3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
Size 6.2MB
Sample261003-ntssmaxejg
SHA256 3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0
MD5 03de3074657bc1c752a0873c9321ddbe
SHA1 cf749dfbff5e18d2bdd7eb1d83b0dfa4737468f1
SHA512 4f28d1774adbdadd10b73a012631c0b4a9213aef7e544ffd4fa8c1d4e2639a42f9322c03a170ce99c60ff95fa1d2281a009d5636b093fbff2988db977edd020a
SSDEEP 98304:+wtymIbD8DEGVql6yuH2MvrL1jg3ms+Pm:vq6/PrxkH
TLSH
T162667B13F29910E8D05DD1B88B6A9232EAB27C894B3176DF0750BB152F76EE09B3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1636	alg.exe
1896	DiagnosticsHub.StandardCollector.Service.exe
3668	fxssvc.exe
3956	elevation_service.exe
520	elevation_service.exe
4888	maintenanceservice.exe
3992	msdtc.exe
4100	OSE.EXE
4860	PerceptionSimulationService.exe
3196	perfhost.exe
2088	locator.exe
2968	SensorDataService.exe
4144	snmptrap.exe
4788	spectrum.exe
2308	ssh-agent.exe
1104	TieringEngineService.exe
4296	AgentService.exe
4960	vds.exe
744	vssvc.exe
1196	wbengine.exe
952	WmiApSrv.exe
3164	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	alg.exe
\??\F:\	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\AgentService.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\System32\msdtc.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\System32\vds.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\msiexec.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\wbengine.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ed28a622250d612b.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\vssvc.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021277b332c53dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006602dc342c53dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095d8153f2c53dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f6276332c53dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bb10e3f2c53dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eafad0332c53dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa2ac4342c53dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000925cf2332c53dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3852	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
Token: SeTakeOwnershipPrivilege	1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
Token: SeAuditPrivilege	3668	fxssvc.exe
Token: SeRestorePrivilege	1104	TieringEngineService.exe
Token: SeManageVolumePrivilege	1104	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4296	AgentService.exe
Token: SeBackupPrivilege	744	vssvc.exe
Token: SeRestorePrivilege	744	vssvc.exe
Token: SeAuditPrivilege	744	vssvc.exe
Token: SeBackupPrivilege	1196	wbengine.exe
Token: SeRestorePrivilege	1196	wbengine.exe
Token: SeSecurityPrivilege	1196	wbengine.exe
Token: 33	3164	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3164	SearchIndexer.exe
Token: SeDebugPrivilege	1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
Token: SeDebugPrivilege	1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
Token: SeDebugPrivilege	1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
Token: SeDebugPrivilege	1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
Token: SeDebugPrivilege	1232	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
Token: SeDebugPrivilege	1636	alg.exe
Token: SeDebugPrivilege	1636	alg.exe
Token: SeDebugPrivilege	1636	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 1232	3852	3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe	85
PID 3164 wrote to memory of 1724	3164	SearchIndexer.exe	111
PID 3164 wrote to memory of 4976	3164	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
"C:\Users\Admin\AppData\Local\Temp\3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe"
1⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Users\Admin\AppData\Local\Temp\3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe
  C:\Users\Admin\AppData\Local\Temp\3258bf757dffa5b826097009e53e878200b7cfb0e79863683506b31f538243d0.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=122.0.5643.142 --initial-client-data=0x268,0x26c,0x270,0x240,0x274,0x14057ef30,0x14057ef3c,0x14057ef48
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1232

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2644

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:520

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4888

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3992

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4100

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4860

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3196

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2088

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2968

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4144

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4788

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1380

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4960

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:952

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1724
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8388a84673a2f7ffcce61535ee7d48655d70cabe1f6632c2b181e5eab17610dd
MD5 e5b84aac905d5b66498c9acd73ea7265
SHA1 1ff1380004a17600c58e906bcefdef9a6ba2ca10
SHA512 437624b35ce2e1e385d8d19d1129de05723722ed972dc0bef9633bd724bd9ae90dec37d746405efa50bb536c54ed643e033c21985dee8425d7509b0d3f38e6d4
SSDEEP 49152:Lb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnszjg3mjg+VBm:Z3q6sjBJjg3ms+Pm
TLSH
T1A6D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 49d611af30dfd4742f9d531d77242491badd233b1e849a302d410f2dcf649956
MD5 7305e89a02775a754dc509165e79e708
SHA1 cb3f85392d7a56b1c14adccdef9d28eac1f0f619
SHA512 be9fd078c726f1d44134359fdd27b93f515cb7f0c4c5b40b4c5444d2bb725f4db454bb4e679405ab49e36e32d399ae85dea8d5a88ce57aa6e834485bff189b2e
SSDEEP 12288:N1XLsswWkxy2lRq2czAYqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:jXYfDtczAYq+mjg3/+jg+V3RS7
TLSH
T17005F129A3D405F9ED6B823CCCA18511EA72BC4147A0E79B03E4E96A0F737D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 fddb2060ee86aa504de6758a6be98ca5c12ff6adcbf4a267d9d24a9196253e73
MD5 c5bad3461344cb84f186803abf4f211e
SHA1 a6a8e940d3cca948c0fc65f7c8ac27ae9a17cf4f
SHA512 34da959c5bfcfae7e7875cfd2179a291a14ec711727dd4627bc344cb2f2225d1629babfeba48a3dde41e090fcd86b3c9cb2a5d8def71b0692112fd32058cd36e
SSDEEP 12288:4XZNYVLeyUji0h90ZD0wxpGZIVuCrHspqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zO:I0Le5ji0hmxxrMpq+mjg3/+jg+V3RS7
TLSH
T138359E16F6788375D073C0B9C5D2A68EED71348257308ACB4286D77C2E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b60926b72334da11a4d8f951371a20c7c41f205f49325fccf420af0f2a46ca15
MD5 d254c3ba1eedea5c67ed35a7d5261107
SHA1 c963e2dfd9b5ed9e2361461b073c41533456f75a
SHA512 99abb8d0d065e4fed41b9469584752e9b620617e33a175b6b44f1e0e25a0b6af6ab8cadddc984480c68aad5a964a15d7eb2865bdc211852c70f402a7c9b09a7c
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWn6q8wyunq+mjg3/+jg+V3RS7:D/ezSC6vUzPveHjyLzjg3mjg+VBm
TLSH
T16C755B15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ee0071469da911538079c5918d49268e8e755e9549a367895cc6920cf88ac3ae
MD5 c7af26f946934294ac8f43890c37fb1e
SHA1 29736c9b83b62e9d703556d303114e5d8b84cb8d
SHA512 439e7bdbc90291ec54af99c573c41e426f0743a5557425f241ccf9662b4b2a45a89c08bd076853f5302e880db7c095c2b7573837839e9d0ecba0a58494b69002
SSDEEP 12288:7VJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98sqIbmw6eKMVxpT/z6dgFmIiDsEi:7VbqPb88hv/l+Ysq+mjg3/+jg+V3RS7
TLSH
T1CC559E66F6748331D073C0BAC4D2AA9AEE3234415B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 8796ae479422dafa573c34f557b9e7ce20996125ffd96d51b981623c1e6d4cd2
MD5 046449341be345bbec20f0d8b412809a
SHA1 b6ddffd29472acffbad67b79a28abe90ec5b535f
SHA512 527f15b4c5061b16f168465210cf863b59e766399136d62752f0b82469f12ca4e5220a7a68eb1cb4f4d1f72051d101405a1633b771134fde57b861d9e986b36f
SSDEEP 12288:lL9qIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:lL9q+mjg3/+jg+V3RS7
TLSH
T13DC42306830CA2F9FF7FAF3CEC203255D864DD8057E4551A15EAFE9E00F8AE2D985925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 539a794e2bae8b3c0027f7b16fe8821a2a34e64c9b3989829719683455783f71
MD5 85410343605e6e2ebfa5d4053293d9d7
SHA1 3eb4ebc1fbad12e6897e25391673b51b3b414238
SHA512 67d9021a83abbe2feafd3267de3ef8f2279edac71a6183a971b10022d7eda2f87a3ae661ba0c5638cd2a2223a38b09770be4fa094de5ae2b1aabcd1e44b051f8
SSDEEP 12288:3eBNUbTVO86UUqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:3JIUUq+mjg3/+jg+V3RS7
TLSH
T19305CF2BEE28FCE2C67E9D785A518340D772B8704B61A3CBD175C20E8E235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 399b692c11f6c9ed054d95a8a9c69090d540dcd4956b78392380afd6f1335185
MD5 764edb38ec1e27739bac5a08e22a1fe9
SHA1 d4d25e73b565f5913a15310e12fd6b2fa4ae7afc
SHA512 4316311a895398e534504e474f449d85ccfd25cbb6e89a8f43ecdad66b5d7e20958843463928c2579a920f5265012d3c8d7d809cd653e82ee42cc04061bcc890
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH6:6QvGAdlCEL8c/DRNw5CSjg3ms+Pm
TLSH
T1BE266D656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 ad09c51ded7bcf902363dab3002d35c6fca4713e49501e6f57ffd74c300cc4e7
MD5 0442331a7a34cc892ec2206fb996f96b
SHA1 b35e93b44f6d3af4419819398670ccf981f75386
SHA512 c7a62c37c510f64d938d832cb0bf7d91c84b1ec80717c2ed71654efc53e2fd4afa787bd766b6b59c6766349de7be451b1adb7f24dd4c560e799401fd8e0906bf
SSDEEP 12288:CAwSfxL/2Dc3RDLLmt0LDQewsAjyqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gE:H0ewsAjyq+mjg3/+jg+V3RS7
TLSH
T18E15E031EB74E036C67F0DB61B21D716582CBD204BA11AC3E3E89E9E49702D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d7e9c024d678675ab3bac5d4a99f678189fe2cc9b5c0342c4dcde791046b3cf9
MD5 53b66baf50d93b851692af9e5b79dec1
SHA1 64d3e2fc49559110a91bbcc2f25f89707af3c97d
SHA512 cb90dc074ea0e424caeed2fc37e35b061525b8ffaf079cc0c00555c731d8fe0c75749a3f111e769162ef2014e9a475429b046083e58d8a5a8ef410cb57b9b7a5
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHDkH:6UEtQevvqc2W1cpV2tI32wH
TLSH
T126474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 130c589bc928de604a0abe2f50fe0d3283ed0d1963cc8e4a06e5ad84c4f5bdf6
MD5 4fff369b41ba8280601d90aa3b32d34a
SHA1 204a1badea17c2921420c194c24f416cdadab13f
SHA512 a9e20e45604308209decbd88e59fe3ff2706c3f3ff18bc2dae51e64fd7948f02ec54213c8dde92b0650a6b7738173a9dffada46443c74f145ac2ee8649cd265f
SSDEEP 49152:1CbRquA/m2yL5zifFiV+XenmE3/zfzjg3mjg+VBm:ioqHVjnmmjg3ms+Pm
TLSH
T117D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 18696289493387d8e18a3261a5da02698e683143276b97fcea73744508ce4276
MD5 f34dffe8286e3101276cee27e421b77e
SHA1 82a5bf0047e54b06de4898ce918089cb0b58856a
SHA512 deda6605fd1e705642186a0b8e276a36b12123d9074128ef8ccdcfe737077e06541be140b3e6c4e64b418813d45096fc508cd1e6b5afbab9aa54fa254a4d0e7a
SSDEEP 24576:pAhGL3IFoiwtA5l7S53zq+mjg3/+jg+V3RS7:pAMUFoiq5Gzjg3mjg+VBm
TLSH
T109359D81E7F951D4F5B3AA7899B69171EA76BCA65E30C20F2160D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 a524906621eb359f7c37e8219d733b8d7b1a91aeb90326e8718b0a9562dc213f
MD5 b45b6dd00d1bc4a7189dad8fe346bf11
SHA1 aaf968f0f8cfaa2751249d16b807171691ee4413
SHA512 aa2b765f4b588c75acc69196b137fac6eed4e92d75c0e3386118b7b1c5eca6e050af3239db6bb532192fdec09fd56fa58c3aa81bab9bc52ce6c04a7cc5be12f9
SSDEEP 12288:Qmw5HEjsChNVBFgl0WDm+CHqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:Nwu4OWuq+mjg3/+jg+V3RS7
TLSH
T19305F14673A818F9E97B9638C5538136F7F2BC012A60D71F17A0CA5B1F77361AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 47774e6936a6a0c6472f509140537221de5ddd89091c21e736d5db9a9b045832
MD5 32f4c7d42e76888889483dcd1db2d64e
SHA1 e78dcb63bbb4ed275ba2953af691f7068c17d90e
SHA512 aa58d7f3b4cb5488f4c8bcc41f347c91a520b0178398b24025d3d60e63c500182104ba1efad2842ff364425e9f9e10c4e9e5023fc5081b93d34956cd988e246d
SSDEEP 12288:WeZ1IyCqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:LZuxq+mjg3/+jg+V3RS7
TLSH
T1E4E4124A239871F9F5BB973CCCA01245D771BC5153B043CF12A5AA6A0F72AD29D35B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 72aab00df99b1a8a01ea7e86ee21aba2a306fd12550bb7638b0e93d8885b04b9
MD5 bb6ea5b5ffab783d06a96e4264b98850
SHA1 33712bb26f6070078033cfb7a697bb7c909b4bff
SHA512 65cc55534a6602f8c04b5e5eba18670d88bca79a0f6e2c24d36c25c9afc2ea1b2189adf519f0b050ef999b7358ee287effbea96a21b158eea94c92148e7d67b2
SSDEEP 98304:GQRQyi36YOcPbLvw2gAf+PN3Vjg3ms+Pm:tQyiKa/X+PNFkH
TLSH
T166667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 aac1625a17a081b0179a0519fc38a2f6bfa5cc8a0abe17f435eabb97f1f1aba0
MD5 0473aebf46ee25b0d50fcf20e249b851
SHA1 0ad32bc1edfad47b19274bbc657b4b0039c8c674
SHA512 8a1200a4ab4dbc73d67105a68acfd3177f628a24d1971ee7f6a14d9cdd98af486011e7ce645af03b2d4e6490df3acd86001cf15e852a9137e332b0b7ab0b0527
SSDEEP 98304:7QRQyi36YOcPbLvw2gAf+PN3Vjg3ms+Pm:KQyiKa/X+PNFkH
TLSH
T148667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f896973053f5f8f7d64fe787675c4c01f233e3eec66e52369550f3b9b6012537
MD5 3676256b3c5f067ae5415be8890c1dbf
SHA1 1dad17dee1eddf1651816638176c4e927c2e829c
SHA512 6c74f406c57f42140df390367a73e7cedd4c3fc1107b131edb6ee4b769b79797c23c5331a17929221f222046f8352eaec784adc7aea0117b37331edb34ee1cec
SSDEEP 24576:QwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0hq+mjg3/+jg+V3E:W68Qg55nhceWu7PNU3/vzjg3mjg+VBm
TLSH
T186B55A33B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 003795344bbbdb959640f43ce856cda1f5a245d176dfdb28496d7e868469a68a
MD5 4e4a04fa3c291f666b6fad29b5f06691
SHA1 5b276e69e9d628a691e400a337686e97178f05fc
SHA512 969d7e5e7d4d0472c8084ecde24384b110f11271a77cb998acc4ee8f5d63c7a77e7af47f74e247f41ccb808d5e13b59cc51c04c8715360bfb7a2543b46792819
SSDEEP 98304:cy5112gYy5azzVvt69nLKnhZMjg3ms+Pm:dLIHEWhukH
TLSH
T15C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 463892875fdb0f7033d4ee27c9d237ea0f89d391ed4e0a8f15b1043b4e0b0636
MD5 97db8b70a758ae96378fa7d78409b066
SHA1 21fa45275eb349bc22f2d6b1a5eb7cc719d53ce0
SHA512 4fb8579a6f6c369eff04836b1be9f05e0e277bfd216c895156edb2e2aa1dc4676cdb773afba688f927715da464a1611202fed18bebf23517397ad9bf7b8df85f
SSDEEP 49152:CB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gldzjg3mjg+VBm:wu6Jmdxd2dNjg3ms+Pm
TLSH
T124D59D13F2DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0f4d849185bc9c34a63e6526d5c60c381e9a02859a12ddf952a1636abbd8ae39
MD5 cac0000d72f270788e94ab6f28ec23be
SHA1 3e2535dc3f6cc3b5b3082b424990e9181c864ac4
SHA512 e671d6c436dc0b10375f34448c22e95b4e5402b711022c6bb31187e4eaa78abd64b538efa471a35791c1873013af55306c6f64d5c862a4d09357c34427e7aee4
SSDEEP 49152:M1hpsNoJpF1A63U44CwH7R4xZzjg3mjg+VBm:MmifPWRmjg3ms+Pm
TLSH
T1AAB5AE13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 54e58e0d57ef045385e4739784a2998041a8f6d08c7edd475a11e2b7ba3fcbea
MD5 9fd7b9723072b839812bbb89983adf94
SHA1 55d8fed2c47090db3e6fc4f9588da460237da0a2
SHA512 35083787564d804e95c4466818cf9ec99b6ee87ed452442d7db0e2ad26353c9262d08524f43f4ae65985515679ab68e0fc35d87fbf4efa6d8124662d13cac841
SSDEEP 49152:VSuZQIY0Be2KcRVtOnks6NMHq8zjg3mjg+VBm8:75dKii61ojg3ms+Pm
TLSH
T153C5BE03F2E941E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6b8a108265ab3ea6e3c1d52918ef4bd9abfe1bc5db221b298e62b7e417e17ffe
MD5 8eff220b9a7a9cfaacd4e280e4524daf
SHA1 62c9926bd20b8374664308fc78569b14b2ec5096
SHA512 9eeb6b04d3a35086fe13be11a379100fad6dab21efd649c72db30e168d89744c5faf95e6aedbbd6a9d2dd38dd524e17188f70a58773fadcbb8fb203add2bf353
SSDEEP 49152:yhtSn8EApI0fig3giDn0AP5wtzjg3mjg+VBm:zX2imph6jg3ms+Pm
TLSH
T15395BE13F2D901E8D06ED178C7468632E962BC150B34BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 54d28853af4795277b842c223cb773c0a0588de8aafc4086f4f86bb165269dd8
MD5 183f999bbee44047cc20a6707b5a1c10
SHA1 20cad979623bb547ec552be9c67d96ae85f3f328
SHA512 e6cddc0efdefd7d540023bc26baa3f7f63f680aa56e0e48ed822faca08554731b107f2d84462c9cb5f169f0b6f24d09925ce711054dc72a51e241dcc2beea91e
SSDEEP 12288:aFqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:aFq+mjg3/+jg+V3RS7
TLSH
T14BC42306834DA3FAFE7EAB3CD8102394D864DD8197E4515E26EFFD5A00F4AF29984C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 c6803edf38c203989df9f9b75df8cdf76d7f3be59ded92f268be2e07d08423ff
MD5 d56a0a716522a4d6b0534ddbb76dee77
SHA1 5fea3482e650edc8f8eb0d29864d56f5cf28727d
SHA512 93c9f24e733fc3a07fe4a15bf8c9ba5c56405e14de6f39ba19b75c2b7b49665d01953f9b79b9ee484c3682a890d676808b1c9df4df9636d90cb6b9bbe40595fb
SSDEEP 12288:fGqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:fGq+mjg3/+jg+V3RS7
TLSH
T1BAC42306834D93FAFE7EAB38D8102294D864DE8197E0515F26EFFD5A00F4AF29985C35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 a974763d2a89c2d9dfcf1322dd56e17654be588d197198ea15e36dd6b835f14d
MD5 d1454086ad4b8a3b0e484158226af840
SHA1 78394cb4f6c726f9246b27f2a8deac5884f59064
SHA512 89e550ca38d59c897c581dc09d415baef1336238cde7dd92fd521ff9f990a1c4bae3172e1afb08761f6b8bdbde1d5952281e889cd26ebbf3c1bdb31aaeac785b
SSDEEP 12288:icqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:icq+mjg3/+jg+V3RS7
TLSH
T17BC42306834DA3FAFE7EAB3CD8102394D864DD8197E0515F26EFFD5A00F4AE29984C65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 a35efadcaa548cfc35a33f3c05ba674003a6f46b8e926f027a2fc7075d8386b5
MD5 5f56d9f7075c9e5c26d90f14d0ab1042
SHA1 91f2d26f97f6cbaea5251432711bfae33d42681b
SHA512 8a62a42f5ff81efba456b800f5b4b9714f13107455a1e05289091dabb165d6ae636e87637371212da4e6d98a79809540c6577eed40ae110dec2e72eec25f6c7d
SSDEEP 12288:zVTqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:5q+mjg3/+jg+V3RS7
TLSH
T1EDD42206835D52EAFD7FEB3CC8202254D5B4FD8097F0929F2696BD5A09F0BE19D60E20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 14b68065fe9443dd8034891904725f40eb362196b2054b4bc3c96b86b3f6ab95
MD5 eb919d80484167e4a52d62631a09ea1e
SHA1 dc0eedbcd84c4f1bd2ddcf5954402689f474e572
SHA512 9cb0595e0fade3bb826a6ce581f5da4dfdd816dc1a295f392d36668ea98d8e618b635a6beb48ae462e376a1bc8f9f6cb791ec99d0790633ba4530306e62ef9ed
SSDEEP 12288:lLqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:lLq+mjg3/+jg+V3RS7
TLSH
T107C42306834D93FAFE7EAB38D8102394D864DD81A7E0515E26EFFD5A00F4AF29984C64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6b9db27c4e4a32fbb49bb10b586a0756c51adb2c2a5019046766417288f02714
MD5 b90a90262c4fed7c289dc6204bfea633
SHA1 5dd271a3c4b55a39eb6ceef3278c35a49e6fe7d2
SHA512 6baccf1160676238cc8f0f928e831967b517d97dc7cd448a88e21a1ae273664a9242ceb0b8b6eb0edd849971bb521834e27f888bb3e471b377dcabca6ebe3205
SSDEEP 12288:8aqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:8aq+mjg3/+jg+V3RS7
TLSH
T193C42306834D93FAFE7EAB38DC102294D854DE81A7E0515E26EFFD5A00F4AF29984C75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 e9f2e91835b12da8ba098d65883f08c5349bdbba939693e32ce2778e276fc5f6
MD5 3473fb180a8409a932fa8620226d4268
SHA1 1cfeb7582665c54dba3db624d86e8955ae2a84d1
SHA512 3fac72b3734f9663e358d478e2061d53667f076534f8899e2d28525b22fe512821e597d15e4d6c7e5fbd3e1837765cb155f17bb1eb4dbe65c134aa1fe5d6babf
SSDEEP 12288:beqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:beq+mjg3/+jg+V3RS7
TLSH
T104C42306834D93FAFE7EAB38D8102294C864DE8197E4515E26EFFD5A00F4AF29984C75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 3dc19a2154665108053c78596d9e71bfa16c678e8b92258defb02b628cedba10
MD5 088299f2a6fa71d3748d0e1202678bad
SHA1 beb373e492a0a93bce60ff44cc17625760ac6259
SHA512 05c973e16d5d3e08bb6fe7d8c9929ed290c219fd6bc902c52c91edf3c5e6181324c0b48d3908855425576aee5f80ffcedef5080c50e99fe6f9c8db3512ea408c
SSDEEP 12288:iiZwbVzzFEoS2cPvymqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:FZMRzFVSOmq+mjg3/+jg+V3RS7
TLSH
T12C05F195B39418F8EC67823ECC215906D6B2BC5907B0C61F13E87A6A1F733A15C2EF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 bce79de7a4872aea9b0f8c7b6690392d27989922002c40325df28637600b107c
MD5 825e7fcfd36ee257414bc8ca7c7a48ba
SHA1 d969562bf80b3ea96924eac609656dd12576c1e7
SHA512 5c5d000baf1d00c3b25254307bc9b5986168764a19c4485177f13732fbdb47e69e5411b288dbbefc4447496b2eb28c31caf9dadeaa3fc60ae484432dd039b064
SSDEEP 12288:ABqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:ABq+mjg3/+jg+V3RS7
TLSH
T12CC42306834D93FAFE7EAB3CD8102394D864DD81A7E0515F26EFFD5900F4AE29984C65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 eda5d7c9198eeb68aaa6287a109ad4a6ee040af3d4fd4d69d9bb080a21846a5c
MD5 70b220002c9ef707ee0b9f770ba68b4c
SHA1 d471083571967288d2e066efad4d32fc8b56ccbe
SHA512 c4d88cb45674fd66568bb66c02c36cec3e17a2e10031def1389a57cb0be73814f442ae5a99305a6d1546d81250d3a62ead2b0761e2cfc23c14982ca9346666d9
SSDEEP 12288:lNqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:lNq+mjg3/+jg+V3RS7
TLSH
T1F1C42306834D53FAFE7EAB3CD8102294D854DE8197E0515E26EFFD5A01F4AF29984C35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 ad44f97130ad81155388ad8fa4b19ecaca13db2c56c4c5bcf28a3cef66eff318
MD5 c697ad9c0b13514448355eaf06817f87
SHA1 e16a58cfccd696fbc94fe5748c76006f777e790d
SHA512 0609540f69565646c1b021281b5e962353c3b708e5e0626e1db0371b4995dbf7cf068d2a2faf2585934e9799a72aa824de093a34ce908d4684a34c9e7570b39b
SSDEEP 12288:nyPz5L8CqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:KzyCq+mjg3/+jg+V3RS7
TLSH
T10DF4020763A931F9E53B9338C8611601F771BC7147A08AAF13A45B7A1E776E19D3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 ccc3df220537f370434ce008841437115e869f2fc5a69d9e764cadb9357b48d0
MD5 c3e9ed935eb0f1290f3ea35180a3e157
SHA1 7b05df8a94e99594eb0d1f228eb9ef2ff91e86c2
SHA512 c28fff7f9d623ca4ab5dd55f92d25124f5d2a8e19f3c7c65caa3aaaa461a0bea5551f872e61a5b0fa2866a344bb69d74f606d59431d03bc81571771cada2e4cd
SSDEEP 12288:qBqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:qBq+mjg3/+jg+V3RS7
TLSH
T146C42306834DA3FAFE7EAB3CD8102394D864DD81A7E0515F26EFFD5900F4AE29984C64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 6ebab3db81bad747e0d2926cd4ba0c28531b55d7e4edee91febc64601e64858f
MD5 76e5c86c9e11c2a05004033f561882f6
SHA1 2c99ae0bfc2aec861ef9772651ea619a3e1d8769
SHA512 eccfc8ba5e6e4041452eba336dd20bfe67610a67a7f76bd2e2dc0e06fba9ab1f7d1bdc2ed76fc8108f793f3d7d19977fba11f1634b7944afb8dfb3ccd7f67b1a
SSDEEP 12288:2BqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:2Bq+mjg3/+jg+V3RS7
TLSH
T1F5C42306834DA3FAFE7EAB3CD8102394D864DD85A7E0515E26EFFD5900F4AE29984C64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 6c009c1f845031006da2edba938c7f2061ce4bf8f0785f2d9ec93c954a90c7b7
MD5 223e0b267bca7f7e71e0fe1531d375cc
SHA1 a931cb7b2d67044a065db88b9df5a4752ab12866
SHA512 26d37ad31de861ca743756f4475b7cba41e87b58f5cbb9c7eb8a205812ff000b5cde8d5bfb472b95829f00e0094d279aefea254909befcdb1c93dbed8d9f398f
SSDEEP 24576:WcP4mcvIjkGOxhKP2l71SNKbrh/8KBZq+mjg3/+jg+V3RS7:xP4m4IpOO67N8K6zjg3mjg+VBm
TLSH
T1E265AE2DA7DC0096D0BB917885658A49FAB1B82A1F3286CF1160933D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 c6edb35b81686bd60ad12f4a242f3051713fad3274e2433a8ee57072158835d1
MD5 256948797e167ff0eeaf017d6060ce99
SHA1 23bc606a39f50593a203a9deaa7a7151a2bb27ed
SHA512 f355122b45111417f71170ba483d3df66fb6894e7d7cac503b165db92662b78b9613ffc8482b1772f7c08b0e2fb24b5e7a19516c147a53f50308f793805f3326
SSDEEP 12288:RbsfxqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:sxq+mjg3/+jg+V3RS7
TLSH
T1F5E4F00AC39852E8D46EA239CB511641F733BC6583E1D3CB22D1F93E0FB56909DE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed28a622250d612b.bin

Path C:\Users\Admin\AppData\Roaming\ed28a622250d612b.bin
Size 12KB
SHA256 8e04c922752b19ab533f12e90523714929fa8240310750669ccec4e25f387b95
MD5 ea31b4f7ed6536cbc8d098e004dd048d
SHA1 4181b7fd16429de8b51c9e60e3be3fbe770eff16
SHA512 672af6ee63c3ef1f919fa164de3fc1fa33e7ea40723f5207092ccd70184ecac76c98625ba8c4cb8e7ede496ede1d854e6c684cecb1bb337d108abbbdfc61916d
SSDEEP 192:YOasf+a82DSoxOttvc6gdMy1RK2SvaA8/3dxquKCSsM/tLHR7x9hrHNd:YOBX82DS5v4mys43DqeSXZxJHD
TLSH
T10242C00D1DCFA8E2A45B882A71B19F4A8D37EC234008A50DC43B4713FBA7B353D52A76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c3e458e84fd05452ebaf802c8e82f56c472429734c49809349812b1f896c0ade
MD5 bb8584f469b5c45a0bb6297468a836d8
SHA1 e6d2da0f07e78bf8561394d95cb1d6245915f613
SHA512 384443e6bc2a3e6135e5f078d212cadfd870a9e17c2ab9b45616e9af24913311d24079b29bfd5f1ec9d3958a6e1310d8959cf25378abb09b1280b7ad35695561
SSDEEP 12288:9RqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:9Rq+mjg3/+jg+V3RS7
TLSH
T125D42306C35DA2FAFD7FAB38D8102264D429FE505BE0914F359AFE5900F4AE2DD50D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d6a58554e439e759fe40fe1a0001e1601fc874fbbe688c46a1103a66a2f3a1df
MD5 7fdbd95504e3d376ef399b529e56939a
SHA1 ed116b6d8dfef326cbbc847888484085bc1e3198
SHA512 28d750f85b68626261e3091bf5d75b6c61f07d803a63e281addba3cc9ab8f7f700b2f7192443b91f15e1fcba24076247b29475636c1abb81baa9d109fde4da23
SSDEEP 49152:fa0h2GEkuAe73q3pp46zwwQOzjg3mjg+VBm:fa0hNYG4JwDjg3ms+Pm
TLSH
T1CC85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37EE44D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 23600046fe4dca361d1182e9730b7b4484fcd9ff355cd9d63d359205b1508490
MD5 61d24af52cb6207e1602bc68192fa6b5
SHA1 6a8689b6a311add25fc4760f5003440f6325a0bf
SHA512 f147580835297cea03018fabc1f41c9778f21a09c9290de2ec41c630b4cdea6f9d0fc8147076b3878b1923b5618bad2aed46830a9a2478b91a6fd0829f02f54e
SSDEEP 12288:LhbHjfX2qIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:LhbHjP2q+mjg3/+jg+V3RS7
TLSH
T10BE4012E13AC21E9F97AE23C8851424AD730FC65176093EF22D6D27A0F7AEE15C35E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d4faf4fd63ec666bc389553f3dcc001adbd5bd763966980b131604e46b64be73
MD5 7321f22a3d344b80b83b7c0bbca5e188
SHA1 60435a76273c42e65a38d9d8e72f8e2ed313ab9f
SHA512 da50840a0d4683a12fbda5f16f328ed072828e37921e5d95044c8f2838b4cdad04f159983d49ad7f2dcea92cd4ec361a0e5e2998454ca0ad600f204b74237102
SSDEEP 24576:f3YgnJcRTk4yti+R5dpR/uq+mjg3/+jg+V3RS7:fIgnaTk46ppR/rzjg3mjg+VBm
TLSH
T1FD45BF2DF3B910B9D8AAD236450143B5FB71782D1F209ACB0174C538AF1AEE89E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 dd8f8009a3355f2cc5830be0ff398c08d4efe35abeaf332dc131914153ae025a
MD5 07aa925dedd4ee84b027f375e7ce59dd
SHA1 51894d361e20a4d914d1ca75527ffed90e0a5aa6
SHA512 f7d41b7446138d3c4c1a2c547756d51706416dc3c7d70cb67337146eb87dca37fe33c51f389c298021bb455b091b3deb81a29b5ebb1e924b3e84f442bf01b648
SSDEEP 12288:gdqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:gdq+mjg3/+jg+V3RS7
TLSH
T1BDC42306834DA2FAFD7EAB3CD8102254D854EE8057F052DB25EEFD5A01F4AF29DA0D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 578a1a6f7d25a0a4733cb8dbe8832003119a9913c8e449dd78bc6653e9317388
MD5 2683cb553f9241061c444e5c47f9d72a
SHA1 6a2520174f96acfb39031bd91326654a72bff8ae
SHA512 650964b34557c4cdf36b18a6aa15a0f039ba352049325c1904c29ffc40ee26cc4328b386b68b7f712b1d49dd004a1d1de0fbc127d0438b52349994fcb695f9a5
SSDEEP 12288:PObfA4LWOsvAYFTYqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:QbL3UTYq+mjg3/+jg+V3RS7
TLSH
T10A25F105E79800F9E97BD23CC8629616D672BC5D0364E7DF03A98A651E737E24E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 2e85fbb7a2f9c79bd6bf8190f8f74178ecf6fcccd3b7173ab0d63945612b1a5f
MD5 166f6fb97d4e60de976165067d94648b
SHA1 4616d0a336787b7ea999551d7de47f83e3811626
SHA512 a1e026eaf0849257872fdcff185b06046106529134c9fcd92d46a01cd64c468cc510d216e3ffe54ffdd702a420c1d1471b419889695d471b2f4f6f38ebc7a2b9
SSDEEP 12288:hpFtIO0qIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:gO0q+mjg3/+jg+V3RS7
TLSH
T1C7E4010A239D20E9E57AA23C89525349D771BC61076153EF02E0D5BE0FB7FF4AC39A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 97389d34e7c6b7229662dc26768d8450ffc77c7c52e0ec2f41364e059291ada9
MD5 fb9dcd9e2dbb7e746cd9f94763b5c55f
SHA1 ca810842f71b0b2c9a96a93072bf82962b4added
SHA512 bfe6234fa667eee0f6c703fb37d80e19893e0565769f2faaab088f1b0bf42ce0b45a81328ab8c0bf26bb2fe5649e82eee4f7df0412e0f80accbeb843f547507f
SSDEEP 24576:f7NM9YmZqmWMUkPjZM48Mv6bEhsBq+mjg3/+jg+V3RS7:f7cBWMpPjN8DbEhTzjg3mjg+VBm
TLSH
T184659E2E6BAC81E5D577D13DC9A28205F6B1B8611B318ACF1162833E6F37AF44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 324b2adc6a0e69cb6aaa4bde8ca7da7ff737a3b864bc617bf5fc7aa9a317d893
MD5 b7038de8fe934cfa6cd54374e80573e4
SHA1 96bbebf992b74c016590cd947eb41186248f3786
SHA512 46b59e382a7aaa1fa05418eb44e0baf1a48a63b5432b7c6e80b13cb4e10c45b3f5bd9ba35af91b2a48cfacfbc31fa44e27ed53c57aa50e39d4cfef7850f79e93
SSDEEP 24576:rW6BApg2YuyuNDYTabvcRvNYf8km1/q+mjg3/+jg+V3RS7:rF2YuHNETovcvNYf8kmszjg3mjg+VBm
TLSH
T1BD857E2967ED80A4E0BBD27D45B69246FAB2BC511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 895f5c564ff30bb5e9992a27c04d2a769b298de7c11a397dff16a741e6d5adb8
MD5 ea16c4491af319d638d4293ed7b76620
SHA1 018fd2ba2ee2cd2978283928d5dc42f152859ba0
SHA512 368135a16fea8338c2880a73b7c63de991934e3f433c93b35595a9b71a97ccc21f25e73a51f2f20d08eafe6978611ec4645411168c7ac80892177cd9883f034a
SSDEEP 24576:tAFs06+OmlfkNXEbTogq+mjg3/+jg+V3RS7:iFs060lwXuuzjg3mjg+VBm
TLSH
T15465BF2F63AC00D5D07ED17D8996C91AF6B1786307255ACB0260C63E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 a501daeee1547242ee5297e91cdcf74ed090cbb388d12179a668bb845e84bb4c
MD5 89869a735fba70f36e8248cacd0fd97c
SHA1 2e6984be84ba210f8371d88ed91d8e05d1b624a4
SHA512 c7a40402a82139aa778dbaf64a0540e75951f7bbd8b77fbd709bb5fd54cf58113f3819201e431d766b33c97905f616322ae83f8198ccf5965d90057e0261b571
SSDEEP 12288:jCJnJ5D3VkrlzxhqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:+JnJ5D3Wtrq+mjg3/+jg+V3RS7
TLSH
T1C515D02DD2A810F8E4B7C37481592755FE72386D2B226ACB28B4D5353F22FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d56b0806845198f713a43308e768ca128f2f43a2611c3ef394d189a0f1dd732d
MD5 e7e192fc0e995f89e7f581ca53fe59d9
SHA1 bd5be7e7fae4eaac5f0a78869d2063203d0c0e58
SHA512 e259419c7f07137c3910309ba899939919d2c038236abe3d1eb76292b650980c34824f1bbae045c28ca163a3f307cb6c6af5ff2b3d06b52a2c591a967456c6da
SSDEEP 49152:0o06DIKdwc+eQnSt65aVgzjg3mjg+VBm:pKjg3ms+Pm
TLSH
T105956C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 a3545e7692243261548fa91a60c3207e60a8e35f6651ed3b6f028c4793480ad3
MD5 25aa33d05b0c32675d8812c94fb8a964
SHA1 5cf43c81f23bd32b613bf35e4722c874a1e8d348
SHA512 a333d08fa3862cf4c63e852200cbd0b9ffc8b14f4d8c980ecdb3ebe707d7f7898228499dc9f944b35ba8c743bda135171ce759b773b8148c941d87d7bd269d6d
SSDEEP 12288:hEP3RrwqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:Srwq+mjg3/+jg+V3RS7
TLSH
T1E4E4121E579C70E9E53AA23CC8504245D3B1FC6027A127EF16E6D63E0EB6AF65D38E10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 943e816e1879abf9aafcb4be54b906f4dace807eb87ec919b0c262cec7ed1bab
MD5 a9afd94d5e975eb2506b4b67c78a3b4f
SHA1 0a03f6f77c83bff9b47b3fe8c87e8fa93d04d8df
SHA512 df47467fef3fde7806bdaf7fa998b67d5cba9148e31dffef9c4c337b6ab0c3ee0343826edb5a3188d01fd8a70071f9f8c0464afbbeb1d9f242997d3da18926a6
SSDEEP 12288:ajkyGqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:aIyGq+mjg3/+jg+V3RS7
TLSH
T136F41205539CA1E9FABA5B3CD9625290D934FC205B6052DF21D1FA3E1EB5BE1AC30F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 e9adbae3eaf27054141272f06ca8b1147ec3798f0101b22a295c186230b5c922
MD5 f1b4613e85f53243075db8af1d961be7
SHA1 8ebe96619a1eaf9bd0962c7d31361e16ed5cd3a8
SHA512 b72a4452b609f7b69628d979a78d13a9fcb37e43059f73f9342f0beed0b6e994f9a2165aecd26bd13aa6b020be16771b8f66b9224ad91cf9d3c4654da6b48d02
SSDEEP 12288:RFEqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:XEq+mjg3/+jg+V3RS7
TLSH
T196D42309431DB2F9FE3EAB3CD8202294D460FD5057E051EF25EAFE7A05F4AE299A1D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b51d476efd3c6dbb97b4ab51c121cf15cf139b874dd9c43de59f55c82db9e3a3
MD5 997d3bf9583fd499f460cfac78cab7ec
SHA1 9bcaf404ee9f97f82c46a514b2abea0659ce6ede
SHA512 6b5708d364c66106f59bf3f0158ace0315d1c269447d35c10814d02b87bf51da230242e7badf057464f9bcead9de766e1d6376127fff82f1c3fc82394ab77012
SSDEEP 12288:rLQZb3C97GYnZMv5zBcKY97MD3JqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRm:nQ9MxZKdcz97w3Jq+mjg3/+jg+V3RS7
TLSH
T12A557D2DABE9059AE177D239D4A250C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 0a759c6913064a380ea93effa0a222d1dd6afe7a7e030983ee01336cb74cb723
MD5 6f70c6081fe20f05cc1e78b8ccc186a9
SHA1 fb553afe30413d1d4d5c93521312f39fc215a133
SHA512 e933508a5433f0c6649cec62aa6d0cd186f300b8b2c48ffb271113c3f84282fb879861b90f1f783fbc98b69102412bf827c63326458522488f23cf3adb0f6bd1
SSDEEP 12288:UyoKo2HRple9pyqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:UyocxApyq+mjg3/+jg+V3RS7
TLSH
T1BEF4DF0FB76D40E2E176923C88818345E773B8705BA253CB6691C73E4E77AE9BD34A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3dc18cc92dcb205c2f0e389eff67ad8ccbd457bf9153575f4c2fc5ab3f223df6
MD5 5faec0e2f4b9a70ccd054ed55274764e
SHA1 6b80ff90943cd5e3b1632999a6594be41b492d2a
SHA512 7f70fe91df5e684bf7b80737e61299e158e990474feb87154262487498c4beeaa8ffa89eac90d09b2bfe097b696242a08a6d06e6c0e4d8917e13476ce0d1970e
SSDEEP 49152:QWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK/zjg3mjg+VBm:C0zuNIPjg3ms+Pm
TLSH
T1BFA57C3DA2BC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c1aea98d67152d2e4ab1bea800fef4c3c4abbb0e9d4e89163260d8efa87b334c
MD5 86d931b5b767bb56a23e546dda0cb4b7
SHA1 019169a2b5d647c0c21cba0d5f8371a5f421e54f
SHA512 1244bf945da2b2e7dcb7234639568c7981c856603bbec45346df88ae8d80bcf97b9c2eec3df8f6194e9f0d6c2dafca696311ad4fabef28dfa2da93608601eeb6
SSDEEP 24576:K1QT7EcpfxR+N5AWAz3ooiYujMqbHq+mjg3/+jg+V3RS7:3TDxR+N5YzT4jM5zjg3mjg+VBm
TLSH
T16855B02EA7F815E9D17EC6799A238512FA727811033193CF42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 9d249fe22d15de056656c8947b7fa33515ef26a1382d3b822d2757ef540298fb
MD5 8a4860b7285e87e7c0c6e45dabd1eeb7
SHA1 f0e9fcfcb266a04634461c02097ea281a0c9f7ef
SHA512 59ecfceb1c3d9ea46101336ebd81b364fa0e59b5477c9b279db78c086d08a019733daa5b074857faf331a0f04438e274d6e693d85e0dcabf78de96fe70466e04
SSDEEP 24576:dTMdOz0FFS+bmSLTq+mjg3/+jg+V3RS7:n0K+bmSL2zjg3mjg+VBm
TLSH
T1CB15E13EA36D14E5E47BD27CDA438906E67278610321A6DB06D0C1792FABFE47939F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 62b6ebcc7928d7aa5727dc908c889d67404e3a733f5b46bc82590aea9af3e1df
MD5 e11401a296a3a6b33a6c386ef3e60f4c
SHA1 7d4411bef9c664183c7ddf548171903e9d6c3d76
SHA512 326fd78b37c48aa1cc03baab59d397e5af37d706a6682924375cce7b0c78df4153ca9a1ea7346b6c36122cc3de5567960761e16ba0dbe4d6486a4522ce302a1b
SSDEEP 12288:Q47YqIbmw6eKMVxpT/z6dgFmIiDsEj7kg5zYm8gRVWlqU:3Yq+mjg3/+jg+V3RS7
TLSH
T13CD4120D53EC31E8F87AA738C9211245C570FC6113A056FF35E5EA7A0BB6AE19974F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/520-377-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/520-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/520-76-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/744-225-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/744-387-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/744-231-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/952-393-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/952-245-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/952-251-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/952-522-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1104-385-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1104-198-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/1104-192-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/1196-392-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1196-241-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/1196-235-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/1232-16-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1232-31-0x0000000140000000-0x000000014065F000-memory.dmp

Download

memory/1232-472-0x0000000140000000-0x000000014065F000-memory.dmp

Download

memory/1636-35-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1636-521-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1636-25-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/1636-34-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/1896-420-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/1896-40-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1896-46-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2088-380-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2088-146-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2088-140-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2308-384-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2308-188-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2308-182-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2968-156-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2968-381-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2968-471-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2968-470-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2968-150-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3164-523-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3164-305-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/3164-396-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3164-262-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3164-256-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3164-286-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/3164-270-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/3196-136-0x0000000000760000-0x00000000007C6000-memory.dmp

Download

memory/3196-131-0x0000000000760000-0x00000000007C6000-memory.dmp

Download

memory/3196-362-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3668-50-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3668-96-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3668-56-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3668-94-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3852-360-0x0000000140000000-0x000000014065F000-memory.dmp

Download

memory/3852-6-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3852-0-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3852-18-0x0000000140000000-0x000000014065F000-memory.dmp

Download

memory/3852-21-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3956-66-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3956-60-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3956-366-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3992-378-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3992-103-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3992-97-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4100-114-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4100-400-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4100-108-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4144-161-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4144-382-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4144-167-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4296-211-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4296-213-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4296-208-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4788-177-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4788-171-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4788-383-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4860-118-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4860-124-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4860-419-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4888-86-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4888-90-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4888-80-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/4888-92-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4960-386-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4960-221-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4960-215-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4976-482-0x0000023313820000-0x0000023313830000-memory.dmp

Download

memory/4976-483-0x0000023313820000-0x0000023313830000-memory.dmp

Download

memory/4976-478-0x0000023313820000-0x0000023313830000-memory.dmp

Download

memory/4976-481-0x0000023313820000-0x0000023313830000-memory.dmp

Download

memory/4976-480-0x0000023313820000-0x0000023313830000-memory.dmp

Download

memory/4976-479-0x0000023313820000-0x0000023313830000-memory.dmp

Download

memory/4976-476-0x0000023313820000-0x0000023313830000-memory.dmp

Download

memory/4976-477-0x0000023313820000-0x0000023313830000-memory.dmp

Download

memory/4976-473-0x0000023313820000-0x0000023313830000-memory.dmp

Download

memory/4976-475-0x0000023313820000-0x0000023313830000-memory.dmp

Download

memory/4976-474-0x0000023313820000-0x0000023313830000-memory.dmp

Download