85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
Size 6.5MB
Sample261003-nttpxsys8p
SHA256 85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80
MD5 01f9f55c93f575330b3bc685f8a3465e
SHA1 91cc7e1a9e44c28fe7014844e9b8f2b0a7def2ba
SHA512 94d659aa4c82441c2de0c342b0a8e2720a022feee9113f077f2c057067291301c05d180d9252e62a13b6af9ed18f555e8fef2ec690a5158d5f2f328cad6c92c7
SSDEEP 49152:U+3281VVnanaVV/1lkimxZ2Wj4b5FHcoPnGjr91gd5pEyC3R8e24C/Phk5Mhi0n1:TNRNs8geU1Upk+8tFU7r1LKqvlV
TLSH
T16C666A03F19900D8D059D179CB5A9232EB72BC494BB162EF2A5077D62E76EE0BB3C750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
4708	alg.exe
3972	DiagnosticsHub.StandardCollector.Service.exe
3816	fxssvc.exe
4580	elevation_service.exe
2928	elevation_service.exe
1924	maintenanceservice.exe
3248	msdtc.exe
3012	OSE.EXE
532	PerceptionSimulationService.exe
1528	perfhost.exe
1468	locator.exe
2616	SensorDataService.exe
3408	snmptrap.exe
2200	spectrum.exe
4292	ssh-agent.exe
4232	TieringEngineService.exe
3532	AgentService.exe
1688	vds.exe
1712	vssvc.exe
4496	WmiApSrv.exe
5080	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
\??\F:\	alg.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\beb2cfa15ef7726b.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\System32\vds.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\spectrum.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\locator.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\wbengine.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\AgentService.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\msiexec.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\vssvc.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\System32\msdtc.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112140\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d9a61382c53dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f73ec4372c53dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000312ad0372c53dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027b6ba372c53dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000247f62372c53dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6bbe4382c53dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2464	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
Token: SeTakeOwnershipPrivilege	2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
Token: SeAuditPrivilege	3816	fxssvc.exe
Token: SeRestorePrivilege	4232	TieringEngineService.exe
Token: SeManageVolumePrivilege	4232	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3532	AgentService.exe
Token: SeBackupPrivilege	3400	wbengine.exe
Token: SeRestorePrivilege	3400	wbengine.exe
Token: SeSecurityPrivilege	3400	wbengine.exe
Token: SeBackupPrivilege	1712	vssvc.exe
Token: SeRestorePrivilege	1712	vssvc.exe
Token: SeAuditPrivilege	1712	vssvc.exe
Token: 33	5080	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5080	SearchIndexer.exe
Token: SeDebugPrivilege	2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
Token: SeDebugPrivilege	2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
Token: SeDebugPrivilege	2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
Token: SeDebugPrivilege	2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
Token: SeDebugPrivilege	2508	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
Token: SeDebugPrivilege	4708	alg.exe
Token: SeDebugPrivilege	4708	alg.exe
Token: SeDebugPrivilege	4708	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2508	2464	85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe	86
PID 5080 wrote to memory of 5012	5080	SearchIndexer.exe	113
PID 5080 wrote to memory of 3464	5080	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
"C:\Users\Admin\AppData\Local\Temp\85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe"
1⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe
  C:\Users\Admin\AppData\Local\Temp\85f90a3880685bef528a691ece31abe698d181c433b00bc2d55c61627bbfdb80.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=125.0.5729.49 --initial-client-data=0x268,0x26c,0x270,0x240,0x274,0x1405bab78,0x1405bab84,0x1405bab90
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2508

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:640

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1924

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3248

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3012

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:532

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1528

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1468

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2616

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3408

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2200

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2068

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3532

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1688

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4496

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5012
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4aa53e9bbb8b3c592a973702e5230730ab4a7e973f1fccc0efacee15cb939d74
MD5 22740e7637c3aadb349327b645b7b7a9
SHA1 375e13387889bddcba5d886a0dc8fb591d78d9f3
SHA512 5c4d463288a3ebdfd13e9193c70e75e9857e96c6235fa38e7ccc0f1cf9e5e0e3999a09b1bc3679b0336301288023ddd236a249e3abdb61537617b9cc6ce4e3f9
SSDEEP 49152:mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnXDGvlvgxU:Y3q6sjBYqvlV
TLSH
T158D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 772e27438586cd0850f3e9a6ee87469c68659a8e713dbf29b103c57ddd50459a
MD5 305a817837506ca3dfca51467f4b74bc
SHA1 12116a60fa940ebde42600a169e8afa68fccfae4
SHA512 2a1fcad404f4208c45df40cf62db4c70627a7b32e3b2211e21271934579ae82b420f3d1c29ea6bc280f148dc14a4b8728614f08e20277c0eb751b368053e7c5d
SSDEEP 24576:GXYfDtczA0sc8giVmYlZVgiQ6s3A+4uY/:ltc9DGvlvgxU
TLSH
T1A365012D679408F9ED67813DCCB1C512EA7278554760EBDB03A48A2A1F337C86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e24f235ae17f2f3f425a28933307b93d3bd3fd5ee3a27063e7528b4b102af687
MD5 8c3c9a034639893caf832a778cf426fd
SHA1 4a3e6ab57893331379023939e597cc72f5c57416
SHA512 d61a140e6b14e10fedf9dbba3614b54eef99e13d74e7c0b6d0e3983f0234116d9426426dcde81802eb055ae7525eb254d482370803dcfa8ff64032dd60e7e8ba
SSDEEP 12288:iL8k5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:iLTsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T13F45238F0F0C747AE73B4D3A99FCA9075DBC0E544C658DE286125A4B847CECBF4A9126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 583bb097adca9d5964fb9d8cb0833a0f881ca0476e19b4ddbe2b79116183c167
MD5 4aa4c2e86a14fd71efd17d2c760ee137
SHA1 c4a6a4ad5b57eee256c5e250b9959e562e01221c
SHA512 d3d8f126ffccfa08d6409c4cc9fdc4fd85d5a26c0825ef7f9865a6f7799eccfd356678962829745d231eec31f1aaa167f975baa402508b36569813b6c213f3bf
SSDEEP 12288:keBNUbTVO86Uzk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:kJIUwsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T14B65CF3BAE28FCE2C27E8D795A91C600D77278304F6293CBD165830EDE235D55E79825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 63f50967bc9c36609b30aaeccb27c36bdc5ff769f439b8174091d096cf262022
MD5 d7c7bec20617dde7b5d0ecd54b631613
SHA1 ef8b9c3f6bb9a33de5c6f1d6b03ebc741d963ddb
SHA512 2189ff518e17f32b5e0aa8492b30584dee88ab620446190e194cf864c620396d351c28dd0a674a2e43d2ed1f9d538df252f6634a126bc3edf36d0e93ef080d0c
SSDEEP 12288:rAwSfxL/2Dc3RDLLmt0LDQewsAjNk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4u:U0ewsAjGsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T15075E031FE74E036C77B0DB61B35C716187C6A204F611AC3E3A88E9E59346D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c5bd2ce1b7b06539ade4a4ecd3f827dcd8f0698e905044055456892a00eee8cd
MD5 7061922b49e967fe3f6a69f2bbb70f99
SHA1 d8fe891282cb91f40ac9f22b430109c65abbf641
SHA512 d3d922e207ea325cd6ee46fe97ff02bd852c23c1350816cbead2fbc7e308bc36b0d68b4d1d1c05356a76f58e7f3514e0beec27b9d194ce38bdcbcf14e8021f02
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHTf:mUEtQevvqc2W1cpV2tI32
TLSH
T11A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 078235cf5ee550a34784c28080953a7f9308479f6c941544121a20892d919530
MD5 74fd313aae4a5f5fd8cca77f5956e4ca
SHA1 f641e5bb4dbb2a72f4a20fde4ac75fa867ebe81a
SHA512 5506d063724bd7201a7727942aa3c0c868c40d997e0a63e5ee96a7c377efc11e46f7a3db1e5776f009c8d0df580a12c5b26d95bd2e7bd61d189fe8754cb489b1
SSDEEP 12288:Gmw5HEjsChNVBFgl0WDm+Cqk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:fwu4OWysc8giVmYlZVgiQ6s3A+4uY/
TLSH
T13165F04A27A81CF9E96786398597C536FBB2BC012A21CB1F0760C65B5F37351BD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 67654aaef0a3106b6a459c9fea3e9730168fac5e8c2082772a78fe543131c499
MD5 8b61bbfb7e9182a44e8e3dd034f19c0e
SHA1 668c66c61b146801f19e9b36573dfc14abff8ee6
SHA512 dc7f534a3aacaeb5ac1b546a70438ac24501393cac818172ecc718a3563e376abc828748dd760db45f48c4915b5f0d1f1d8ea54bc2cdf30eb1686afca263c7eb
SSDEEP 49152:OB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glkDGvlvgxU:cu6Jmdxd2dkqvlV
TLSH
T130D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4bef5ccba8d594f75b7a043d63281d020d62f859d97215e68071535d795d2638
MD5 7a59a3d36fda84e83d5e027445d8e5ac
SHA1 d0eacd61a8a2ed83d8c278e82225608090a63576
SHA512 56d4fdf493ae5dd9ed25bdb1fab107b577f9083536a491b4e4ea0438262056ea59d8d98335b6b9be2369ffab10a3be823c697258b7ffe3ad1d445d3b8d333820
SSDEEP 49152:PhtSn8EApI0fig3giDn0AP5w0DGvlvgxU:eX2imph1qvlV
TLSH
T14D95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A50B7561E7BFE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 22f0f9bf1fa84d4143761ce8f0cf427b815b5f38b763ed6b4ebf1b65acc0cc0d
MD5 8640b158db5e5e9671dcded20a810bc0
SHA1 5fa8abf949b313629833bb198b8c2a3a9b260a50
SHA512 73d00ba6deb7eebdf211d7ef9c4814c14bd71201182d611cd29c8c2a2bcaaf2e21a15f19ac8d58cf7bc36a74e039e159a7f5063357cea00d770da913452b5b45
SSDEEP 12288:vEk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:vbsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T15E45238F0E0CB57AD6268D3A89F8AA079DBC1F558D664DE39607020B947CFCB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 eb0e8a2fb6c2e2d99adc851541a852612710c4b04802acfb5533236f95191298
MD5 dba80dc8f2cb15b89b3816a7827ae76f
SHA1 529e135507cf03d7722653271fca8d4d9bb8f702
SHA512 480d68bc5f0a8e0e526d3d25039cd38e6f2d3bd38a300482acb6fca80b8445ba9883fb1aff36b2302fad58b0c60e87f8ee3916d35753a2db730a937365ff47af
SSDEEP 12288:Hxk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:Hqsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T16D45238F0E0C757AD6268D3A89FCA9079DBC0F168D664CE39A07010B947CFCB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 355b642eb68aa5137b3ff5f50fcdb39ae469a81c024d8706311b47d915127810
MD5 428b5eca0b8585bc655cdc75c9a45d7a
SHA1 7616b900f3b44995819921d2a462870dddb289a8
SHA512 074623e91d9a9e7bfd5b2e7737cb8ce6a7a8482a7487f425e55493f1045543bb234d7f2774c7d7bb82fbe1e998cff9147017d5235f9367b3197603d3a3cdcb84
SSDEEP 12288:E7k5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:EYsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T18A45238F0E0C757AD6268D3A89FCA6479DBC0F568D664DE39A07010B987CFCB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6bd484b9ca0b3054533dfa38ce350224d1c7cc5d3c3e5e2d6e34e426ebd45b08
MD5 821cf65dfb69e25b6c53915eadf6d4a3
SHA1 b86e35e4f4368c105bf1dcb9f644c972d5bb33db
SHA512 767aab7cae6cb06d300848a67a40b75b7fddca05ded9edca2fda899d73b7182b122fd6ae07b93a3f41151cf533ddc8f115478933b8aabff870e9683874a526a0
SSDEEP 12288:8Qk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:83sc8giVmYlZVgiQ6s3A+4uY/
TLSH
T11F45238F0F0C757AD6264D3A89FC9A479DBC1F5A8C664DE39607010B947CECB3469075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 9572ed0592f57046d32f5067440b7c39db5a53b42f763bb4873c237ca4fda3a7
MD5 d0a663b156227dfc6f928e1835122594
SHA1 256e1ef573aa495b2ddfd421372ca91ae29e1497
SHA512 749020fff5a4a64d386c2874d85d0fd102e4e43ea83f340451409eeb53f9b1de679c52a9ba5e907cc75df67bfd7e610f17e897e6ab1d5e30cf8acbb5560c866f
SSDEEP 12288:MyPz5L8dk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:VzyWsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T11155014B276530F9D1378239C8A55A02FB7578364B208EEF5760077B2E36AD1AD3A770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 88b4f4d547bd78e650cb53c38531113d2f0e63e3c3d37e0252285c3958d754a4
MD5 24b010d48bc5c7817696630d421296a4
SHA1 e7e122703ac8300f952d05bdc41df79e9b388b34
SHA512 a33b555f37d2134aa9cfebc57227a443604ab2d19e69a8ab9e485746d8fd3341cb3f3acdb500ad8dea6f92470aabb362dba20431850224f078fd7b85dff43c75
SSDEEP 24576:jTDaLl3z0zDIsc8giVmYlZVgiQ6s3A+4uY/:jTuLljNDGvlvgxU
TLSH
T1C6650299735028F8EC67853ECD658906D6B27C5A0B70CA5F03A4362B5F337912C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9ee67914f5609789a5b0f880beffd7b5cdad746b73a4dec711a2b2a20e458080
MD5 3bea129ecae78c4ac1e54c5fe518c889
SHA1 d3f637a28a3ab55dce79a297783460267238d5b2
SHA512 c9983e288b5a96e81a41b9a041407992d56281cec50f2ce19dab3724729335c4aa42ac67a434e2c823c62d67c8a6abc4feaa42fbcc347b0650eb87fb04cf6bdd
SSDEEP 24576:N3vd9CHKy7GZ8sc8giVmYlZVgiQ6s3A+4uY/:tvd9CHKyaeDGvlvgxU
TLSH
T1BB75CF91B7E810E8F0B78A358D765512DAB67C591B31CE8F03A4261A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5a38848716022ed9363b238e0e17e64db3a8fff09db53b5a60b7737a9e06f60e
MD5 dec2d568d839d910272d3fd62a0efa48
SHA1 c8cefaabcf929343d83b083cc17e253b19d9f3d9
SHA512 58e584a5565b40520b19d46f1bb806b156ff03ce2e02de1df2818d95804825ba81b427b8b02d8d04e96efbb2a7904795e42346796983c88c1cb66fd7ad11acd2
SSDEEP 12288:Nbk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:N4sc8giVmYlZVgiQ6s3A+4uY/
TLSH
T10F45238F0F0C757AD6268D3A89FCA6479DBC0F568D664DE39A07010B947CECB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 712ce848c46a5b47759366c5e4dacc2983424b7513083ae4e40bbe03093debdc
MD5 a00fc24344dd2f6d5e829b2b143db3e6
SHA1 b12401bcd2231a41d908373c095c451e8a4b4a3b
SHA512 ec7aa15592b91f4353869a7c60caa3e36af0ac17ea4f05145a08bbf73af9819de18ee66225df60fd8a0a4d4a3794d273c238587e1296d09d4b19fec3fb961ba3
SSDEEP 12288:T9k5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:T2sc8giVmYlZVgiQ6s3A+4uY/
TLSH
T15E45239F0F0C757AD62A8D3A89FC9A079DBC1F158C664DE39A07050B447CECB7869079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 59640ce883a3c3d275d2ad7be732b1f3f813e5d533b22c8d152c465b56d301fb
MD5 a928a98f144516d9de70736d00ec1edf
SHA1 a636561e363c68aaf1d1209d073c24283deda34d
SHA512 c66e83919a305fc800624369392ea62fc5c78bc5741f7ecc73c93df030839d099f4a5e38298798a7c70e4de8dc010cff207713e8cf2857477ba46d99225f2579
SSDEEP 12288:aCk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:aFsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T13245238F0F0C757AD6268D3A89FC9A079DBC1F5A8C664DE39607060B587CECB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 1.2MB
SHA256 0e049f1963188055357dec06ecbe01552ab48f82538803e9c235ea7d2ce80b2d
MD5 75a21dbf2a7a485b24f8618fa326a73f
SHA1 b6fc6732592e24d88b91e57fcc852caa15dc9e0f
SHA512 265372652d507e8acea1323084fc0721d0bf44d16fac5a7c56849a016a63df6d3c1e00de6e5358c37b2c9c4b8ce5d5d033ccc44c159d59871ffa648071497051
SSDEEP 12288:4gk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:4Hsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T1AC45238F0E0C757AD6268D3A89FCAA479DBC0F568D664CE39607010B987CFCB7469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 1.2MB
SHA256 ddc6accf6fe057684c65c0759d72cc6db848a9256489982550bea6552b8c5041
MD5 362cc81a46d7f8e0ea7a641477f0968f
SHA1 3fe897f5b79bb56c65528a09d60982a668b4e889
SHA512 9c944e4b15bd9c4e37551fd14a6c55379e162764ee18e8111141e238dd4168b4bcd6eae9f65044bc9bedd0a2ec07924ed1b2b3f425158716d433dce3f566ba41
SSDEEP 12288:ndk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:nWsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T12F45238F0E0C757AD6268D3A89F8A9479DBC0F168D664DE39A07420B847CFCB7469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 1.2MB
SHA256 ba9a4d54e607ce1de68ff8dfc06fc5306c729d683b858d0c3fcdf9bdfdf8d435
MD5 7e800ef7b92cdc7692f85f9896f31491
SHA1 a520e9168ad9620e2253138662f8123758fba262
SHA512 263049167be10dbd4a3d33fa43c8d5d8965474cd07afe0c15d153b7ef7ddec9888a760f4d4f1eec639ac26c9a17433957ef0f31cc4516428d1d167e385e5cd5c
SSDEEP 12288:ZQk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:Z3sc8giVmYlZVgiQ6s3A+4uY/
TLSH
T15C45238F0E0C757AD6268D3A89FCA6479DBC0F568D664DE39607010B987CFCB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 1.2MB
SHA256 60d3b1f1319f0459b429ea2740045112c8755e128e5c0eeb4da31f8f9579982d
MD5 3afc134645c9de786ad45612e34159aa
SHA1 5a00a3f9b71f9e621f0f196bd8df6fe68c03f6c6
SHA512 e0668233712119a584976f8078e57c11c587c8face0f036cdfc2d131a0fb08ef6c0bfdd195a9033c827fd295c4bb19636355cac302371ca8fe75930f3b4e67c7
SSDEEP 12288:eQk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:e3sc8giVmYlZVgiQ6s3A+4uY/
TLSH
T13445238F0E0C757AD6268D3A89FCA6479DBC0F168D664DE39A07010B987CFCB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 1.2MB
SHA256 fe0f469533b5533366000dd3977cbe117314d1df7a532737f36692ebce30d706
MD5 a36f81f8c8dc65f2939f5beb19cd21a1
SHA1 48a6fdaec3f32628e37aa01d509f79a94184363a
SHA512 ef2ed58a5751b1a40d03bc2616a61bdd24b0e53b32214c633eff8a56fe6c689e76536d5b8a42edec9d95741b3b912c9aa034f4d181d62db24a418eb44bc26b47
SSDEEP 12288:H0k5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:HLsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T1FA45238F0F0C757AD6268D3A89FCAA079DBC1F558D6649E39607020B987CFCB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 1.2MB
SHA256 e8d37bc47e72144663bc7df83f0146739f48d538235d66822184092af4e23191
MD5 657cc26aef93c26ebdf218400a6838bc
SHA1 142d479d2bfb79f174b8b1cb7735beb2b2edbb2f
SHA512 d08eda7e990cc10fee1069e7e73ec1275118a7536a12995b99d1b10145ef366e887ba48eab5d6b3a748c04a96f32925d982ac6697e8e788e309de50436ec1091
SSDEEP 12288:lqk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:ltsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T1BD45238F0F0CB57AD6268D3A89F8AA079DBC1F558D664DE39607020B947CFCB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 1.2MB
SHA256 ade4b1a215a90968a614485678c5c5e1110351f05dee4388cc2814327368087f
MD5 ebf73668d4551a5a97e9444fb60bdbc1
SHA1 a1be2f5f75d115ea9e727d10b2ab353c15bfc12d
SHA512 fd01143afc9405c969dd1ce2f755083957dc385f323bb3756d03d57ede387fbc8b4f33c85f37d449fc2d3b505a2069826e0588c6d720fb73727dae59406033dd
SSDEEP 12288:vrk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:vIsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T19745238F0E0C757AD6268D3A89BC9A479DBC0E568D664DE39607010B947CFCB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 1.2MB
SHA256 5a42fd03c12cfefef3ac656af553b25753d62baa05368a8808704f94f9894af3
MD5 235806ab3c30d2e2073cd65d5966d9a6
SHA1 a76f28eb30566da8b9570f72d32436cf6b36d408
SHA512 4481521e791d05b2ad2ae7855a442b3328f8460f136a3f1d3e1ddfaad33e407be3d4dbd0cd508cf874ad092bde41534880da0af6f4018faf2e07132978bbe9d8
SSDEEP 12288:hFk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:hesc8giVmYlZVgiQ6s3A+4uY/
TLSH
T12E45238F0E0C757AD62A8D3A89F8A9079DBC1F1A8D664DE39607010B947CFCB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 1.2MB
SHA256 f01d356cf895917cccb00bc39fa9c528f11b10f07caae5c63c8dfda019ef6bdc
MD5 bccb5661a6b671d875137e3c76da5e9b
SHA1 3e23318c7b06fd3d8ba755a276de548c6ae73a2b
SHA512 59fb269d2deb08062b860e8ef184cc82a8c33965473b4ab4b32db74fce4270bfd9a74fc31bef2fabefd3d5d1a5bd4691cf6c4868a59eb6bfc019d47086b24011
SSDEEP 12288:T1k5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:TOsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T14945238F0F0C757AD6268D3A89FCAA079DBC1F168D664DE39A07410B947CECB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 1.4MB
SHA256 1701608b9cf738082cdbb64d47864f0950189387e294db8c019047b022f8c92c
MD5 0e8501e867b8f8ea91cba59fda229525
SHA1 4bb2a12649d49000c56775860116ca82d7b92bed
SHA512 b7849b48db69b65c076230e4ce4d2d2f55a4d442b80c1de6499075e88a2735bda2b05ca33f325bd50113b45962f011cd5bb67cc1a82b6f80372c86aef7d41e78
SSDEEP 24576:EjCdF7IwFsc8giVmYlZVgiQ6s3A+4uY/:cCH7IwFDGvlvgxU
TLSH
T11A6512AA1B142572C5B7417DC9D2C71FD6B93D2503684BCB84C883271B27AD93AB83ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javacpl.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
Size 1.3MB
SHA256 744498d397a21c9b235d0f137fd1069b8c4ea2a8d7e483096104b23f4360bf66
MD5 9a5945b88f97773f5146b2ddfaf0f06a
SHA1 8c140871a80045b5e711a3aa6e73229b711ae1cd
SHA512 d40b6e96b0919d66532b0092b748ddbb550a16fc5e706015afa95b0a124bccceabd09dfc9afedeb113440669f3784ba6a7d5cea484ea39ca489841f16da919be
SSDEEP 12288:qgh3vvsk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:qg3jsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T148551292639C70D4E537DE36C8B889218CBA7DAD4E71CD9F1251320E0976BD2A439F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 1.4MB
SHA256 652f21d3ecd5e23646cb869f6652a2a3b2848552f13be59c21088b452d5b4cb5
MD5 96e4c77bc02a9c53096b5c5a58f8b09e
SHA1 01c31734164d4f3fcd370c2245b14ef0193c7cb1
SHA512 239246ad5f7d26e0acd5fc3e7314bc36062c20ae72f0bb5f00751d66f6dc54b6a8bb9f397cc69b1b90117673f21cf7bd9edc2bc6d4ae65e783312ef64b3e3125
SSDEEP 24576:WTDaLl3z0zDIsc8giVmYlZVgiQ6s3A+4uY/:WTuLljNDGvlvgxU
TLSH
T13D650299735028F8DC67853ECD658906D6B27C5A0B70CA5F03A4362B5F337912C3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 1.6MB
SHA256 45afa60660a869c2cb6b6032fa8b82da672b320b1d15c46ada03b292b0685c55
MD5 c06f4b40a0f47c01cf3ab938c786c09a
SHA1 8338d28825b6e78929621c8f1edcf23003984fa7
SHA512 18e7899a903d416be585f347f92c51a8f83ff915e8c31620eb69137b8f58129b427f579946ace13f9218fe8a256036fc7569bb95b8e7c59eec129a8413afb817
SSDEEP 24576:M3vd9CHKy7GZ8sc8giVmYlZVgiQ6s3A+4uY/:2vd9CHKyaeDGvlvgxU
TLSH
T1AD75CF91B7E810E8F0B78A358D765512DAB67C591B31CE8F03A4261A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
Size 1.2MB
SHA256 f2f8111fc3246e64ac5ef899a6eacfebb2cb41a3be66b2c6c404512a01b1087f
MD5 0c5979767025ef6968930a880f7a3901
SHA1 1c02fa02efa25dd8b03b2247fe12281129e375b4
SHA512 4a9891cb77c62b6877cea05be872c2f36eddac8ee3e61f6cfa915a9e44775c65f45b6101ddcb904b4f2286a0edcc967291e69ba5e4b49e42b022719a6735c0f2
SSDEEP 12288:DOk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:DBsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T1B245238F0E0C757AD6268D3A89FC9A479DBC0F568D664DE39A07010B987CFCB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
Size 1.2MB
SHA256 55234cc4b03c255a0665a8a517a8210a170882117b6671b735401324e96f9c52
MD5 2726420001517ffae1e7db43c3336a0a
SHA1 1c3eeba336462e755a10a42751ec15c71731969c
SHA512 35f8f11f0d4b53ca8ffb3542f3a76af786a47176eb4fa62a3ea8d85d82addf23f3d73aaa5c8ea12bc0fc760bfa12dd46815376849baea25341d8257c82ad2316
SSDEEP 12288:fMk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:fjsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T13F45238F0E0C757AD6268D3A89FCA9079D7C0F1A8D6649E39A07460B947CFCB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
Size 1.2MB
SHA256 762df82712093232ca2c45276811d311f4194a11cc784f032adea69b633d7dca
MD5 d0bee2daebb3bfc3b845382b350a90cb
SHA1 92ca4868a34fd0292674b2e9e23d5d3333f496c5
SHA512 082cf7f32567b510a340c10cdfaa2d5d862fb6f67ef3d35eee6513dfe7864dc96703350b54782d1a59783c24824042fc0163c69358300be0f8730a496c2221b9
SSDEEP 12288:Vqk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:Vtsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T14B45238F0F0CB57AD6268D3A89FCAA079DBC1F558D664DE39607020B947CECB3469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
Size 1.2MB
SHA256 7e0bd50a15be732294131c0c7530c1d92105a5da15ddc3ba2d09f3d398c14196
MD5 c299056e29543b35067eddb549b95aea
SHA1 5e4679159df343386964c326458780109cd65a1d
SHA512 d5bbba3f9219cb307b886629fa0d9d7688dcf06bdac1774b35515fc061146c16098677b856b8f24fe50570e72c85c85c1ef26eb21689d171900da30c1cb0c095
SSDEEP 12288:VPk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:VMsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T10945238F0E0CB57AD6268D3A89F8AA079DBC1F558D6648E39607020B947CFCB7469079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 1.3MB
SHA256 a1ec2005174a1b53a1458666812cde533ccdfbd70c0a1ab0f518abfe58a004e1
MD5 7aa9117c52b1229a686657fc093b937b
SHA1 012ac8dccfeb70505ab68ee2fb402abc9019a416
SHA512 ef18490cc38e6cf9f1db2492338125edb3a5a8bcf9ff44ead5e0d1aa3254e24031aafc5463b0d6576ce6bd59a622a86acf1dac870d220ba243852a9a685829da
SSDEEP 12288:uQYfgHaUk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:QfCarsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T14055014617E820A9F173CE3999B485168F7ABD614A25EF9F4640410F0E79ED2ED38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 64bb730f20a42718f3805f5d1ad299f42357aac845445add86f3378c8b4f3329
MD5 215336a0b67d58963ab50769801cb720
SHA1 e83e4fae2ea335337f549e0ad75455b4eb06e7c6
SHA512 da33dde877dbf2e87c5a11fe70ed58a9c6060f76798977808e7b120d7c873fa857b7b07fd4881d919f9578a02848c1ee65d5a3d507f3ee73c33dfbfe6b8f05af
SSDEEP 24576:mcP4mcvIjkGOxhKP2l71SNKbrh/8KBvsc8giVmYlZVgiQ6s3A+4uY/:hP4m4IpOO67N8KdDGvlvgxU
TLSH
T19B65BE2DABDC0096D0BB913885658A4AFAB1742A1F3286CB1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beb2cfa15ef7726b.bin

Path C:\Users\Admin\AppData\Roaming\beb2cfa15ef7726b.bin
Size 12KB
SHA256 22e8ba4a5d13082f092339b7970119ab52124672b9b8394e9c0700990b0819b9
MD5 2577fb9870a8e75c8bb16296930ef61b
SHA1 922a3dbc984555469dde9a503bec84cc514f129f
SHA512 0c8d030665785ab0ddc7b765c9e82a536a233323e77cc3b5458e0211eb576d55ddca6b4c9b2899aed31e0d96e301d9e19e4f86c4b355fccdd5f19a12ac099acb
SSDEEP 192:KKoHuPPtOdSWx37G7qdtVBlATW8QuqvjhtNhXHPlFRtMm5ZxyFLddgYnG:K3aPtQrG7UByW5ht7HPlFzMm57USV
TLSH
T1B442C0974691D3C54AC52AA5F78E8B2C29763DE4B4483183ADC919783A81CA89CF8CE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 13a03c46a70ee97a6236de9913c10fa2b7593f5775ca14491a78a0bc242752e1
MD5 bba32ec09534b9b92c35fd58fc73b789
SHA1 592eed4596c6c8da6519cea6012c7e03b0178cb6
SHA512 699b61f3876990cbc4ab98acec49dbbd02803349c9959433d76d569ebd24e3f0aba26749a31cf161faeeec1b9636da59b396c5bee7268f4b799fbc9d8f3976fc
SSDEEP 12288:ogk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:oHsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T19245235F0F0CB53AE63B8E3549BCD5166D7C2F244E658CE7A602021B5478ECBBC7912A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 62660b9151115b2053ecd5bd5ceeb2d408b0d1959b415a390b1cfe52d20b8328
MD5 5ebae96538d82627465bcbd00a8f0248
SHA1 ee0060b89becd90031421c4e344a38f967b7f8dc
SHA512 fb65623def10920461cd45aabcc8a29571a407bb8f89428457410b42383575777a3fdc10d1a0c685f674064069e066d3165ddc657e347c05cba4e7e35aaa0813
SSDEEP 49152:0a0h2GEkuAe73q3pp46zwwQBDGvlvgxU:0a0hNYG4Jw+qvlV
TLSH
T15185AF1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 1ab050df38f97c277a2129738ca4b20da390f897ac96c763c2b749dce4e3997d
MD5 dcbd49674bc341a1ade9589206b9a818
SHA1 ec49f2f96cec3ed964e5435def9fd7f609eac80c
SHA512 c716c269ecb2641e4aa3ee741cbf619fbf07a73ac068c9d3641cd8401f8ba84e62b9d7c1a3f4c532f4ab2d33d80dc4a3fd25f2d24e603c0d6ced07f2da731cf0
SSDEEP 12288:9hbHjfXhk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:9hbHjPasc8giVmYlZVgiQ6s3A+4uY/
TLSH
T1D555027E0B6C30E9E132D57D85A5860AD7707C250B2197EF1382827E4F3AED96C39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 df24335e71552a8b88daebc9e713857012fd0c42f6a64c5a8f5ea3aefd17521f
MD5 795b2b3c25aed3cca994ca674af827ae
SHA1 bbde9b77d53b941d65ffa61292be1619a7d7735a
SHA512 fb83a9d94ea3cb7ec8d3b8768b45346b163d94ca3ccecf41dbacbfe2a8162417018facfeae4a81a1dcb18ac000395cd575212c20a179387d6a2055c43f6b8bf4
SSDEEP 24576:N3YgnJcRTk4yti+R5dpR/ysc8giVmYlZVgiQ6s3A+4uY/:NIgnaTk46ppR/yDGvlvgxU
TLSH
T16845BF2EF3B910B9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 82fa889fef89896158340e484968fbb63fb0960d8b6e8153e3dbbb54e734401a
MD5 caa3866a23bcef7fb317c5419193ff47
SHA1 191f545bab130f8db931ece597b858883a6c4e9e
SHA512 a6c3fd7dc872e36bf4672ca28173af2a68c298d4ca9e2971e2de91b47efec6ed488ab15334bbabbd1da758e87af8931b4aae0f627e8e65296a5354b54fc8809d
SSDEEP 12288:2ck5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:2zsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T16145238F0F0CB57AD63A8D3A89B8DA0B6D7C1F144F664DE39516420B847CECB7879125
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 451ddd77b0eac105cb8829a179558b13c30046586133e1505d5fd0c11814900b
MD5 4f4a8f0236550314769da3a3bb75659c
SHA1 9c0b8a80f80a6c55be6ef9ed481948173eeac3ab
SHA512 1ed5d2dcfcaaf0199e78d97c73d8e514071083a9bdd05b3c27fc2a0403b21e13b1ebd4389687550a8c1b7883ce21124322ae369d43f0c8cdad73dccce919061a
SSDEEP 12288:LObfA4LWOsvAYFT3k5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:UbL3UT0sc8giVmYlZVgiQ6s3A+4uY/
TLSH
T172750149EB9410F9E83BC13CC8B68A16E672785D0764E7DF03684B561E237E25E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 ab957a44d85dda82abf7b1be9f3de615c67603209850a0395444f1e6befb8f86
MD5 e178e6f2e49a9c7d5ae9c31fc19c8562
SHA1 c13c4c0448a4912968c49f78876092a92b09a8b6
SHA512 6270c8073bddd69cc1f90295b4d1efd55ed02e4b50a59bf0a896aa35f8dd332e53b5600a460f85fb14f633a425094eca09eb86a4a8f59f0168e5694645a1aa11
SSDEEP 12288:NpFtIOTk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:8OQsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T12A55121E2B9C20F9E136953D8996830ED77178660B2257EF0290817E4F77FE87C3A661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5fd7d466adcaf72e3ee2179cc6db78c8342bac3e73dc1a24a199eef64e50ecdd
MD5 9949e50557d66ffa14e5065bb4cdc009
SHA1 e0cfd3a26a483041c617e1d605f5209f92b3640d
SHA512 89b3e92516a3190741ea24d7087287fbfff263ab5d298e3e2b4f212483daf56a119b0e7fcc201ecd238f9582941cefb868268983ac44f9a340551b2e0039dfca
SSDEEP 24576:m7NM9YmZqmWMUkPjZM48Mv6bEhs3sc8giVmYlZVgiQ6s3A+4uY/:m7cBWMpPjN8DbEh6DGvlvgxU
TLSH
T1FD65AE2E6BAC81E5D477D13DC9E28206F6F1B4611B318ACB1162833E6F37AE45E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 6d74985012e8eff34e189a0e689f0240d948865b588a8d654f2113c89d214263
MD5 ddab772ce8ec0f9df9b27f77d39d52d2
SHA1 ae6c97d3d7338c711a90706ee518a073fe41bb91
SHA512 e977e387679789bc0b6a19525c032fe9e44a6843c778af4d3e2ae2911f7a3bf527aea29b0ae3209687eab68e175356863da87bf014e10996895cb9415821ff4a
SSDEEP 24576:qW6BApg2YuyuNDYTabvcRvNYf8km1lsc8giVmYlZVgiQ6s3A+4uY/:qF2YuHNETovcvNYf8kmXDGvlvgxU
TLSH
T1F7858E2A27ED80A4E0BBD27D45B6D246FAB2B8511B3056CF0255862E1F33AF45D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7e5b3454147f1a95e07619e7f5142eb4487597dac4a43715036e9bac5d23efcb
MD5 330033e8982efae5c3a9f0a80ae6b2ec
SHA1 35a9735364f7f4dec0a12e1aada8987cea3b6a4f
SHA512 0612f9bbedb692c2462f95464e489fb8144a7469a71a0669d282bcb8e36294b707a626a4aa391683925cd1a7e9a9349283c000688b496bfe0c93d11971f71cac
SSDEEP 24576:bAFs06+OmlfkNXEbTo8sc8giVmYlZVgiQ6s3A+4uY/:UFs060lwXuhDGvlvgxU
TLSH
T18665BF2F67AC00D5D07ED17E8997C91AF6B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 871351253c6d2053097393ace6be3abfd48ba3bccd45b4f3f16617e490639369
MD5 7044e2878d47cd7c5a3f60dfb8c80c02
SHA1 ece2590eb11065eb19c505c6f28af5ac63b36661
SHA512 9d285a44f2473fe6776bbbccd965929d59d86d39ccd308700416154c417402478a07c6e83eb1fe3892126df420fb0e6db384886da7df1624680e8aa4af6d7069
SSDEEP 24576:vJnJ5D3Wthsc8giVmYlZVgiQ6s3A+4uY/:vJnJ5DGthDGvlvgxU
TLSH
T1B675D02DD2A820F8D4B7C274819A5B56FE71383D2F2269C72874D5353F22EE0A979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 69ce6ddc457a4bdd2944d84150806e9294097a1e654956b70667271c4f94f0be
MD5 527dc492099875f48a292cc76c8cc174
SHA1 c1326683056f06f8b2dcfcb6668f1513dcc362e3
SHA512 75335f1d45f2a55eef0ed24c097274021a614853dd7416b8fc02e1586929782e242062fd475c5208e1967c5dc71c03101f0e6e34fcd3245568a75f9d78ace7bf
SSDEEP 24576:VEPohm6/7IIXdwcXrif7qQncjlP65i3Vuysc8giVmYlZVgiQ6s3A+4uY/:Co06DIKdwc+eQnSt65aVbDGvlvgxU
TLSH
T12D956C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 cfa628cb624f67043ed0d56386d476e9d3a70346c87931f43926af78410f6635
MD5 33ed1211242f5bf2b95f0f5942a32e68
SHA1 28388a5611b00368c54e1bc61ed51250001a53b3
SHA512 240addba8e3394e60e53ccf4612abbceaa0e7ad16fb690b54e94757832ff4d74d38b2ffc6f8a75796b1e47ee177b33d9afefb06fdfad6dcbbca1a4db7b20741d
SSDEEP 12288:REP3Rr8k5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:CrTsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T17F55126E1B5C70F9D13A903D85A08606D7B5F4700B622BEF4691C23E4E7AEEA3D3D611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 ab0201cfc40efd4caa1506dff6ac85fb52e323e5b71c89eb6a40e194ddfc6046
MD5 6532945dacddf951463d5262be638351
SHA1 56f541bc2acb35ce00750c1d69115b9d3d0babe1
SHA512 951d54ff4b723d17d45dc318f4ac240146a7d51cabd69319e89981f2097172caf2512dd45d5a0ab25db1ce289e3d9763a2a0564ba6b36731df163ee906b9eef9
SSDEEP 12288:Ojkyxk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:OIyqsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T12255120E175870A9E67A4A3C89B682959E787C304F2186EF5181E73F5E39FC5BC34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 1b032db46958457eb78e22e240a6d22d8d4412eea6d88c677899f8a2304b4b9b
MD5 b90a8dbcb9b5ac80a9414ff16ee59bfb
SHA1 edce03270894e5b6e97b6cc21044749786f43c1e
SHA512 e8b2c6aec1a62421798258f35a67912716827a94b3e8b7727e70d87dfd993dd7738a3dda73ba6edd676b8c7d50b1b84b20a7d352aa2f21cfef74ed26b1cf12b8
SSDEEP 12288:IFjk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:Ggsc8giVmYlZVgiQ6s3A+4uY/
TLSH
T13545234F0F1C747ADA378D3989B89A06997C3A344F251CFB5592823B8878ECB747A065
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e6824d03998b0a09ac02d2daeea1e2c8c0fb5be2c19679264b2aec1872e6a27a
MD5 b6f0e72ebef27e66efaa75d92e37d874
SHA1 da9376b5663446f46efbc7ebb7f2c0edc08b5a0e
SHA512 dc9c0e60a570e686e31d9497590c9be53e04343fbdbc681b71a09cc44f7b6daabcd72abd776c3676e92062c6f5bd1aa6701ed5073c88ad792f8ad9a79398eaf8
SSDEEP 24576:hQ9MxZKdcz97w3fsc8giVmYlZVgiQ6s3A+4uY/:hVKXfDGvlvgxU
TLSH
T107558C2DABE9159AE177D23994B250C3A673B4301B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 5a27fabb2a902062226092d4de6a23bbd0a7775b7430ee92834a490cd96e93fc
MD5 8f407d950727c21f3d5c4eb980b66967
SHA1 19f8bb1372e33d817fdc71b2fa7a8eb66a50766e
SHA512 d7bf3af59af229d2d69d26d759d3768ff2e6207141fc4e53cc03077623fef3d72a03f2e960bf7508d00bcad13ccd6b14c9b4da735d2ad9d85d12938d1ecb77cf
SSDEEP 12288:3yoKo2HRple9pkk5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:3yocxAp7sc8giVmYlZVgiQ6s3A+4uY/
TLSH
T1D765E01F7B6D50A2E136813C89858745EBB3B0304B6257DB5691C33E8E37AE9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c1c206383ed3c2a8a13d6c4d03d1e0c63a6805758fc1aad59c82c82ed103ae25
MD5 6b94df51285c80a17ae91da76e0e2ded
SHA1 5392f8a34d1cf7a1b709cde3d47aea63a9533883
SHA512 72ae30291101dc23e0f6ae00525ac859c939ba61610eb799ee3454eefbe29b3ede5dcd4ffa27e1f371787623c540bbdd2245f66876360196cf0ef4594970cac1
SSDEEP 24576:41QT7EcpfxR+N5AWAz3ooiYujMqbtsc8giVmYlZVgiQ6s3A+4uY/:FTDxR+N5YzT4jMwDGvlvgxU
TLSH
T12655B02EA7F815E9D17EC5799A23C502FA727821073193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 950467ec44b2369482eeb14baa2be6a560f844e1c39f6916f6244c4efe1c6782
MD5 5c33d16f5bbb9af8656beb3cee6eea90
SHA1 873e2bee5bd2daeb5ca9a34bddc4c20df21394ff
SHA512 fbdba2e95dc3b1d36b8a7a256e97776067fb858eaf0ca318d8a506887e859c391ad1faf68b14af38d8822dcdea09217e70b275dcace9a98cc5e4e9a54ba2cdc6
SSDEEP 24576:BTMdOz0FFS+bmSLpsc8giVmYlZVgiQ6s3A+4uY/:r0K+bmSLpDGvlvgxU
TLSH
T10675F17E676D14F5E43BC27DDA538906EA7234610322AADB0690C17A2F6BFD4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 c2c57805e76f1604aa42afe23e78c640ffe1c5844fa531433c645f29584f93d3
MD5 c1ee646d9767d994858e0c8d372d9e40
SHA1 bc8d647d28bf3e3ce9c910d8569e51c25f8569af
SHA512 49eff15071818081cd0c4df070b0a461613a555317f2d3864ce5adcf5673a6ba4b00330dbe8337a636f235d810b29ba6161aaaebd8c4b0418dd8b2f1c624c5a3
SSDEEP 12288:J473k5ec8+viwyXRmkSgl+bqZXgiQ6s3AM96M4uhUWEBV:80sc8giVmYlZVgiQ6s3A+4uY/
TLSH
T10F55124E0B9C30F9E43686398A7982069A747C3507255AFF25D1C67F4F39EC9B839722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/532-359-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/532-124-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/532-118-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/1468-146-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1468-361-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1528-360-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1528-131-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/1528-136-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/1688-368-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1688-217-0x0000000000AD0000-0x0000000000B30000-memory.dmp

Download

memory/1712-371-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1712-235-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1712-229-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1924-92-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1924-86-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1924-80-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1924-90-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2200-365-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2200-177-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2200-171-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2464-22-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/2464-179-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/2464-6-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/2464-8-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/2464-0-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/2508-17-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2508-21-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/2508-11-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2508-383-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/2616-156-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2616-150-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2616-363-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2616-377-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2616-376-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2928-357-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2928-76-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2928-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3012-108-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3012-114-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3012-374-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3248-102-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3248-358-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3248-96-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3400-227-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3400-221-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3400-369-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3408-364-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3408-167-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/3408-161-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/3464-387-0x000001EB7B520000-0x000001EB7B530000-memory.dmp

Download

memory/3464-386-0x000001EB7B520000-0x000001EB7B530000-memory.dmp

Download

memory/3464-391-0x000001EB7B520000-0x000001EB7B530000-memory.dmp

Download

memory/3464-390-0x000001EB7B520000-0x000001EB7B530000-memory.dmp

Download

memory/3464-389-0x000001EB7B520000-0x000001EB7B530000-memory.dmp

Download

memory/3464-388-0x000001EB7B520000-0x000001EB7B530000-memory.dmp

Download

memory/3464-393-0x000001EB7B520000-0x000001EB7B530000-memory.dmp

Download

memory/3464-392-0x000001EB7B520000-0x000001EB7B530000-memory.dmp

Download

memory/3464-385-0x000001EB7B520000-0x000001EB7B530000-memory.dmp

Download

memory/3464-394-0x000001EB7B520000-0x000001EB7B530000-memory.dmp

Download

memory/3464-395-0x000001EB7B520000-0x000001EB7B530000-memory.dmp

Download

memory/3532-213-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3532-210-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3532-204-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/3532-215-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3816-94-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3816-104-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3816-50-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3816-56-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3972-355-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3972-40-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/3972-46-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/4232-200-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/4232-367-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4232-194-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/4292-366-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4292-184-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/4292-190-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/4496-433-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4496-246-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4496-372-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4496-240-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4580-66-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4580-356-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4708-37-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4708-384-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4708-28-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4708-36-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5080-381-0x000000000D0A0000-0x000000000D0A8000-memory.dmp

Download

memory/5080-434-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5080-373-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5080-271-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/5080-322-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/5080-287-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/5080-249-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5080-255-0x00000000007F0000-0x0000000000850000-memory.dmp

Download