Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 12:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe
- Size 1.4MB
- Sample261102-n7n2laszgv
- SHA256 12e64343c6bb6037542c4c17aefef33a495d42337939f48d3ced4557f26a858a
- MD5 ac296e423e237adde1f4ef5ef45e6b59
- SHA1 12398e1957fb377e78caf7743a5d5292a043ab1f
- SHA512 8f0dd4f759dd9c3d3c3684e7d7de94cfed34bcf43ce3bd4e411ea2ddc32ae56aba1a6aa4adab76e101a94de7814370c7a9d4d8ae91906508d782b25062cc50a7
- SSDEEP 24576:FZhtWw61OPgBpRM3Rt1lBAnWdCN/j2GLl3iFSE33b9:FZhto1KgBpR0lAZN/j2U4FH
- TLSH T11665CF503BC0C136C1A1317286EADB745A66FC604F39ABCBAA503B3F5F365C2597531A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 1116 alg.exe 4288 DiagnosticsHub.StandardCollector.Service.exe 1100 fxssvc.exe 1948 elevation_service.exe 5028 elevation_service.exe 4644 maintenanceservice.exe 3316 msdtc.exe 320 OSE.EXE 2284 PerceptionSimulationService.exe 4412 perfhost.exe 832 locator.exe 2660 SensorDataService.exe 4824 snmptrap.exe 632 spectrum.exe 4324 ssh-agent.exe 1436 TieringEngineService.exe 4952 AgentService.exe 5096 vds.exe 1708 vssvc.exe 2680 wbengine.exe 2928 WmiApSrv.exe 2352 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\System32\vds.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\System32\alg.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\cbdd239a60f3a3fa.bin alg.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
description ioc Process File opened (read-only) \??\PhysicalDrive0 SearchIndexer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname alg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain alg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3673412c26add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000061b0712c26add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060b82312c26add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a7b2812c26add01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a2a5812c26add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2642919c26add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024d98712c26add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009aa22f12c26add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 652 Process not Found 652 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe Token: SeAuditPrivilege 1100 fxssvc.exe Token: SeRestorePrivilege 1436 TieringEngineService.exe Token: SeManageVolumePrivilege 1436 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4952 AgentService.exe Token: SeBackupPrivilege 1708 vssvc.exe Token: SeRestorePrivilege 1708 vssvc.exe Token: SeAuditPrivilege 1708 vssvc.exe Token: SeBackupPrivilege 2680 wbengine.exe Token: SeRestorePrivilege 2680 wbengine.exe Token: SeSecurityPrivilege 2680 wbengine.exe Token: 33 2352 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2352 SearchIndexer.exe Token: SeDebugPrivilege 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe Token: SeDebugPrivilege 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe Token: SeDebugPrivilege 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe Token: SeDebugPrivilege 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe Token: SeDebugPrivilege 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe Token: SeDebugPrivilege 1116 alg.exe Token: SeDebugPrivilege 1116 alg.exe Token: SeDebugPrivilege 1116 alg.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe 2168 2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2352 wrote to memory of 4624 2352 SearchIndexer.exe 111 PID 2352 wrote to memory of 4364 2352 SearchIndexer.exe 112 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_ac296e423e237adde1f4ef5ef45e6b59_elex_emotet_magniber_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2168
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:4288
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1300
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1100
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1948
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5028
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4644
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3316
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:320
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2284
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:4412
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:832
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2660
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4824
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:632
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4324
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:5092
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:5096
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2928
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4624
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:4364
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 f9b6fc2fc60bf9cf4ddaf202416af610ed807db65c2769507b3a193def205586
- MD5 4a43d7c309ecfac46192071204582f64
- SHA1 c2ba56189d1f69ee6057bafe5ecc6d241f65fb93
- SHA512 7df055c3005dd629049eb967aa237fe71dee5f45bb504eaf17876aa8e95797b4a019caa54e476f75f00320f1d2b20db1a2f16af4455d4a283309ed5c824cf1ca
- SSDEEP 49152:ab+632BuPkFKRrdE6ohvstBhuXjfS4LWxnQN/j2U4FH:M3q6sjBFj2jF
- TLSH T1C7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 8bff771ccc3d4111397fe8c79c56ba83e3c3b6ad91a7249dfccc0fc9f257a607
- MD5 513e051f6ed022f2622c22f513ebbcd5
- SHA1 d293ce380caa09de81b93ab1354df7cde05ac542
- SHA512 bde15e741d41b29c666b6c0ee3a754131d107f6988c3c8a84cafea08737f74950f4db5c7776bf8485269cedce5339a45458d1264b31a53774c2ea25baf5f1ae7
- SSDEEP 12288:41XLsswWkxy2lRq2czAcJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+XYfDtczAUdCN/j2GLl3iFSE33b9
- TLSH T1E865F128B7E049F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 461484e7d95616107aeb73eac56a7707a7a6cf6bd32e9babf90affe97d88e3ea
- MD5 d108db197a3895c79f876cbb1014ceca
- SHA1 83bd6dcbb7f765a8373804f3509c519be5c7e604
- SHA512 24b88925752ccc9a53e08f74d347ffeb34040cdf6e8c6eae2f91d68d7f92ebf4a443bba984a97cd8aa7ede030c3bb380bfdc54be0c51a9cb783782ef18accc2d
- SSDEEP 24576:T0Le5ji0hmxxrMrdCN/j2GLl3iFSE33b9:TPji0AjtN/j2U4FH
- TLSH T1DC859E26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 ed5ef840b1980340a1a5eb00cff0c5aeb17dc50b7a19ce23ea3e74254a63c7d4
- MD5 4bc878a7d11700101b780debe39d0a77
- SHA1 853fc87483d825dcc920d5cf9f83f97332f82e37
- SHA512 acd28a1056dfdf105427096305ca881e9bb90b608b68aaf85d66eb37c95c558bf527677870694acbce24e5de41b30c72b3530cd236eed551bfa987846d589360
- SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWn6q8wyuNdCN/j2GLl3iFSE33b9:v/ezSC6vUzPveHjyRN/j2U4FH
- TLSH T141755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 c908fd921846d52cca084f48465228063056bb02116b64d0911736f2421fd613
- MD5 ec0ab3ac054f48f255915de2584a33dc
- SHA1 b81966c86a402fe07fa3aba94c57d10a6769d02e
- SHA512 19a1bfc4dfaa2f17ff600156a01b8a6aa731b797ddf60a3d9e571a3089274c51adcc2aae9d417043fa2615b3e83e064e9dcb7101578a0518c4d54bfecce00fa7
- SSDEEP 24576:iVbqPb88hv/l+YwdCN/j2GLl3iFSE33b9:iVO88hXl+KN/j2U4FH
- TLSH T1D4559E66F5748331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 f4c86901d50b5a9f264e90bb2c6ef98ca9a0e001b38df82fa4070ceb67666388
- MD5 0f157a6bd7bffa116ec8b8b6b734e502
- SHA1 2a248f0ece2ac4d5ef8345d70a1123b1049823ef
- SHA512 daeb7d79ac2bdd9d28815ae2e55041a70f1679eb0dc6f70efcc3476d0488e267f590396e5cc6a6050af29419460c3bd9a3fd51e54dad53f87f4c9b41c086e8a5
- SSDEEP 12288:PLHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PLHdCN/j2GLl3iFSE33b9
- TLSH T10D452360DAA5F565F26F837903ADEE655200EEE8E525884785917BEF117CFECC032063
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 d05d2eefd7446fb004c0dd4ee2af0c6d5dd21e16845c02500d42648cbae99b51
- MD5 982237340b8d5fcfe1b795e3ad5c9f5c
- SHA1 b9d47b2c775d3a7244e37f6648400a4324eab6b5
- SHA512 c208eb9d405764b6b6d78cde279123e8a3950a0041e15b7d379b74e00c08f7cbe9e7a51fa4afc6ede60dd5aa65af8dcc5b84b053c8317a817ae5a5b97744972a
- SSDEEP 12288:aeBNUbTVO86UoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:aJIUIdCN/j2GLl3iFSE33b9
- TLSH T1EE65CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 2d512328c5f4c256da719590f977ef8ff6a5b9c7a995b5278973d2f3b6e33cc1
- MD5 4a01fe275376209c96a1a88e3e8df71f
- SHA1 e966957c66b980a13ac1609806b9e71acd80ec11
- SHA512 266a08ad046aa29c2a75e7e62a0b549f774d9efd20ed300b142b57996712e58ce091a5a77f864c6ed6a0cff96148eecb61cf99998bb89099ed60484b2f6be11c
- SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THi:EQvGAdlCEL8c/DRNw5Cij2jF
- TLSH T192267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 917f676170308c38608eb001e4cf29061bc616c52d857c6288c702d75521fe5f
- MD5 221b7ba3409421bdd2dac0d9753da61d
- SHA1 7057aeb14cbf246a2edf962163afb06706e7a242
- SHA512 9afd67de2398103692eeb66a45005e9e9b744aa38f4e0f46557319c2a2450ffdde903da1ec1a4496839b1cad0f81bb54cf4f433d0aae09b60b993475baec9529
- SSDEEP 12288:+AwSfxL/2Dc3RDLLmt0LDQewsAj2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:j0ewsAj6dCN/j2GLl3iFSE33b9
- TLSH T15775E031FE74E036C2BF0DB61B36D716142CBA608B6119C3E3E84E9E59346D26376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 5cffe8ae4737900b63ec9f8d6e07eaf7dc205b040ae0f56160c00462bc1d4697
- MD5 c28c3bbc27e864d556e25e6b825f047b
- SHA1 dce26c513c41692ce1f771bdb519637e859937b5
- SHA512 8c76deb8e7dbc520e8995382cb40de34464b2e3880da91abe85c81385c48cb5bfc85de8e88408450287ce7752cc984aec0505e88f5f097b874267e21aa789978
- SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHL8F:yUEtQevvqc2W1cpV2tI32L
- TLSH T16E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 e0dba1c2b54d5c37f3238f6f5f95ee34c841138440ed9413fa1273390192f7cc
- MD5 e89bc3b167ef47a16cc1494c0ad9e8df
- SHA1 63dfa48c75450b05f886a70b816fc17efd20bd66
- SHA512 679675db2f12dfc4897e440929983bc6fa5a54d1568d916776b3b1782c1892b1326489d6836189a4c65299a0714439689c80fb694987019f3d30acaee2faf758
- SSDEEP 49152:9CbRquA/m2yL5zTfFiV+XenmE3/z9N/j2U4FH:6oquVjnmuj2jF
- TLSH T190D58D0976B8C2E4D1F6C77886A2C647F37178158B3197EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 309dfcfd652b328e1dc3295fb8fe6b2043f9c4a900d9a80a13db9d627aecac3a
- MD5 c84ce139b29cf0d4222821658c002e04
- SHA1 8924a818bd5605d95288f52bec664910fba42b11
- SHA512 cd121a1cfac1514d1bf6a260ecfb87aac49cc5122acdf4cd8aeb7790e1368d160334c46b83010d7fc243f15de596e2fec89276f7393a1d2f1bc9d4b118564556
- SSDEEP 24576:pAhGL3IFoiwtA5l7S53BdCN/j2GLl3iFSE33b9:pAMUFoiq5mN/j2U4FH
- TLSH T18535AD80EBF955D4F5B3AAB899B69571EA72BCA95E31C20F1150D21F0E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 61fa73af33e54fdffcfb2404625459c20e0e37e65e2da492af01a8d7a87c763b
- MD5 98b3c9ae8942bb758b7c64711f3bfb21
- SHA1 112f45004f5e1b359854cd6a19865a92569cf957
- SHA512 df43f4306226cddd1439fe54feeb61c1318b0ee8429b8ff91a66ee2a2ac4315770dc5b8f63533f9832c9234375ee86d00c2ee52c1b08d7737207004e7d44bfe3
- SSDEEP 12288:8mw5HEjsChNVBFgl0WDm+CpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5wu4OWudCN/j2GLl3iFSE33b9
- TLSH T1D865F14577E41CF9E56782398697C536F7B2BC512A21CB0F03A0C69B6F37361AD2A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 4f468de1ee6d5d1ca0e7e3cb1ecb06aafeb407138e0a9c5d946e6401da0ee946
- MD5 8f2712f485971d506a7f947c8d62fc4e
- SHA1 9d29e9f28164dac2eccb87ceeb1cf79404ff4de8
- SHA512 87a07ff3a8f0125817292e48fe29c331dfabc3cb781a01e801c6d9189da976c0173a30e617ca33f74d01db2caa1bcb58226ac7431fb4c44f73716eb59fd1149c
- SSDEEP 12288:/eZ1IyGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHB:mZuDdCN/j2GLl3iFSE33b9
- TLSH T18755125937E471F9E1A7823C8AE59A05D321B8A5A73243CF025047EA2F36FD59D36332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 369aa81f95774402feb786ed96e13fc2a13695782a22d1fa2891cf299f919bfe
- MD5 decdac72ca144b2a1f3f1d516cc9e008
- SHA1 40adaf84fbed43396ee4fa677cab87ef8a00af7d
- SHA512 64febe9502aa2d8361f7c99fb8dd5c1d27a71fc93f80aa5a889605135df6dce2878f1dac12d6eef42a23c7624b6e0f645a0ea4ed8db36b6c01a40c04b90fe35f
- SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UW:2QRQyi36YOcPbLvw2gAf+PN3Jj2jF
- TLSH T181667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 004dc301a93ea0475483ce8aec752b4d86ec82287ceb8cb875d46b597e4e68a8
- MD5 bb210d1cce6649b26d088fa87f626184
- SHA1 eb52bd1946487331c826db417209a8aed3ebdfd0
- SHA512 6cbbc91bf5f64a1053e84e307c784710a1a238e7aaba1866ddb3ebab94a519501d0fd520c7921fed8d8672f4c30715b392599c7662939d2e56632e194a2fc727
- SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UW:oQRQyi36YOcPbLvw2gAf+PN3Jj2jF
- TLSH T1F9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 e8e3cee92a866f401236f6a6060509ed698bba93bcb68d1b13db7e6e2e946ec2
- MD5 fbee09e44a6984dc5dad439e1df7eb62
- SHA1 811c9fa0a65a683b73fdd4ce4812c88a58601ae1
- SHA512 fef7de2410cf9f5dd1ac641e5933cfd87e28e96ac108bfdbceb08720eea3d82d51a843052c7a13ece26b5c0bf14113b61e0e0c2b608125133ec524de7bbe9dd8
- SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0TdCN/j2GLl3iFS+:C68Qg55nhceWu7PNU3/tN/j2U4FH
- TLSH T1D2B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 229f9fab4d8a28397298b571fe595009beca1c9b095898bb2913692007d72dee
- MD5 d76609934acbbdfe61fe3a432c65d5a6
- SHA1 92f401afd48a5aae4a7ba2278682bb05c3a4e019
- SHA512 0c9006e977d82ba3d2df066abccada52a898da4ecc4bef9ad494aef5293f7b85d4f129d9419a3e7789bb560ae180f1bc842922e11ab5b344bcb3868d5faefce8
- SSDEEP 49152:w3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk990:9y5112gYy5azzVvt69nLKnhZYj2jF
- TLSH T16D168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 8a81772eb93d6e11bf468a8c75fba40da0adf2a24c833af9337f5f9ce9ff7622
- MD5 21a6816623255bad508a042c2efdd294
- SHA1 79f05ab2a14182359b3a32226b826e1c5415b6ab
- SHA512 f739a8568703c1288b54b97c70576205c498e53517df8205e461389e3a1ac2fb56f04f88d37ae8d2f958537d2fa0c6ac754192967852ce15d42cb04a8d6699ec
- SSDEEP 49152:bB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glPN/j2U4FH:Nu6Jmdxd2dRj2jF
- TLSH T1F6D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 43c8ea50f79e64c69cb0de013a9b7758ab9f6d0a1397e7526944e25d7741efb0
- MD5 26876b63068ebdf69289d3e1ce01571f
- SHA1 1638df175a1d8302d78d41d1ccf5ccd30dfbf991
- SHA512 dff08d84dbe8145d226c6284ae0eafb3be5a5678996edc7cfd438a1fc4645a218a0f07a93f26ab88a979188eaa618deceaae5eac67f6ec55274394a2d996a82d
- SSDEEP 49152:+1hpsNoJpF1A63U44CwH7R4xTN/j2U4FH:+mifPWRuj2jF
- TLSH T11BB5BD13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 156e6e668e65a97b5e3fccdb6a12304ce0090d5faea19dc95d15f523553979a3
- MD5 fa57ce8f3f2b68b016e77a7393e8a4fb
- SHA1 0967578bab1a670a58294af2de025b2c7a5426cc
- SHA512 086daba7851f50ede1b01ed5480d0c17ae18a7a6e9be6c7a9631b21dc0b950d72a577b544120f451adfead795f13bc5300dc807a8ee1bd9240d7ac9c22c4f2bb
- SSDEEP 49152:rSuZQIY0Be2KcRVtOnks6NMHqAN/j2U4FH:55dKii618j2jF
- TLSH T1D1C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 11e480c9756cdc357209532f3448ae8a9fcc13b05fd6c5bc70d1de37a3bf076a
- MD5 a40a5d4ad60f7ea11ec56b9028e91bb9
- SHA1 84e817131db7e891bb5d2be6f671b7319ad8b642
- SHA512 9f67de64161f80175400d77d86ddcf087724a97f2c97a1f33f1f641a290e516977d01b07c468c69721f9ce446c10c9abedcc04bc3628b4a18811b428723bbfef
- SSDEEP 49152:chtSn8EApI0fig3giDn0AP5w/N/j2U4FH:dX2imphaj2jF
- TLSH T17D95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 85fe9910d9f4508263b7211fd60767622af50221d612ce1bcee41a9fc75eadef
- MD5 31e05a4c215e58310a1abc82964b8314
- SHA1 7667b2da712e88d549324f27fc12d2879f70f331
- SHA512 7b3ed1e301cbd1a8b75df948d1d9479ebc6eb155f33ad71257335df96faaa4230f262066230c160f45ed0a8a1ec1e3f1f928b022da60ff64c946146610e43b32
- SSDEEP 12288:1PJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:1fdCN/j2GLl3iFSE33b9
- TLSH T10B452364E9F6F669F15BC37D43A9DB555200FEE8F6264487828116EB237CFEC8032062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 b27cac30642c02980737da8cd2635c294f6a5bf6a0769f94fd6d138093c7fc1c
- MD5 96faabe4e0731884bc6d4b99d916b994
- SHA1 69fba1fcb6c80ea4091765952fef13a4d9b166ee
- SHA512 9c92bb9d70389c04f2a42ac78e30221524ee0af10e7c5d16833499ac4e77ab044d3e0d6cc9903ce413d6840cc00d8c108c7d6888624576f5e9df73617ea72779
- SSDEEP 12288:ZKJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:Z2dCN/j2GLl3iFSE33b9
- TLSH T18C452364E9F6F665F15AC37D43A9DB555200FEF8F622448782811AEB233CFEC8032462
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 b3012f8ebab18593ba805eecce3c8e358be597032574710d9bf43c88d06ae8ec
- MD5 e9477a11846f75d2f5a520cb4fc8fba5
- SHA1 4e32aa0804c597ff18b32cfd66d5d387e40799ef
- SHA512 b45431ab0a4e92fb6f7a4a8740bd0950c9e47d71799534b605562b0778fa319d14702a2e22c8fb06779a1a8543e2cfa02ab9c005bc79fa814fbf0386a89068f7
- SSDEEP 12288:3wJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3AdCN/j2GLl3iFSE33b9
- TLSH T1FA452364E9F6F659F15AC37D43A99B555200FEE8F622448786C116EB237CFEC80324A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 f675030065e459488947e79a47b4fd806df408dd54ef3a4a05b3d6939cb6a345
- MD5 ffc2732a759e6da8fdc87ee8fb312a8e
- SHA1 af960e8d99b4cd68dbcb39b9a8118d03c3c7120d
- SHA512 b072f3eb230d5deb162950b47ee7f7fd42a1677ca59843240afbbc575e9cd598ae97fc1368447dffc506ae0defc53877824a7d68578a465b18cfbd7ee49fc1a2
- SSDEEP 12288:vVlJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3dCN/j2GLl3iFSE33b9
- TLSH T127452360ABF5A1D5E06BC37D83B5DA11E320FDE8E732458F87401AEB1B74BE89431562
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 c5298f24ef21d165c0354fc85199cda135ff74b0734b76c878e47efe23baf115
- MD5 99b8c371ae511aa9e6102348b84832a0
- SHA1 e95f003987d2921fbc4dd348984ddf413cc717ca
- SHA512 632e112332ba707eeff70594d26eb9d2fd26dab599fda1fdce42a634243fa44d8b4fdcf8529fcd987c9605116312d894023593ce8c8d9566f40419d65910b68d
- SSDEEP 12288:39JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3pdCN/j2GLl3iFSE33b9
- TLSH T127452364E9F6F665F15EC37D43A99B555200FEE8F622448786C116EB237CFEC80324A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 0324cd2efe1d91d3b67d5f779a84bb82076e1fa266e05390e3d1d4e18725e67f
- MD5 266ffe05e9c63f1ceab5efe457613091
- SHA1 45ba0078b3ee284f1a0ba86ab8aa16ea5efb7a4b
- SHA512 57e5efe8c69e42e49ef3408a108672cc3f3068e047358d750533bb5778ae34f1d104646fcae28a65d7f4149adbc0e55b5620d030e6a453a2b4c5bfae7a1a5531
- SSDEEP 12288:3eJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3SdCN/j2GLl3iFSE33b9
- TLSH T19D452364E9F6F669F15BC37943A99B555200FEF8F6224447828156EB233CFEC80320A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 5c2b5aa7fc712c1e8ccf149bad8d4a3045bd46ebf78cc636fbf6e5d5c2193137
- MD5 ce75aa4130768b322aedb38cbb71379b
- SHA1 c9e72f1c40e8938aac48b3ef93622fdc66484b88
- SHA512 ddae0225ecef7d2274e1851d729f6551861e8bdc03e47f23b741e0e2b8a068231ca7036a2f14d8ad185a2cbab9d2650aef155c25353b28ce48d37c1b5980d24a
- SSDEEP 12288:4iJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4+dCN/j2GLl3iFSE33b9
- TLSH T134452364E9F6F669F15AC37D43A89B555200FEF8F6224447868156EB237CFEC80324A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 48ac74880a995c594f9a4e59a9f7ea81a1d7b76d8be0856485d0f7dac5048b73
- MD5 e69cd35338dd2f79142945ee025d7a1c
- SHA1 b49b9537318a1881d743a9d7f8c1b563231cc1e9
- SHA512 ab93eef775765fcc67df63ac53319926762b26ec62dcbd5bb8bd4a13201d88d3d6ba3faafe9ae427f1fc6c53e7d9bfd3296a18b24dc20ff4dea76ce86542cc6f
- SSDEEP 12288:riZwbVzzFEoS2cPvyqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WZMRzFVSOWdCN/j2GLl3iFSE33b9
- TLSH T1E36502A4B3A058F8EC67823EC9658906D271BC594770C60F03E4366B5F377A15C3EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 31aef14e324f3ce70cf9ad679eed8c11d1fc15d9a96aa428d9e4d12d1ce8b79d
- MD5 ee5d2dd9492020afc70264f35b6df867
- SHA1 8dbf35f2237396256ac5e5f065a27c938bcfa06d
- SHA512 19a66f92235bb8ced5d575c2e0bd005fc7e7682c5c5fc5f6a7a090a922ee1087ecbf9fd52c30639693ccb3d38c5774bf03aa810cfbe77f8e810864a44f8dfcb7
- SSDEEP 12288:xrJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xzdCN/j2GLl3iFSE33b9
- TLSH T132452364E9F6F665F15AC37D43A99B555200FEECF622448786815AEB237CFEC8032062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 17c89f30ecd32e4f504e025851c8ad97b0611bec8590507330553aad5b844f51
- MD5 4f8448c5b3d6d05a47a00a6f3d72ac15
- SHA1 fbba58c762c734a7db45dca360a71acef379c489
- SHA512 56f5d24f3a656bc023c944da642d5e857d9aa9bc918487aeca3df75940f11a3f9617ef8866b5fc714437329f5ea173fda58b59383dea324d0487e05ace18516c
- SSDEEP 12288:BXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:B3dCN/j2GLl3iFSE33b9
- TLSH T1AB452364E9F5F665F15AC37D43A99B555200FFECF622448786815AEB233CFEC8032062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 c9bbd08ed2a63226ed925f47427a74064addf48db5b4e90ed4b42e64a16f8820
- MD5 97bbfb7ec322d95632251a497afe0465
- SHA1 2dcf907d3e0712ce00c0751b3043202c0d69b2a2
- SHA512 2f6bd011a553c81633025083c6b108d6834162bd4eb07a1b3c613faca90523af3784130fb817340724aae4a6b99cd975c1048c2dc645ff95d4afe12fe0d4278f
- SSDEEP 12288:eyPz5L8GJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DzyqdCN/j2GLl3iFSE33b9
- TLSH T1BE550217B7A131F9D177823889A65A01F331B87597208A9F439007BB2F377E49D3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 c735e8d7e16cd9868dfa2b6f6102b61a3805807f9c42828543b76bda38f384d1
- MD5 6b4dc72417ad600a24e3841b72894501
- SHA1 694dad68d227cadb347f8667d84fbed8e74d20a6
- SHA512 5ec9dca55b7e07beb70e1c470a367325092ac9dcecadd31cb1685ca50808141bfded6002033622a3dd991896b2ff6ce74018edafd713022f12456fdb9ed0e7e3
- SSDEEP 12288:RrJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:RzdCN/j2GLl3iFSE33b9
- TLSH T1C0452364E9F6F669F15AC37D43A99B555200FEFCF6224487868116EB637CFEC8032062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 f8e0ae686e133fd2988ba66f3521a5b8423547db225f44902e3b247e23c4d155
- MD5 b1c5bab11db2a2fcdb034abb62bc192e
- SHA1 18ca632b91f13f5db02c0382260608c8d58c1bdc
- SHA512 0787e0ed3f9c34d1ea66cc28836cb5a23fe027cb1b226eeef25ecba1dcdeabd13cefcb2bdf7eae6a86b21ac3d57ec616bf48c5c72de8e9aef1a1f5c465af62bc
- SSDEEP 12288:ZrJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ZzdCN/j2GLl3iFSE33b9
- TLSH T107452364E9F6F669F15AC37D43A99B555200FEFCF6224487868156EB237CFEC8032062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.3MB
- SHA256 6601b0ac98a7b8839a667b374b4020192e0a3fa47b0d30cad72685219dc665b7
- MD5 a0d1841fdc49398bb7aac28770f451a1
- SHA1 9477df2b76835b12d1d2aa134546967d6c77ee79
- SHA512 3cfc3f10852a8ddc34ed6fad18178cf912965dd77d4502e54b40e3bad3e443f1241181883d8e5db489531a5abcfe870599107413780cd5ab52942feb78de20b7
- SSDEEP 12288:NyPz5L8GJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:kzyqdCN/j2GLl3iFSE33b9
- TLSH T14B550217B7A131F9D177823889A65A01F331B87597208A9F439007BB2F377E49D3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 fe4e008d7f25fe2d242271834a1c6d29c8e7ceb490f24b727ea8a0e8adbad464
- MD5 3733dc728827a4d58ca9ec00661f22fe
- SHA1 2b1d44f3480bc52370db60931bb64da67497e39f
- SHA512 a0e1ffbb564b20353c2978240f92985b984c91616f9fbb7c17ae0c0917e665571f0268dd241aed29f738b3cd53617ac593b2d1a9046fa744835ff88cf4f26904
- SSDEEP 24576:HcP4mcvIjkGOxhKP2l71SNKbrh/8KB7dCN/j2GLl3iFSE33b9:8P4m4IpOO67N8KSN/j2U4FH
- TLSH T15D65BE2DABDC0096D0BB817886658A49FAB1742A1F3286CB1160937D3F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 ba2d0307870ccc972ac504d1f209ebf1f9a062f51e3b8ba327e210ae5cd8c2d7
- MD5 9827d9871b8b4c0d7665b6ec12568485
- SHA1 bb08f9f46ebf14cec99a5c9322895208e14c4f21
- SHA512 f662bd201f1c198a5c4dd5f8f4a55d7ee263865b2254e550dd3b1f191c1577d4a1adac73d2a1a21d98636e0f35ffb754797f32baca4c17b935679ab710e7fe26
- SSDEEP 12288:YbsfbJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:/DdCN/j2GLl3iFSE33b9
- TLSH T187550119D2A452E8D06E9279C7558A41B323BCA493E1C3CB43C0F5BE1F39AD49DFA613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 9a4ff0eea35c7c6db6e10b9ec76f2042fa75d657df0b114462614bbde3790e70
- MD5 666b0841894affd48342d5e53aed893d
- SHA1 36fadd01e4cda7d22a5d813a403844236edf708d
- SHA512 98312db3b480250a957f8e754e8c554c02ebc0aab73a163aeaa57ca587d9b002b03432491fc50fc6bde8fc65bdcb5ca444a12429ce3eb247b2d87b3a68f89aa2
- SSDEEP 12288:37JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3jdCN/j2GLl3iFSE33b9
- TLSH T17F452364D7E9F656F17F83780369DA256200FEF8EF258487858116EB1278FE8D832523
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 77852629ee25116e4fac20f452756c807ccbb824b78f8741e0429f5424445d43
- MD5 38ea5fe5d51dc3ed2891dbe0bfde5351
- SHA1 adad39173a3405e668f72f24630b1560f1fbb1fd
- SHA512 411187d80d818cc5c3b274798f90de301a6b7ce5fd8764f8132d53120ae72c21d8edfca89e0c50c6ef09cc8ead59600f1b0f0d135afd9c00f4cef9985fda31bd
- SSDEEP 49152:+a0h2GEkuAe73q3pp46zwwQ+N/j2U4FH:+a0hNYG4JwLj2jF
- TLSH T1DA85AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 b5c52a405b6557722f6045ce98dd55eb274569158052d4a8dc26325ba047b7c9
- MD5 d7efd0857fd71f7990c7130454a29091
- SHA1 17047601f587fbb700f42047b4f65d0b7766fae1
- SHA512 dc48b199bed25e35c14a1aaf9a0a801954f5f4c668888df465794230e6063ae2142ee759cac75c8dd0a70908a17d8429abcc65fd2482ab0a330f2ddc397d5bbd
- SSDEEP 12288:HhbHjfX6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:HhbHjPGdCN/j2GLl3iFSE33b9
- TLSH T1C555027D66AC21D9F176D27D86958A06D330FCA4572193DF12C182BE0F3BEE84C36A52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 0f9be181e26967629b8644e19dcb54ef246a25b638b35e12296ad4a79d85a76a
- MD5 e254e99d1472f1bb6c45b37d50b3b249
- SHA1 abeb36d697c531ac88f65a61c12fda5a92fd0d16
- SHA512 aba5dc0fe62c1659cfe13ef2d8288f796dfff0351dadbad595b6ca9f61ae3ecf0a7d89019fa477cb54a920d46e093fea69ce8ff1d7ef50b4acaa3aa9a928ad34
- SSDEEP 24576:N3YgnJcRTk4yti+R5dpR/udCN/j2GLl3iFSE33b9:NIgnaTk46ppR/xN/j2U4FH
- TLSH T11045B02DF3B910B9D4AAD236450147B5FB71782D1F209ACB0170C538AF1AEE89E35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 e7fa95ac23a155147f719af8c267a068cef77999202a7412e047f2f751a76593
- MD5 ce7012bf8e085a79ba05596e4b123a48
- SHA1 3b4244747e71a2d52db0668714dfcdacdea57564
- SHA512 2f9de980f90e6126d76686058c6611a5f8efa90e3026ab488fdc2084f1105d0dcb26b8ed7089f033a2b2b542e403023858085155ac87bda485e02108b4ba69ff
- SSDEEP 12288:7nJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7ndCN/j2GLl3iFSE33b9
- TLSH T1D9452364E6E5F659E16AC37D03A9DB256200FFE8E73644C7858166EB137CFED8032062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 ab2df8b967811f3c77af1103ae96e47733ddf42794ffba59872da165ad226552
- MD5 d719e9de0a0b744f33d8d6a8e3169be0
- SHA1 0252ab7802ab70bed4b1d6efde1a20ff5ff1124f
- SHA512 e4640e6136e87df7f6ebcaa2d950fa8ba953d360558fc9ded458eb725f9c31fd5b98b86efae3ecc44d87b94875c84e784a8c5835fe4b4685ab861fad807cb35b
- SSDEEP 12288:nObfA4LWOsvAYFTcJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:IbL3UTUdCN/j2GLl3iFSE33b9
- TLSH T1EF75F154E7A450F9E96BC23CC5A68A16E271B89C0724D7CF03A84BA61F237E54E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 229ab15d043874dcd26e892dac6341b8f8a14a88a0b75be237cc61aacb09b491
- MD5 28e2f28434f5959d89e97ee8f4b0266b
- SHA1 ba5ce904e44d96228f992e46475806cff84b0b93
- SHA512 330ce43dfe9f00b7cb0452f2e144853712362299ef1b0e8c4199e024f6b375d385b9c38793a1d51b1739a1029494cc2f841ab56c3d8a0d472ea7be732bccd8ed
- SSDEEP 12288:dpFtIOIJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:sOodCN/j2GLl3iFSE33b9
- TLSH T10555022937ED20E5E17A923D86968709D330B8A5572247CF42D081FE1F67FF85C36A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 d620a98b5a8e9b18e10256a25ab764fa79c6b1ddd0439bb0f02b8498ac5fbff2
- MD5 855f50014554bde50fd1bf5034819262
- SHA1 8310f6d8f499cfe08e32e43e23d45a2a574af5c9
- SHA512 75ceed346195ae136aac0178c2b0b5c70f9cda29bd2c8fb4955151db8e31a3ab7339011d08919ca4de2a5b8a5bd88e4dc4e4ff8500fd92f87fd807eb1d6fc875
- SSDEEP 24576:P7NM9YmZqmWMUkPjZM48Mv6bEhszdCN/j2GLl3iFSE33b9:P7cBWMpPjN8DbEhpN/j2U4FH
- TLSH T1C265AE2E6BEC81E5D477D13DC9E28606F6B1B4611B318ACB1152833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 d15ccd89f053401996dfa8f9e241b03299578d39eaba40156d7276915e66fead
- MD5 da816cb9aca393169625fcc85a95ce68
- SHA1 bb0fabc435362efd2342448e3a29cc56181cc87d
- SHA512 70056ecb1bf0fecaee60deaba2fdcc40495eca1b34b103929f7163cf70ee27664e8c0ee044a24b16e78276b281694dec68b4cebccec48f04d553f6140d0a33ab
- SSDEEP 24576:UW6BApg2YuyuNDYTabvcRvNYf8km1VdCN/j2GLl3iFSE33b9:UF2YuHNETovcvNYf8kmQN/j2U4FH
- TLSH T121858E2967ED80A4E0BBD27D45B6D246FAB2B8511B3056CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 6811afbbbef8e21c87a1627b45a8ff1b6ff74197258348acdbbf37b61e13be46
- MD5 9871b0a1e4ab8e88b53dabcb86a40fcd
- SHA1 cacdf5cc0d19e57826a1e61b99b116c32ba1842c
- SHA512 8be61b083c63b3c02488047fe2d1547e73d2f16a6e9c066d5ae0b2f0587e20c88d9f1f51b6ddd2b3957368366a5f8c4a7592f0b801868e2b62ab14fbd27e051a
- SSDEEP 24576:qAFs06+OmlfkNXEbTosdCN/j2GLl3iFSE33b9:zFs060lwXueN/j2U4FH
- TLSH T1B465BF2F62EC00D5D07ED17D8A97C91AF2B1746307255ACB0260867E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 5a11453ddf8a0eab2af2d7ed6d1d512c6707047b49e6d8e2428f3ebbb4b76a73
- MD5 977efb7353ef12381a59dca2203d81e1
- SHA1 71c4cb3b6a6e13f94b0cbb4f6c508c13865d417d
- SHA512 7d53e49d1fcbae52a0fe65971cc816655be6303b9b94e892e031bfb3479c171aff69db80e3a9d725986859ac8b32251343f1b49b232002f018a6fa5ba1f283fd
- SSDEEP 12288:oCJnJ5D3VkrlzxLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dJnJ5D3WtJdCN/j2GLl3iFSE33b9
- TLSH T1BE75D02DD2A810E8E4B7C2B4829A1B56FE71387D2F2269C718B4D5353F12FE09979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 6331250a399af93b7569e1fcfb65ba359bdece362dd89fb5e5bedef3b88beefa
- MD5 75eb08e99b116dd48572390073f8a404
- SHA1 30fce8b08d6ff20185e68a3ee918f697b46ff0bd
- SHA512 c8b6afa90d7afe8cae39c6a3b1d307af44db2064a65b1ca21aed1cc5c21df05630dc6423b6a755e51afa10011e6b6d2144ae7acd88d13ca9fd4ae1e8ec7d5ccb
- SSDEEP 24576:dEPohm6/7IIXdwcXrif7qQncjlP65i3VuudCN/j2GLl3iFSE33b9:qo06DIKdwc+eQnSt65aVsN/j2U4FH
- TLSH T10A956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 ffd3c71192a07b9455009850afeed283dd1d8331ce086f033d32f116ef88b007
- MD5 2ab52e0f70e82a9a8acf965414429ec1
- SHA1 c8baba2a74b8d44ad8ce4ca1351d23134228521d
- SHA512 237056a958e73e806ead772371a9a9f50bd8e1fc5c5f039aad1a833fa0c8f53163ec90f709fb030be07b75670015087ca7a0e087692598488273b530040fb2f3
- SSDEEP 12288:UEP3RrpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PrtdCN/j2GLl3iFSE33b9
- TLSH T1F455126D67ACB0E9E02AC13D82918605D331F4B4AB2217DF42D1C2BE4F37EE95D39A11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 27f71ef7fd18340a32bbeb2d02028ca8148b7e3f60ad23f49449e69f45bbf616
- MD5 80a3a2fc0a3230b826f2c6bf378e842c
- SHA1 9217e2d1eb452fcfa3b2235aeb8bad55d9b0089d
- SHA512 dfdcd3eaa8d7ed5847c726ee3be613fb6d251df196c2e66c89573239768085a583c1d9aecb08a1ad0de0404ff7417030a6b74e05cabd1353fad48753b6b6182d
- SSDEEP 12288:hjkyKJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hIy2dCN/j2GLl3iFSE33b9
- TLSH T143551214A3E4A195E5BA427C86B686659A30FC70EF2146CF41C0E77F6F3AFD49831B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 d9f323866b7a44b357fedfcc9f30b7462b3dc2b887de78f4d2c2d8a493886b15
- MD5 2b56a2d45dfdf57cc9f90fc0a3db9400
- SHA1 20ed61016b047de301ced9a6fd1f4e23bae8c040
- SHA512 8294e42b49a25b22098ad7fa1c8ad7e5a974f129de2a7d602e3a92105db69a3ef118d7f15c85e9f143079d7f8eaf63eaf064debcaef0c665086360d0b841c0a5
- SSDEEP 12288:/FYJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:tYdCN/j2GLl3iFSE33b9
- TLSH T1F0452368A6B6F669F16B837C03699F515210FEF8EB2144CB41C0A6FB573DFD89032852
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 4cd846ea961d6b2074f14fa699758129e825e6d03ef5eccc58e5ba059ab796d0
- MD5 bfaeefdaaca8025e4880e761d3dddfc3
- SHA1 ac6afee1fff88a40f983a7e02e1a86ba9dac0361
- SHA512 488a1d05f067efbb8f1cecba8cc76d973f5829f1442d10f2278bd04bff69b0f3bd4532e3385af99ee773dd473611caf257c948a5260448260a818b4b1a0f9305
- SSDEEP 24576:wQ9MxZKdcz97w3LdCN/j2GLl3iFSE33b9:wVKXoN/j2U4FH
- TLSH T1A8558C2DABF9159AE177D27995A250C3A633B4301B31C6CF2448D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 7bf87edf78faf1451feb239b64df26ab748f1cbab91cceaf32435fc030cf561b
- MD5 45c70b2129779921729002098418eb7d
- SHA1 abc0d3f08f5b312d7e12934368175dabde33b51a
- SHA512 1e4bc3be78513639cf98810b3b686d69a20f00f4f1b2a78c0b8bf44e6fb5bbc158277545dafa32fc866066f75ce27f5eb7cd9ce3d03ba665a91b304fe82c925e
- SSDEEP 12288:TyoKo2HRple9p2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:TyocxAp6dCN/j2GLl3iFSE33b9
- TLSH T15B65E01FBBA940A2E076823C89858745E773B0705B6253CB5591C33E4F27AECBD35B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 849cffd1b72edffdfbafdbcc52c3779b30669fa59c6675f0e422a62657dd3abf
- MD5 3f8739649ca23cb157bd0cf1e69b7426
- SHA1 749f96b9a2fa7f36d74392751af903eb0dcfa7cd
- SHA512 6b4f57d51e27c5c4a95a3250ad326c489e556c83c410f4d0c1d07e6685ff2562f255c7b76b91c96d74c9b696e11fe4c130851c385c474899dd680ddf4a1e1144
- SSDEEP 49152:MWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKdN/j2U4FH:G0zuNIPj2jF
- TLSH T190A57B3DA2F800A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 973df59c993062459b5d47362cf29e5aae0ff5d63382330551a5e78484f3b98b
- MD5 a8ae1b10f75084b232d67e2189f8576d
- SHA1 63f407862b927218c44216ad6941e90195ce2118
- SHA512 8d4345ae8372aa86f84db8c831266b14cb8abb83c6c831eff7cdb147e1237bdf29bb1a677dbe037db11f7d14d3e7db66235d52f8effe9da2435eaff9373f41c4
- SSDEEP 24576:X1QT7EcpfxR+N5AWAz3ooiYujMqbtdCN/j2GLl3iFSE33b9:qTDxR+N5YzT4jMzN/j2U4FH
- TLSH T1B455B02EA7F815E9D17EC5798B23C512FA727861033193CB42A0C17E1E6B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 cc2992e19cfe326b726f33c6bcda7f5c4b7e18eae70032d5d27c06b22de01f83
- MD5 19cd40129228b49b67a0649cc6607302
- SHA1 ce7e7c312f84342a9bb7811582c6005abfb11d20
- SHA512 028557f05037fe9ee08101ec63aa74e5593c2fc92dea83634235cc64d43ab0f4c140ff7cafa5f08a59558d35b1d363d640812e013b98c3daac4a850db4603044
- SSDEEP 24576:nTMdOz0FFS+bmSLhdCN/j2GLl3iFSE33b9:V0K+bmSL2N/j2U4FH
- TLSH T1CD75F17EA3AD14E5E47BC27C8653C906E67274A5032266CB06D0C1BA3F5BFE47939B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.2MB
- SHA256 cfe29f37a3c6abb1cbcb633c4ca658965bd36ed549b9892fb54c895224e64487
- MD5 bdcebd6b8efd99a8fb8c45046f893cf0
- SHA1 2268ba9d7b7221a6213f01021d220d87b2cd19b5
- SHA512 13761c0004f98068c0de43b74a1025674e48316bb96b5a91475fb201c67fd2b7c272f9453650a3aeebd443969448a969167a0ee64d29e4444d2e150cde4583fe
- SSDEEP 12288:N47cJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:YUdCN/j2GLl3iFSE33b9
- TLSH T1FC55121CA7E870E5F0768279877A86159220FCB4A72145EF15D0CAFF5B3ABE8C435B12
- MD5 SHA1 SHA512 SSDEEP TLSH