e95e196bb718352d
SHA512 a40ea214291810c16c69f8176920949b169b602080155f7392a1e6c090f5ecfb11bd6273f9a513c195c0b395be637f83536fad9d0fab2efe02060b9db921b591
SSDEEP 12288:Z49mLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:ylNyBo4kx929bL3Hnx
TLSH
T12A55120913DC30E9F57A66749A2A4154C930BC6A1B2167FF79E1C87F4F7AAD18A34B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/728-208-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/728-214-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/728-382-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1028-76-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1028-534-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1028-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1028-361-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1368-218-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1368-224-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1368-383-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1496-28-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1496-432-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/1496-20-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1496-26-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/1820-15-0x0000000002B40000-0x0000000002BC5000-memory.dmp

Download

memory/1820-1-0x00000000022A0000-0x0000000002307000-memory.dmp

Download

memory/1820-8-0x0000000002B40000-0x0000000002BC5000-memory.dmp

Download

memory/1820-0-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1820-14-0x00000000022A0000-0x0000000002307000-memory.dmp

Download

memory/1820-386-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1820-66-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1860-501-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1860-34-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1860-35-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/1860-43-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/2248-58-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2248-67-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2248-64-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2248-533-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2332-244-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2332-238-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2332-394-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3212-170-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3212-164-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3212-379-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3340-175-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3340-380-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3340-181-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3480-395-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3480-647-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3480-515-0x000000000D9C0000-0x000000000D9C8000-memory.dmp

Download

memory/3480-255-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3480-279-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/3480-263-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/3480-297-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/3824-191-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3824-185-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3824-381-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4372-133-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4372-366-0x0000000140000000-0x0000000140133000-memory.dmp

Download

memory/4372-139-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4652-160-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4652-375-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/4652-154-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4740-365-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/4848-97-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4848-396-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/4848-103-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4856-434-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/4856-368-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4856-143-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/4856-437-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4856-149-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/4968-114-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4968-108-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4968-397-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/5092-234-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5092-228-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/5092-393-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5352-398-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5352-124-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5812-53-0x0000000000EC0000-0x0000000000F20000-memory.dmp

Download

memory/5812-81-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5812-78-0x0000000000EC0000-0x0000000000F20000-memory.dmp

Download

memory/5812-46-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5812-47-0x0000000000EC0000-0x0000000000F20000-memory.dmp

Download

memory/5812-54-0x0000000000EC0000-0x0000000000F20000-memory.dmp

Download

memory/5932-83-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5932-93-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5932-89-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5932-95-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/5948-526-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-524-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-531-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-530-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-529-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-528-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-527-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-517-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-525-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-532-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-523-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-522-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-521-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-520-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-519-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/5948-518-0x000001534CFB0000-0x000001534CFC0000-memory.dmp

Download

memory/6136-201-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/6136-195-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/6136-204-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/6136-206-0x0000000140000000-0x00000001401C0000-memory.dmp

Download