a7c44526c063619fc3bd5234a5a9fe95cadcbb6691eb4eda7ee0febd79c2f6bc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Size 1.6MB
Sample261113-fdgresfw8v
SHA256 a7c44526c063619fc3bd5234a5a9fe95cadcbb6691eb4eda7ee0febd79c2f6bc
MD5 3f4da8a1b062b36c9cfb677b9179cb9a
SHA1 2a9df50fb6a2eb9d12b485b2f0c7fca388d13b24
SHA512 8eaf854733390a595359dc4848755128968b9dda46e34e35020c48eea34e607665ac1a10c254a60b3613f577a4590890e424a4ba43407053edeb44390c26fe7b
SSDEEP 24576:DIy/kLRKgXe4i7ojhsP5Lgrk1TWb4AN5:sykfe30jaNf1TWbdz
TLSH
T12075BE2279CDCD62C212AB3485B6896C62577FACBEB5CDCFE644BA3E1F332D14514206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1808	alg.exe
4336	DiagnosticsHub.StandardCollector.Service.exe
6052	fxssvc.exe
5144	elevation_service.exe
1060	elevation_service.exe
5876	maintenanceservice.exe
5464	msdtc.exe
4388	OSE.EXE
2960	PerceptionSimulationService.exe
2308	perfhost.exe
976	locator.exe
2076	SensorDataService.exe
748	snmptrap.exe
3212	spectrum.exe
4660	ssh-agent.exe
6056	TieringEngineService.exe
2020	AgentService.exe
5096	vds.exe
1668	vssvc.exe
452	wbengine.exe
228	WmiApSrv.exe
2624	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\35084bfa4bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaws.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dbc031ce2973dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4f789ce2973dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee1289cf2973dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c942d6ce2973dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db4fbfcd2973dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000226378cf2973dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cec4d4cd2973dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b2ee2ce2973dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e9a2ace2973dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000adc65bcf2973dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf8abacd2973dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
4336	DiagnosticsHub.StandardCollector.Service.exe
4336	DiagnosticsHub.StandardCollector.Service.exe
4336	DiagnosticsHub.StandardCollector.Service.exe
4336	DiagnosticsHub.StandardCollector.Service.exe
4336	DiagnosticsHub.StandardCollector.Service.exe
4336	DiagnosticsHub.StandardCollector.Service.exe
4336	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Token: SeAuditPrivilege	6052	fxssvc.exe
Token: SeRestorePrivilege	6056	TieringEngineService.exe
Token: SeManageVolumePrivilege	6056	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2020	AgentService.exe
Token: SeBackupPrivilege	1668	vssvc.exe
Token: SeRestorePrivilege	1668	vssvc.exe
Token: SeAuditPrivilege	1668	vssvc.exe
Token: SeBackupPrivilege	452	wbengine.exe
Token: SeRestorePrivilege	452	wbengine.exe
Token: SeSecurityPrivilege	452	wbengine.exe
Token: 33	2624	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeDebugPrivilege	2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
Token: SeDebugPrivilege	4336	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
2368	2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2660	2624	SearchIndexer.exe	111
PID 2624 wrote to memory of 6012	2624	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_3f4da8a1b062b36c9cfb677b9179cb9a_elex_stealc_stop_tofsee.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2368

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1808

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3888

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1060

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5876

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2960

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2308

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:976

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2076

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:748

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3212

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5032

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6056

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5096

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:452

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:228

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2660
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:6012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 80ca513f32be9394a935014076d614fed0f4b89a2fb254f6186996762c2df92f
MD5 f2962c40ac6d642cca7c683a48193c46
SHA1 04dab05705420eabc20373b94b25d782b9719f32
SHA512 a17085dc711b747461bfdd4ae78edf11fba6ef2df0ea5caf5f2ff31e3e7678751b6d37396768deaaddca145a86098282789508e6d2e33e243edc4d352515c3a4
SSDEEP 49152:Tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnee30jaNf1TWbdz:x3q6HjBbU023W
TLSH
T193D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 839d333cebaea02a58645c5f9d03083678a31a364b5df7ff1c814c01939e91b0
MD5 11a63166221d771a62f97820ae6e0099
SHA1 e7f22417e5507363866c3e6fc10167e56360916a
SHA512 1e8a41e76994446b23f26eec3d6ce0d0e3bf1d874ab33e459146ff6d5805ab0f5b7867a40dface163e72fd4b3c82c6a4d6da0e954578a5f3b710e0596d4fdb1a
SSDEEP 24576:IXYfDtczA4gXe4i7ojhsP5Lgrk1TWb4AN5:ftcse30jaNf1TWbdz
TLSH
T14465F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 8ad2376847d1736a8d8e0182ca72cb84902335f965307a30fba15f2609ccbe60
MD5 a8a446a0146fc09c099a2b264ff57453
SHA1 a3b2f325006841317ac351fb87fe3135047a81a0
SHA512 23ee66a5711310d8870f9d841479b121433ae777e0cc126550ef9e0524ec9ede5702d1ee00060dca712b137a0a3d99a5e00d4c3985d7b8147a9c31465440e62b
SSDEEP 24576:10Le5ji0hmxirMPgXe4i7ojhsP5Lgrk1TWb4AN5:1Pji0AcBe30jaNf1TWbdz
TLSH
T16485AE26F6748735D073C0B9C5D2A68AED71308257308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8528b2347ad676f05bdc040f1e7b1827839498027a8d4a26d5e3cc2ed727a1c5
MD5 f6e4fa296f979294cd77add29d70454d
SHA1 790ba870ee497034d7423ab6d9f7442f51f6459a
SHA512 21dc446bc05b1220554849a9aebd888ca55268ea49e310f22f01f4d0992508d577f7a76bc21f73519636408fdccb7e09f2d225d9826cbdf6a18f0262bae282bf
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWE6q8wyuBgXe4i7ojhsP5Lgrk1TWb4AN5:0/ezSC6vUzPvxHjyFe30jaNf1TWbdz
TLSH
T16C756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3d2152d205096632e920d5cfbabf205eddabd6c504b7767119b9710ea80cba1a
MD5 4b161d9842c755142d517e37d398fd27
SHA1 d0bacead5053383558dd66d3a6d6412ee257d085
SHA512 651e5ff40a7afb29621aa636ad26c91745d2d46c310465d73ecc23764c2855a16199a01b8d74347231dea41b81d538e96f1b9b7454cca7509a350ee164726e3c
SSDEEP 24576:1VbqPb88hv/l+6EgXe4i7ojhsP5Lgrk1TWb4AN5:1VO88hXl+Ke30jaNf1TWbdz
TLSH
T195559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 722d6d040aaf470e1f49ef791adabc4b73e43b73f5042637169698bd2bd68b2d
MD5 b5f115114d6631d8ede2db85476f816e
SHA1 d41cc0b3a73e9cfc1144c24e5f9a1c8229be98e5
SHA512 6848f98c234b2277c0410837dbedf7199d6a373974f90eb81aa1a4a5aab669cc8238a39328806b34ccb6c8cfc7dc2ade1160af61d0bfc910f27d70877f81aae3
SSDEEP 12288:0RC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0RbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E74523A19F5409C6F38FC3F4A0F7CBD1E9E11EC061448D6B47E0BAA318BC899DAD4469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 09a6b47d1fc257be52b692c2091972f756663ece3dfc34674454e29104f5e1bd
MD5 80254f39d7e1f3ce9043e6b84b8e8676
SHA1 7ccb827384ed1802dcf825bbfd7110ddb296ab72
SHA512 010121d4797e9c2cf68f59db25d42bf11fdefc6cdf595966d3f2e46a478b72d34ca456369ffb51463fa9ab88a332bb403c466e7d27896a9c3931ebc91beadd0d
SSDEEP 12288:FeBNUbTVO86Uv0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FJIU8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D565CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8d6cd2506b3722ef74dcdd6246cf58d51728fc7d2a9a40c175bd3a1c492ac346
MD5 b2cdc4abea81d623435670a54f56c947
SHA1 6896839b54536a94c53d67ebb5dea4d889b7c9a1
SHA512 9d6590ecbaddd0624087eeb0dd0039afd51443665a6bb7603e142ac157e6330b0e3b9fb6bdd9e3217bca929f006874be0a400c12d98ccf8943f47c9b1ff5c82c
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:bQvGAdlCEL8c/yRNw5CMU023W
TLSH
T1DC267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 fa613b4f604a8072e027958f3530aeb5c243d4a33ecd6a4cacbe39de3d2b1d36
MD5 e278aa07df8971d23bb623759d9f5c41
SHA1 3708733b4feaa0010cdcf5237666619156b9c5ce
SHA512 c32268320067480762951ad6c5e4ea56ff4dd8e3531a77aaa7b7e51874356fde46fca948f80dbbc2b4461574e5a078852cc4be0bdde3a81085758f06460c4aef
SSDEEP 24576:rdewsAj+gXe4i7ojhsP5Lgrk1TWb4AN5:5ljRe30jaNf1TWbdz
TLSH
T15C65E031FE74E032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 09fcc21a9bcd406810d107b74d53c8fde402e2397e3f4ca8261c2c8ee9681e28
MD5 f05d1f385308ab38203d74c08332e3bc
SHA1 b37b460b047a9b258ff7bdb5f5b61a0061f711a2
SHA512 cf04feb13566878cce078a4de341e43bd1b675070677e35acd5cabdc9790e5c99e4ba674ef03c329a0b74caed523a1c9e4d8eb143cd3c1895590da1500aa767b
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHpp4W:0UEtQevvqc2W1cpV2EI3274W
TLSH
T1FC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 37683807bafe91eaa876da905c6f0cb3e9d1fa6688b236f9e7d3d7601f773be8
MD5 20ebacd6d285066f75018dcf194297dd
SHA1 eb0fd48ebcfe2910ac4b574100c669e63b50a921
SHA512 f57e4efd90d4ad7b601c7895eb811a4663d5bfef4b5e8160364d5000807047a89f6693f11b325298a3074b4751ffaf6d29d2a181d02d193c92f30ab33020bd1a
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/zxe30jaNf1TWbdz:+oqtVjnmwU023W
TLSH
T1C5D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3aa160eae11849d2ed451ed9f0ca08f9394fb9e111b6196844b74f13734308b6
MD5 c5fe43e38d1bae189ca72191ca380eda
SHA1 f19050ec880d31c1bbe0857f82c2acd7c26b1c21
SHA512 bb7774a225bbe96263efdf8673388bbc7d006175ff715087b6504399f0908edcd7cffa9dddd002c7159873c8f831e28b6b4e9921db941694b6be2a2f3f5c9eb1
SSDEEP 24576:/AhGLJIFoiwtA5l7S53FgXe4i7ojhsP5Lgrk1TWb4AN5:/AMyFoiq5Ae30jaNf1TWbdz
TLSH
T14D359E81EBF945D4F5B3AAB899B68571EA76BCA65E31C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 0402ed3d0fd0e82b561330b81da00809ff64fd050eacae2623962389e155a755
MD5 11e1986bcf48e1dad256c987d5bdc23e
SHA1 a2066756c64b66982a45330b8d04cc2f25b69224
SHA512 ea3de98fee19e04d5694d7d9c93750ad6f0d2877d586f48132c7f40f4d40ec0612b496f0e0657cd5cd914295e70d25bad54f0ecb40aecd9df285f619fd99c39f
SSDEEP 12288:imw5HEjsChNVBFgl0WDm+Cg0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:7wuoOWygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11065E14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 57c2f4e0deb8f0ba372ad5ae0b2391182551e3272c526a2916715bf9de5da71f
MD5 ab832516d951a59d4850ac3f93d6ef80
SHA1 11a1b2ba3dbeef8fcea37c659cce4e0835a417eb
SHA512 57436b7583fd77fe4ebc7f35e45ce67b0d54e39ad5cb9c0bcb96ce47d068b0d88b38c9829fa133fad1cde5ebf31dec3f2e00027e12c8b6f5d7417dbe0951b1b4
SSDEEP 12288:z+BZ1IyB0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:EZuHgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15555129637D420F9E2978278D4F68741E7B23892233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1c1fb48c69eb5d63a8f0819c79832fab3f046c47b99fc7ac7bfc4d3f74fec868
MD5 679993dd520f85bb959a1a2f3ae8a874
SHA1 01cd570d77a37287665c5f6a18b1f95b3ccba469
SHA512 1f9c226fd502525f9ffa13831a7d087666f499822cbef0caaea63f04644437ae7b4bedf873f04278829c9c5c7253bd95c9780993975a26ac7a5152fd0e7ec4a4
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UZ:WQRQyi36YOcPQLvw2gAf+PN33U023W
TLSH
T125667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 327d090aa66dde3b7f10b0a7a3b66c4e6a6a67b0d96ad1b32c0769cc250b6a0c
MD5 bd4218a2b9d632da60f7f73e78bd45cf
SHA1 191e8e0256d2386230a1a941a0d9c8e0d19fc7e0
SHA512 b19b5d303a03735ce6503e0eaa01952546f1a76d15b07e24a5fcf8b33af2327bad9a35fa47ec8957fafc35d81ce76764eff3f2cba572ebe114eed025540d7d4e
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UZ:CQRQyi36YOcPQLvw2gAf+PN33U023W
TLSH
T16B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0c54fa56404dc42e1c65ef84d72da94f8faa6f6f296761dc5ec91fee197e6d0c
MD5 170e068da7b61905410944a17782f81b
SHA1 d6656a1cb424f3de0dedb9d4904e93d599bdfbeb
SHA512 d85caf4892ac5860960a8b1a8fe89e7783c108361cc3c4b496f722e03b844cce0b8594ec229afd6caf5e70f94f5b2a324056ab9f3dc2c797fd6846128e940cfd
SSDEEP 49152:v68Qg55nhheWu7PNU3/Be30jaNf1TWbdz:pthWRc/BU023W
TLSH
T1EEB55933B2F60099C04DE1769F4A872196E27C718FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6c1648921175aa2423409ad75a42486cd66c9b5265eeb87d2afe657abf7dc845
MD5 7358e398edb5c1ad14bbf086f27757ec
SHA1 9f427e1192e195f0ccdcf30f9c5c1fad084c8355
SHA512 1c0109875ddc50eb904ea13a320a91cc84d856fd959301ca8aadca02555ab4be2428f57127938c7011cb49b751af2948d7f25946d4f224639ab535b0e8eb6ce0
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99r:vy5112gYy5azzVvL69nLKnhZCU023W
TLSH
T12F168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ce249f7a2a0801bfd539c41f56524a678883c14ba5da3d38e2d11c7cdace5761
MD5 356887078323bf00bbeedb8a53daa6df
SHA1 3abaceee06124b7df1f5a79aa0558cb21211bf3f
SHA512 34a0996d87dd240bcaebbb538ca03e4bd3bda1b1876f30dbb7dfe3d4b24f1c4c79f1d35f597c5b01b0dc5d685ea11140ea49ee0441eabce76588ef8f5f801267
SSDEEP 49152:lB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl/e30jaNf1TWbdz:Lu6JmVxd2d/U023W
TLSH
T1DAD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 59bea78ec181e766df0a7719e495a84a12cc2b7e2dd36a95570cfc6c210b3e39
MD5 10cf5229dc689afe004614b39383532b
SHA1 381650eebb9b2aa80a036bf059de6cc7db34cd09
SHA512 00e441bbea6b44a7742a4ce6fe653978bd289b79e23ec34f92a085483e656aad65168566fae3c2bb513f72c070c65909c505ed16834bfb30a31c4b24228ad67d
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xze30jaNf1TWbdz:jmifPbRwU023W
TLSH
T126B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 136c874977fbef5f22236277f910c811efbf6c31472f0d1277614f4eb249005b
MD5 4ec2b6ca03f88d62f6424725f4b71aa5
SHA1 4c08d54aa9b52ba7448b9a879ce382cb84f476f3
SHA512 1bcbff39b5dc5b531e56f597b6d4f0ce3a6642f66038e3e243ed89abfa992bb0d9352d12326a009a7bbb94415eb954b55e0bdaf3fe03951b23dd849aa8e660eb
SSDEEP 49152:RSuZQIY0Be2KRRVtOnks6NMHque30jaNf1TWbdz:/5dKTi61uU023W
TLSH
T163C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 775a7e86ab70b7571f9b1d696e05347ae81574e13bb3902ff7a1303f8280b62d
MD5 289db64103f7ebba54397631abde6ea6
SHA1 31abb536a9c7205fa0808671572f8b5026eaa29a
SHA512 aff3c4d9e8bc04104390aed951397979c9d92c982ae0460b802e11c867b1a5a7f9778715e1f62fcefbcfee9c57ba0c7590e6213e1c1a7aadb23533e6dff7db0f
SSDEEP 49152:ThtSn8EApI0figngiDn0AP5wPe30jaNf1TWbdz:SX2iyphkU023W
TLSH
T16F95BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ac93932b9834d670f557e201b786ddb730a8277462bf1cbd5991a464ae801e26
MD5 5f3bfe74fdcc23331f50f766ea1c8b7c
SHA1 87188d6d8b25395fc8ec73fe3cf29c535f807033
SHA512 618e3181a21cf31b0b8a0eddbe428633a2147b17cd2fc9a96d7f72c89c9a115bb446c5de51022fa7c3bf7b2f5163648dc6a788519b9a274fbea346d3772721c9
SSDEEP 12288:0a0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0zgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A6452391AE9509CAE34BC3F0D0F787D1E9E11EC272404D6B57E0B5631EBCC9A6AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b3e8577b3ff90d8cfb792e3aeac677b298e11eb154faecb8a4a87a9f388a058f
MD5 d0f8cfcef299b2c68578efde6806648d
SHA1 11828a0fe9cad65e6addadbfafbe754c836a30a5
SHA512 0de6f4e5b558cd287d5025f9f577866c20cfb45981140f34b157308c7d57aa82be292db22c6e7dda8d76b7efe6907b53db89a1633f2c2446b0e5e5dcaf48af55
SSDEEP 12288:fN0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1284523A1AE5509CAE34BC3F0D0F7C7D1E9A01FC272414E6B57E0F95319BCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 40c75e2b79355131abd3e497aa9be5ce0cebbef8872efd03c6c058fbf8776aa2
MD5 30340df1c18cf2d4bf2b27951bd4acbb
SHA1 99ab1225acb4a95f6437c7965cc3b7dadd1f92fe
SHA512 b40a0ae1eff44ef588458252d587e090d14ebf0c870a5e27f88d82f4e4c58e8c59e0384a05b4f600a700738792a8b1ae1ee80e75ec6675f6e5791048faf8239e
SSDEEP 12288:sH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:sUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1494523A1AE5509CAE34BC3F4D0F787D1E9E01EC272404D6B57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d2378772101894d8e898c80779f20c91a8aaffa4018ca441a60acfb487e47b0d
MD5 8219eb3e788123f4c76eaed5579d1306
SHA1 2d49a77d7e693d3565d8841faa61c4a3ee914653
SHA512 c626e3300a64d54f198c652006e53d928e90c5951702871ec73896fec340b4d29d15e748ff573ad3780a34227ff4cbf35c85b13ca190fe6e2ccfe63f2dac7cd0
SSDEEP 12288:iVk0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E14523526F9905C6E18BC3F4C0F38791E6F13DC1B3118BAF47D069530EB4AD96EA4A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ac6789c983e195b13101eb95c05df2cf791656839a5a8ba10ab7ab2935550544
MD5 5d2625c75ea1004ca12eb694acdf7733
SHA1 8d4d6af44cb6456687b5f7298cebc54df1190ee2
SHA512 9b386226170ce2260296a06e85106f3efe717947aea9b642af84e56f391154943aa1236aefcf3cf88563d0a577f1e3526fce1bd22af97568211e8bd662b819b6
SSDEEP 12288:5s0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5NgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T159452391AE5509CAE34BC3F0D0F787D1E9E01FC672404E6B57E0B5631DBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4c3cb955e83dff9c82cb9038546b73ab9008555d7f619c673e495c7a3b425b5f
MD5 4420e258a60eee0ba34aca0578d6aa71
SHA1 0a13b0bfb0bf3ed92a9c1fd92e65c77b9a33c6c5
SHA512 a2689c8a4d75d927f0bc35816593e45b43722418b1914735373f41403f9a25b8816d8a3d94091488406055ff8714a80c549be691cbd5a79e996c6307b22f9c27
SSDEEP 12288:gJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:gWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F34523A1AE5509CAE34BC3F0D0F787D1E9A01FC672414E6B17E0F55319BCC9A6AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4fbd3025f8195713069af16183e26e365b5367a2dbc3bb22d988b7c06904b398
MD5 70bee6cceb89230960d4f8ee16079a2f
SHA1 73a8f16123de2b763990480b13fb95dc26405fdb
SHA512 d68195668e478aab676c6668ba73a1247e6d8e04c47f3299d25c5cb6d36cac57339a898f25733e6b4e55ef47a5aae718fc57a93bad3840ea45bb0ba00b7cab60
SSDEEP 12288:E10DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ECgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B64523A1AE5509CAE34BC3F0D0E7C7D1E9E01FC672444E6B57E0F5532ABCC996AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f789b379e7cf42ccb972b952b128092c70c4cc6f708539fd75e9b5c084c2148a
MD5 858e9e1562455e37f02ac58238ed029e
SHA1 c3e3fb2d00f90a7844470eb0234fb9891d09afa0
SHA512 729b9e12ee0b57bf04d2778d71b9b075622d3ad6e2f50298eb237ffed1ce9dd778737933ebd75700576f95aa6e6bea0328b26bd6b44b3f673655cb26807450d2
SSDEEP 24576:sZMSzFVSO6gXe4i7ojhsP5Lgrk1TWb4AN5:sZMSzfJe30jaNf1TWbdz
TLSH
T10E650195B3900CF8ED67827DC8A68A02D6B27C561760CA1F03E436671F773A11D3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8ab4bff85dcacc5a2a35485262ea68c81a89cfaa22724d15b38add562871ed3a
MD5 788f99e51c94a11c716074891e56d60f
SHA1 d3a301cb110c7b3e2e12fee87545e817cc89fb68
SHA512 e28835a5ee43424abbc9df6c41acabf8e046603d0797a787014847fb3471397906f29decddbe490783fa7cf4b16fed48a4511c6cde004fb07da4446be179aae3
SSDEEP 12288:7+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:73gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13D4523A1AE5509CAE34BC3F4D0F787D1E9E01FC672404E6B57E0B9531DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 39a41965de60b9294baf11ec1f97fb740faa6b63e4f365f5d27014c402dd181a
MD5 13857a11037c495b50ef88e9509692b1
SHA1 0df444a57f16c97dfec020657c620a8b507db7fb
SHA512 70d5f117255be5a327fad9916b13b5fab3764a5c799a56e6f4ff81766c0ebd119a00d1064b35c17c127a6aad313f7da9188c0dad414156dc555de7468391a3ba
SSDEEP 12288:3S0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3LgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12A4523A1AE5509CAE34BC3F0D0E787D1E9E01FC672404E6B57E0F95319BCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 5ad42f1b6029a79005c7b1a650aa0708a0b8abd29e4319d5dae15eca6e3711f8
MD5 9e5f8f696efac4aadf7c0253e815688b
SHA1 21d0c481ea12b5b26ecbda701b078feaaf7401e3
SHA512 5041dfb72bf231978fcb6461996c71b5f34fd6889298cfc0be01fe0edeefe7e52c05ff11f7132cbf318f16e75c6c51acaa5b1031a4d37c3908feb6f15c2ce719
SSDEEP 12288:hyPz5L8B0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:wzyugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C455025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 56cd7c5987601a50033cadf6b528aa00a76a9a23e7910a6ad42eac1557fa1ec3
MD5 736364be63902168fecd7c0b0d49da6c
SHA1 d42a558f4b85a2b7762f90a3902359128821d83a
SHA512 1d262d36e580ccf80aaa80e17a2af65728f9744ce1638c2783ed12c2c72141fd83cb39066b40582a1840bff78e6a70754d8ee842bb5afb398deb2a9827fce360
SSDEEP 12288:x+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:x3gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13A452391AE5509CAE34BC3F4D0F787D1E9E01FC672404E6B57E0B9631DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b0096cf172748e9ac95ab1a6143ae0b94d028320e25602f9daeae54d111b54a8
MD5 6c6eee29e569663f1eaeb52bb12a513d
SHA1 18dd901d1b11da3e3a4afed5ff9cc78791615daf
SHA512 e9c68155f1a9a6d91f7a221f4d86f2e527da41956247334a33df962292eca6357730c1ce97aaf18054f9469d219115311a8f50fd26624a4740d6a4e5dc63545d
SSDEEP 12288:l+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:l3gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10F4523A1AE5509CAE34BC3F4D0E787D1E9E01FC272404E6B57E0B9531DBCC9A6AC846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7518cafae4868f03fb9c727b255c9a07c1b75246a75ee26b414243674313544f
MD5 dcc9a66b2ca7c345d3d7cfea4573c227
SHA1 42b62ab71813cb71912811f91e9f43f8461d5379
SHA512 b47bccdfaf9c293faa670df2b5e0d77fc2232376a338af821f5ec8f1b5b45421b831d9854af4b828c94c3adc8136957f40237fa734c2484d59dc407d15579edc
SSDEEP 12288:NyPz5L8B0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:kzyugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13455025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 31268dcecf707feac071a97648b228afc1b8693675e0f58614b2a88b1e59eafa
MD5 c53edd6a35736f2ceca2715f01b730f2
SHA1 4971836ef00538d2734ef91687cb5a3a2e7e8c9c
SHA512 f12c148f0889b310b348c6ab7dd19356d7355a0e1d20a442efff180b1df4180a5a6ce3e37d0c6005a9b089baedb6b1e560d767365dee90a084c2d7e78e31d2e3
SSDEEP 24576:FcP4mcvIjkGOxhKP2l71nNKbrh/8KBfgXe4i7ojhsP5Lgrk1TWb4AN5:KP4m4IpOO67W8KMe30jaNf1TWbdz
TLSH
T12565AE2DABDC0096D0BB917485A58A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 54102af3f4b588cfbdedf09c31d8d70650679a90f6ea5d68f00c40f5482cd8a8
MD5 85cbf3bdc94732db4b26ec48a567484e
SHA1 8e5b3cd90140e8d016d28be3554df777c633a8d6
SHA512 98d81829a90de5c247be619792d6aa8aaa06e14df8cbc07fe164d31428b9293b095185f3701cd967c270052d52293e314fc91f6a560b6af351402b12081605e2
SSDEEP 12288:INsfu0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:pHgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17C55F15AD29802D8D05E92B5C3968A81F3733C9193E1C7CB13D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 af45823a492c380b613b974e39231b2f9ad93533d2c9fc86bd2d0f903f5dba29
MD5 c2e4d14e89a996488c26ffc8aa9c56c9
SHA1 05172fce05306ea5becfb9021915379ceaf0cb17
SHA512 77800d0b3d81ba782d57b790005b8bd16ce6f56807c56233e297f26e075b4cfbd310a78e48e59ba259b12afc82b8531dc8acec2f157de448662d9bc6899a7d5d
SSDEEP 12288:6O0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6ngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19B4523629B9809C6F29FC3F090F7C760F5653FC067008DAB66D0B66319B8CD5AEA452D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 75403d5147359e9672d83fd27d9e98e75a9e942bc5aed196b5708e00281f040a
MD5 0f9a778fa8c66c05d2511de6a1828c06
SHA1 9d2349dbb24abebaf927e3ede67a76e82e7a0718
SHA512 c77885436e784423d5fd73252763e2bde5ce95c188d5b20b629aa8be910e1d8c877382984ee893aad8cab1f6f7af76075f230e155a56e32df31d18e869f319ab
SSDEEP 49152:Ya0h2GEkuAe73q3pp46zwwQIe30jaNf1TWbdz:Ya0hNYG4JwpU023W
TLSH
T12D85AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 49cb383a6c52befecde525f91e8bf4d434d0fb71a7c1c7ccac0e5d3dcc6ae28e
MD5 68be059540a745f61a798aedd9900955
SHA1 ebe20081077957f52552a1b05ca6784b5f076980
SHA512 f69f1176391eeeb1417e445d664c7ac55a324a2601bd39afec362320fac29e353cc36f967878dedc3960dcae37287625ed2c3bc75956e5fa10b7e3a8d6eca2b5
SSDEEP 12288:khbHjfX90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:khbHjPqgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16455127E2AAC10C9F276D2BC91E28646D371BC55231187EF13D1927A0F3AEE85D38E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 fbfd7e67e0cfac14edd80b039ea3fc8c7efce5ffd9cba0987c940e02520107be
MD5 8b5dd8d73a69b699e5834f0f565c3895
SHA1 0012e7eb915ecd549edc4da09a20bb073a42da83
SHA512 08a836a5e635648499e99c4a4a8f1acc5762ad00b4122e9aec7820362182c19efaee821558cad8624e19cd8804297da1698658b8b26d3b33a0e9e5787186b215
SSDEEP 24576:M3YgnJcRTk4yti+R5dBR/ygXe4i7ojhsP5Lgrk1TWb4AN5:MIgnaTk46pBR/le30jaNf1TWbdz
TLSH
T10945BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 1cd2af1e8350528b7dc34eff9d69f15fb7f19e557a7b24f2752302bdee2b7db4
MD5 5e660d58abd8d579f42dcc51ceec40c4
SHA1 09c6a1bc3c7fa1a8441442ee6439a49e2565d66e
SHA512 dde1585c7fdef3b5e0bf24635ccbcd69ea1f5a98c54edeb1803173d7559897288fefb3624970813ee30a547967132973eeb7610871d7fa909ee5f29aed014a01
SSDEEP 12288:8i0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:87gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17D4523959E550DCAE24BC3F490E7C791E5A02FC133014EEB56E0F5631ABCCEA6EB4468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 e6695671e2c8e492697323b297f9346b22ede9e4191585d51f84bcb82ba95a15
MD5 147f5ad6a68d77c3fb701a2bae7cadc9
SHA1 cfb7e2fec9e2ea0ce467fcfadaefbbbc5b66d55c
SHA512 fa6b92b5299e4ab337d8b15660d22e5feb32ea97da2e45670a711965791b8c3e9a072774be22a0a5beb38bb833150e1e737095f339b600d49c6c90236b9c32a5
SSDEEP 12288:2Ob9A4LWOsvAYFT70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:fpL3UT4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DA75F155F79400F9E96BC27CC4A28A12E2B2789D1364E7DF03A84B661F637E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 44313a9bf9e2cb68741dd006b33c61b9543daf1774e929a84aa38edefb73474d
MD5 0f21839bdb58c17f59c99fe605756103
SHA1 df3313430441b041dc809a4a8fa62f6a8934730d
SHA512 fd49202977486bbbfb6f49d39d05d602d169685eb24ae596c114dbd9b8f24006715b5a7d78678966c4d5a044c4661985e96af12b52c776ab5ed03587ce4a4b62
SSDEEP 12288:lpFtpOP0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NOcgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13255026A37EC10D5E16AD27C85D38349E3B17892171147EF02E081BA1FB7EF86C79A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 41de1549138e06dfa99ff61ed30707fe5c335aa510225ea0690bc44fe07f35c5
MD5 e62737ddf88e2bf87e25d9814d049c33
SHA1 8b6bd99ea002086387006961d68a9b12a1cfa119
SHA512 5761d35b66e3479badc7d4434882562f12c1e59e41292f426e19057e268d2c8d4279f43df0930be9638f9349f0efb2310f2d6b4c3f477d77a2dc3732e901180e
SSDEEP 24576:17NM9YqZqmWMUkPjZM48Mv6bEhs3gXe4i7ojhsP5Lgrk1TWb4AN5:17cBWMpPjN8DbEhte30jaNf1TWbdz
TLSH
T186659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d82eb8ec112d17c83a474d6bf415b9d20784a81eea7611517f573b43bfb95057
MD5 4a74875a7a41be7054578b351f401733
SHA1 e2aafaae9b027ad5d81ea42ea80e852ad05da637
SHA512 4c1a2eb5f3e50a99e1303832e5d7b3d85c08cacbaffb2a7d02022f270dbb25354892d36abdd72fa712bbadd3289f361d28d23cc9af0984a9c34b1dbd84ba707e
SSDEEP 49152:qF2YuHNETovAvNYf8kmee30jaNf1TWbdz:j6BCf8kzU023W
TLSH
T142857E6927ED80A4E0BBD27D45F6D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 63fe7b606e93a57cc464ad5b2a9e8cd0b0e406b4ffc07710114cc0c6a26868e9
MD5 14da8f1a21424e42b8bcab9b5cbfc9a4
SHA1 b2fd0f7c3a1ed8be91a046829c4107cdf308fbd8
SHA512 97099ad5a50e41724d055cd93c63d7b763a435ab21c0c81df7f77379c205211e9ec38c40775153559d1c1ba657624bbdae78f84373b7611644190e1e1e8002f6
SSDEEP 24576:CAFs06+Omlf3NXEbTowgXe4i7ojhsP5Lgrk1TWb4AN5:7Fs060lVXuoe30jaNf1TWbdz
TLSH
T12565AE2F66AC00D5D07ED27D8997C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 e37233f151175f1c74ce2d464cb617f1e4b2bf67b59cfe88c93d417520f13fee
MD5 9bf5e7850a85bd9266c81f63d6126dab
SHA1 34f3f4184183eff3ca382cfaec447068f9d5cb1a
SHA512 b1ef5eb9b27c1e2727a50ff7c139b1bd302cfd27b83e89fca562261ab521afd0850956c7bc2e80ae17b0e2db6ae12938aa57e8ba7f52819f518bc6d2239234c4
SSDEEP 24576:EJnJ5D3WXtgXe4i7ojhsP5Lgrk1TWb4AN5:EJnJ5DGXoe30jaNf1TWbdz
TLSH
T17665D02DD2A810E8D0B7C3B4819A5796FE72386D2F226ECB14B4D5353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8e3d7b8e56ab5ab64faf227e6ba1f60d7f431ed4c9f220797c94987707d3b5de
MD5 fbac753ee24fa69a70d96e9c38380366
SHA1 c3f78c3306603805ee4fec2d33fa956083e0e7ed
SHA512 ae86a30590db5607461418520fafb4395113937cc4b89962a86ecaecda31d8d1c3df5104ad7bf74d212a1362635782a48bfc34d023ce4a853069de2343c32780
SSDEEP 49152:dg06DIKdwc+eQnSt65aVKe30jaNf1TWbdz:20U023W
TLSH
T107955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 fdc5aa1c9f2a56ade6beb6a4647278250a041b001d83fd36c25b91e877ad8106
MD5 e06149669fd0dc9a86629051e4780211
SHA1 18a9729a82cb79dde1d006d8c6e8b3d088b40767
SHA512 5c23ede5f7b1a7e0062bf7eef05505bc186135b402fc7b058232c4acb44a6a13954ea2e720b7fbf1b7ff68f4d280b14b083f1500780b5701d857caab572fda27
SSDEEP 12288:aEP3Rng0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5nhgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CA55126D6B9C60D9D16BD17C90E28741D3B2F4A127421BEF12E0D27E4E779E92E3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 c2a99db9f29aadd686b087670b7fe1a5a43a2baad430c01a95222219594d4107
MD5 b7075a412d454f1050bb9787f3abb540
SHA1 ec8ca6bda192c7b6bbd21a44bf0be1a8aab5e3a0
SHA512 b0942bb2221176d5cbba1386d02ad5fc0f9e57a05fd8ef52a2616f4edc30430cca7ebad83f850c25f4b181491a74c40fc79696c20a1ecbf857e44e5cfea2f277
SSDEEP 12288:EjkyN0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:EIyagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AC551204679814C5E2AB8278D5F38390DA70BC606B108BEF51D0FA3F6F7AAD4AD74B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 36d85185f95c1d72513deade4425f7fdf5ddff948c5a876e83d86a1afca10fd0
MD5 c013e72e8113d3bdc0808fcbebd93c1a
SHA1 b7a38b9947f7b24d3aa2c3de60bb05679b205a25
SHA512 e84f62141641a2f36c5172af8d40c3c3869ef2a7a26fa7248b8147d257fbd5766e983dc81de44cf0f1ca4956b597d11aa226cba0413f1611287301649af7554a
SSDEEP 12288:byf0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:GMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16E4523695A5519CAE24BC3F490F78B91E5B03ED133004DFF12E0F6735EB88DA6AB4858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 52c7cbb2d772eef88a39219ab7ba90f33ec741e536624c3ebdfa05d77003b629
MD5 83eaf82c9c576fa18e5993a5cb26633f
SHA1 3f5fc394bfe29355a5d09c119e5f71393f0eaa40
SHA512 4cd68bc3405de0e31e8869177430f011c983bb0211cb53aad7f9eaa7f46985d87edc94e4a4fb04dad9dba1b3d7ac97185532df46176f9879bc0d2fd3f46ad2af
SSDEEP 24576:IQ9MxZKdcz9dw3vgXe4i7ojhsP5Lgrk1TWb4AN5:IVKZme30jaNf1TWbdz
TLSH
T128557C2DABE9098AE177D275D5A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 f0e8acbdc346653d361f2b3460b0228b13c8ea5cc7cd29922d57b6bb8977d622
MD5 9a34c7bfd4a135de797e136e9cf1a9ef
SHA1 984741dcaaeaf1344c5ee475047006f98055543a
SHA512 8fb0fc7db42fbdcfa7e290828f4f0203e3b61f9e83abf6f67e3ca69e8485df831f292bdbb8e0bb6b90a0eb18f83866b5a6e6d665aec96d0f0864d1f579bc7beb
SSDEEP 24576:AyocDAp+gXe4i7ojhsP5Lgrk1TWb4AN5:NocDApRe30jaNf1TWbdz
TLSH
T1BB55E01FBB6900E2E166C23C88868741E7B3B4702B5257DB5291C33E4E779E9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1b57ffc068d58e7ee417d0299feaab621841da736a5544d7eb2dd5a994c9988c
MD5 e9be37458004703c1c11bc0fdcae2a9c
SHA1 138a9b0b8fdc7e9df63b0f5f85b8436288eded00
SHA512 9a739e5da3ec108e072b2253d973ed91f7dd7918843b77c67e80e95c9f33888ea186ab47c306ff0a48ce4107df76dba43834e99fb5157b9c92869d87f020cdbb
SSDEEP 49152:zWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKRe30jaNf1TWbdz:z0zuNIPU023W
TLSH
T164A57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cd0fd588351d019b5899383cac23daceafcf850fb4a16ec358c5acda47c251cc
MD5 afa4c1106aeb5460c10d7c4e8d44b769
SHA1 1cbb59c8d7d73d18b253190af16e49bfb3b3097d
SHA512 f8d3d5c11cf7f1b0fee7265f79ef4c112295a657f4e8f91398a77296fc973f78c69915551eea0e6d8a0f065ee28ee0fd52d648cfd12e9eaeb1a92936f8051ba7
SSDEEP 24576:R1QT7EcpfxR+N5AWAz3ooiYtjMqbhgXe4i7ojhsP5Lgrk1TWb4AN5:0TDxR+N5YzTfjMTe30jaNf1TWbdz
TLSH
T18655B02EA7F815E9D1BEC5789A23C512FA727851033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.4MB
SHA256 dcca3d659cd0f364b2ed0581cc3590bbf2cba5948868dee4e5beee36c1d8f111
MD5 cef9451fe94e3085cb33e9351749e60d
SHA1 e2062e2e78553e0ac6698c3cd257daf1c0805e2b
SHA512 c0eb9d4e5fe60f6e76fe3a7376bb7ed808f13e5b55e8970d378107280bf7df2b898e464dc507fb68b25f0f943fd036591b556c0235e80d5a9f38750ac4fa01de
SSDEEP 24576:9TMdOz0FFS+imSLlgXe4i7ojhsP5Lgrk1TWb4AN5:H0K+imSLwe30jaNf1TWbdz
TLSH
T18465F17EA76D14E5E17BC27CD693CA06E672386103116ADB06D0C17A2F6BEE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 3b2fb14fa5ee094350d1fdca4f7ed0ebe84e7815ab24bc94d615ef265b0a4a97
MD5 e51291919b33960d935103dfdb426ca3
SHA1 e6ee40e744850b89205a368e4a553acf1316e4bf
SHA512 de4c6e4c0b128f244c1283119d1600bdd045bc7fd2f8170016a309712b2665e3c514f794fffcf414f2e83afc961317b9c606465080953947ae6a8ae9feaf4913
SSDEEP 12288:a4K70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:g4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14345125967E824C5F167C2B4C1F78381D6707CA123104AFF26E0EA7B4F7A9D89978B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/228-269-0x0000000140000000-0x00000001401F1000-memory.dmp

Download

memory/452-268-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/748-262-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/976-260-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1060-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1060-436-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1060-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1060-256-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1668-267-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1808-349-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1808-13-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2020-134-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2076-261-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2076-386-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2308-94-0x0000000000730000-0x0000000000797000-memory.dmp

Download

memory/2308-259-0x0000000000400000-0x00000000005C2000-memory.dmp

Download

memory/2308-99-0x0000000000730000-0x0000000000797000-memory.dmp

Download

memory/2368-2-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/2368-316-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2368-0-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2368-8-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/2624-158-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2624-174-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2624-438-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2624-270-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2624-196-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2624-321-0x000000000C9A0000-0x000000000C9A8000-memory.dmp

Download

memory/2960-257-0x0000000140000000-0x00000001401D6000-memory.dmp

Download

memory/2960-81-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/2960-89-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3212-116-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3212-263-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3212-110-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4336-25-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4336-17-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4336-16-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4336-369-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4388-77-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4388-71-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4388-271-0x0000000140000000-0x00000001401FA000-memory.dmp

Download

memory/4660-264-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/4660-127-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4660-121-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5096-266-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5144-435-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5144-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5144-39-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5144-32-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5464-272-0x0000000140000000-0x00000001401E4000-memory.dmp

Download

memory/5876-59-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/5876-65-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/5876-63-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/5876-53-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/6012-353-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-357-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-394-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-393-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-380-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-390-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-381-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-382-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-384-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-385-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-383-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-372-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-375-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-374-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-373-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-371-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-370-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-378-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-354-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-355-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-356-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-395-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-358-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-359-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-360-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-361-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-362-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-363-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-364-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-365-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-366-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-367-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-368-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-392-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-391-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-389-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-388-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-377-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-376-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-387-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6012-379-0x00000272EFC40000-0x00000272EFC50000-memory.dmp

Download

memory/6052-68-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/6052-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/6056-265-0x0000000140000000-0x000000014020D000-memory.dmp

Download