9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Size 4.9MB
Sample261003-prxt8sdb75
SHA256 9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2
MD5 b618d3ecab96394000973ee8be7e6a19
SHA1 47881bead49d6c2d513a4c34fdf5df231fcfa1fa
SHA512 3d3f6e8e14279e24746bbf6b01d935c41ddca4d61d9b57f01155f5368142908661bfb4440b2ece8e47cbaa6a065e3dfc00a814c3d6d049353f642413de64f9a5
SSDEEP 49152:utz8DTC3b2/mrhZ3nGQXAPaZdx5P2xU1woP1mUuS/WRucrWdICHZmWMgpJFpvUFW:85ZZPe21OWdIREPt2DSKSIx
TLSH
T112366A13F19600E9E05DC178DF569232EB72BC4A0BF2A6EF269076152E77AD07B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2500	alg.exe
4880	DiagnosticsHub.StandardCollector.Service.exe
3932	fxssvc.exe
1928	elevation_service.exe
452	elevation_service.exe
4916	maintenanceservice.exe
2472	msdtc.exe
1984	OSE.EXE
4736	PerceptionSimulationService.exe
4028	perfhost.exe
496	locator.exe
1236	SensorDataService.exe
3488	snmptrap.exe
1884	spectrum.exe
2328	ssh-agent.exe
3332	TieringEngineService.exe
2564	AgentService.exe
4220	vds.exe
932	vssvc.exe
4628	wbengine.exe
1128	WmiApSrv.exe
4348	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	alg.exe
\??\F:\	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d515a7f99b11239b.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\vds.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\vssvc.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\System32\alg.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\AgentService.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\msiexec.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\spectrum.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\system32\wbengine.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d349d903353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f21abd973353dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f6833913353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000247b46913353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010cff7903353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1f0f3973353dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3496	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Token: SeTakeOwnershipPrivilege	4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Token: SeAuditPrivilege	3932	fxssvc.exe
Token: SeRestorePrivilege	3332	TieringEngineService.exe
Token: SeManageVolumePrivilege	3332	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2564	AgentService.exe
Token: SeBackupPrivilege	932	vssvc.exe
Token: SeRestorePrivilege	932	vssvc.exe
Token: SeAuditPrivilege	932	vssvc.exe
Token: SeBackupPrivilege	4628	wbengine.exe
Token: SeRestorePrivilege	4628	wbengine.exe
Token: SeSecurityPrivilege	4628	wbengine.exe
Token: 33	4348	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeDebugPrivilege	4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Token: SeDebugPrivilege	4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Token: SeDebugPrivilege	4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Token: SeDebugPrivilege	4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Token: SeDebugPrivilege	4260	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
Token: SeDebugPrivilege	2500	alg.exe
Token: SeDebugPrivilege	2500	alg.exe
Token: SeDebugPrivilege	2500	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 4260	3496	9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe	84
PID 4348 wrote to memory of 2924	4348	SearchIndexer.exe	111
PID 4348 wrote to memory of 2848	4348	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
"C:\Users\Admin\AppData\Local\Temp\9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Users\Admin\AppData\Local\Temp\9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe
  C:\Users\Admin\AppData\Local\Temp\9104f14eba9f59563c669490d37634d2315ef178b391d3981cae5aa1bb396ce2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=79.0.4143.22 --initial-client-data=0x2b0,0x2b4,0x2b8,0x2a4,0x2bc,0x1404341c0,0x1404341d0,0x1404341e0
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4260

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3812

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:452

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4916

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2472

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1984

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4736

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4028

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:496

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1236

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3488

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1884

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4472

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2564

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:932

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1128

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2924
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 318ac4a2c25a1bcc87e89e40186592d64caa4e34750548b753d61c4dcc7dcf9d
MD5 0511b79e17554efa72f73271625ffa7e
SHA1 02440086949fba4320ea8d8d36a803f4b49e244e
SHA512 3fc51fb7a78ac9f37bd9dc8cdeadbae3b5945d27ea1a677768db73c20546cacf2c460bf5ce7c6d8bd5c2fc3e25bd38b570d86474ff5bcf1969a5445563d038b9
SSDEEP 49152:+b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnIW8zjSIxN:A3q6sjBwKSIx
TLSH
T1B7D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 4773df6b83a23918cc5ce1651cc9b0b957fd4e825ac58e69d5f18b8db6fdab64
MD5 fe0d0f3cdb17e11b3632cf64189f0e86
SHA1 9dde5a1b1e8069c5b74081f5fc279d593b6d6162
SHA512 db5ca6cc956e464148c0c036c70fb8f6cb99f5dab5f1caacde8574ea6615a683a7ddd50d91bdab70f09159caecbc58848704f307d26baa8f2022500662d762f5
SSDEEP 12288:91XLsswWkxy2lRq2czAiH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9L:zXYfDtczAa22Hb5Obvb+ISeZxNx
TLSH
T15775F129639109F9DD67827CCCA28502E633BC924760E7DB03E4A9295F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 86c67a55ba0f1a1e21bd63dcfe1c365760bbae502ee7d0b9753e9053c50985f8
MD5 15d3db39708a7d53ce419ff5fda4122e
SHA1 9d1d9e5174da94299ca5b09b28479703b3191e07
SHA512 51e88e494921956a130c916a5cce1eababd949f31307b38376e01109743763ecc8c70cd8e9749fa87439d89187bf51026a3e035f77eb731e29efb8e85138205c
SSDEEP 24576:T0Le5ji0hmxxrMN22Hb5Obvb+ISeZxNm:TPji0AjLW8zjSIxk
TLSH
T126859E16F6748371D073C0B9C5D2A68EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0ce3badcb8517a4b877c6a1e167a5d0a3445caacfb7bedf9a79553b723c890f8
MD5 fa7742cc9b1c926cd630221360b62a1c
SHA1 fc3ddc24bc6d20385e4c7fa7978a05e7fddd724c
SHA512 a54dc8abe88a2e618420e0cfed038ac0ea4386a3e75bc38953bb8b2dc07be4f8ed10f1a23c4fc975a2adc57435da12662e07a097f0853d05c12b17f31e5b4fd9
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWn6q8wyuv22Hb5Obvb+ISeZxNv:R/ezSC6vUzPveHjy/W8zjSIxF
TLSH
T1A8755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 37427308e7abdef0c380c8b3d39beb4b37de67170ac77f0f6d4eadbbc8259d31
MD5 f110f595f7da4b45cf75e4caaa0fa2f0
SHA1 1879d5dd06e53ead410e8b6cc317e58686e3a5ca
SHA512 9f0b20ba965092c28b116292268c485972ea6dcf11a7e6566992edd3fbd173c692fb7e0ccb664231b7ffac7c485142fe3d31558ca8a15ebf0cd78c2f2bfd6e84
SSDEEP 24576:VVbqPb88hv/l+Ym22Hb5Obvb+ISeZxNF:VVO88hXl+GW8zjSIxX
TLSH
T166559F66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 2c2cccdd7440158b234c8b4bc6c76d18be55509d25d4a87b5cd56deb42fe9618
MD5 d1b6389b9a234cf29b6e1c5438eff6f2
SHA1 eb4edaab06f75b74595c7ce7a06b40c66bb72589
SHA512 931c22ac63dd5c918aa5c01fc6ed2e6469dc43d7d3b916e72a005523bcf55a91148dc99a83c3268c1303fc3fdcf41d4ede00e8e1bb82194146410efeef8d7c36
SSDEEP 12288:NLlH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NY:NLp22Hb5Obvb+ISeZxNY
TLSH
T15055231AC713B1D2D7B94774CDE2B04792199ED39C40695B09E27E0EAD3CEF1D0A872A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 3fda788bedb01b01bcd63afe29276ad78b4d2e69c15f869f7b3395329fe03a95
MD5 6fb927e2b0b8e2a62c6a7d84c7eebe85
SHA1 515805a63b5cb8f7a9c597b81210b12ff9f469bc
SHA512 591fd42b15b4e842ee3bdd93da66dc6df3b89bccda3c10c81b3d8c103055726dff96a257ea950531bb88f685023264ece364a93db48b9ebd685f2bc7831e37d8
SSDEEP 12288:teBNUbTVO86UOH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NY:tJIU+22Hb5Obvb+ISeZxNY
TLSH
T13375CF3BEE28FCD2C27E8DB85A918240D77278714F52A3CBD165820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ccdcf8b2762815e5d633b8edc09cddbbc1e4ac9ef7e7832404b04f28f01f01a6
MD5 e833a84e20b457cbf835b5c0b6cd2ce4
SHA1 a1b4abc4d0d8c946cbac5b0eee8c04b0750b7b66
SHA512 0974e6465ec2a0dbd66c7836d03bd04f32844fb077c0bd15afc87fd4d191b00b7a175809817673989866d07d4c655a1fa71e46cad63b050a2182f73f20850fe4
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THj:GQvGAdlCEL8c/DRNw5CBKSIx
TLSH
T104266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 8d328d0b42586e64d61d482fc168fab00f57266aea497c91105abf3e9ae81282
MD5 aa98d8471b5d10b988a1d1cf6873cee6
SHA1 4e167f293a96d54e588b8ebb6083dbdeed7f3e69
SHA512 f94199f0a5ea92aed77aee58d2dede2532fd96aa722ad359db20140f85257c6c9a51664a2bf255b079a9fc1313397de138ebdd0de11f1f7cf7cb2549c1d32327
SSDEEP 12288:vAwSfxL/2Dc3RDLLmt0LDQewsAjIH73s32H+2xfhD61sDIpxvbKfhijiuDymjscY:40ewsAjQ22Hb5Obvb+ISeZxN2
TLSH
T16375E031FA75E032C3BF0DB61B66D706542CB9604F511AC3E3E89E8E99346D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 09dd6fcf1af7a34e16e92b40d7bd01884d3c8ace7977200e5c0ecbd9a55faa60
MD5 a8ee4e82264479970670f8b4565d124c
SHA1 b8c1820c61846fef8ef243e451c96ea97d827e6b
SHA512 9ecaa3049f530f146bc33808f67a0fd48dbad574e5a1a05a505b0872ac29071073f53a43229cbda22b89c3916facd5902fe44e857025904994072c67e05641e0
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH7x:yUEtQevvqc2W1cpV2tI32V
TLSH
T1F0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d851a441f914512289d921f35a5dbd2133526cdb98c4bf45114aaa321d4ecfd8
MD5 8f8dc1491f705ab0ddc3843a9985969f
SHA1 51586fa55e668d4b557627ef48faffe1f1cea729
SHA512 27a0674fac0278e6573eaed9337f4204e9345cc81bb92e4da5df558c3da70648000e6238f6c3c14e09c8c0a6945fa3452af07b5a7fa36129afcb07b7b93d4322
SSDEEP 49152:ECbRquA/m2yL5zTfFiV+XenmE3/z7W8zjSIxi:NoquVjnmNKSIx
TLSH
T1A3D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 534d6107c663be16adb2f74cb5b3951514f4f904bf213c5943618d63efe4ff84
MD5 64221abfc12dd19792846ab92d546517
SHA1 a44452b55a21bebeaa4353503afa994db7986b52
SHA512 f884c4f3fb2c187b2479ae93711f7467e655b3ca729f881318d32195d3c03a9c44ac715d91de19ade55993c290520349ce5e9f2c32a172c87c3c646e6af68803
SSDEEP 24576:rAhGL3IFoiwtA5l7S53T22Hb5Obvb+ISeZxN7:rAMUFoiq5yW8zjSIxN
TLSH
T10B35AD80E7F955D4F5B3AAB899B69171EA76BCA65E30C20F1160D10F1E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 6d3b2d20f5350bd3b197a5a4f7048ae28c7bfd80a71d9a4bfb07973286e02ed5
MD5 cc74e9dd79f25e2a3d7f1099dc5f09a9
SHA1 0a02821b6ec7dbf7f6f80e53d29e1b34e8ea8c58
SHA512 ccd20622a8b968beb3a30c17af1f715e15f219d660fa8fa6ab2f7a2d539220c52faff7e659fd07e127f9f0cc736d35c3d0d885ea08d6b38c2a84c9b6ceeb2e41
SSDEEP 12288:Kmw5HEjsChNVBFgl0WDm+CjH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhL:Dwu4OW022Hb5Obvb+ISeZxNP
TLSH
T1CC75F10573A51CF9EA678238C597D136E7B2BC522A21D71F07A0C61B6F37361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 37c98b4bf3d331ce3b905fce423152f7d4d54fb15b8eb1d6f107ef2b1a6cc346
MD5 a851c11944a855bcd18a6f7c06362a45
SHA1 3a83d34fe285f951bcbdf63759a8912511664c42
SHA512 9447dea07aa77478de74f8950cf0cdd9115148c291954b68e42239c70234fc6882132d0358ebff6c07f3d5afa42b8dc316fa6bff5a1755b2e64e061b6b0e7f04
SSDEEP 12288:PeZ1IyYH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NE:WZul22Hb5Obvb+ISeZxNE
TLSH
T15455121A23A170F6D2A7427CCDE1A546D332BCA36B3143CF06A1661E6F36ED15D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 02933327831124a0c20de5728c1fe373a63d432c5b600c6a9399d3ee759891b6
MD5 27c9ef39733a312d9b0cc62c080e9842
SHA1 fa5409f061694c5c726dec654576168f7a7f6e4c
SHA512 5ff74a3f7b5858d09709097e7dff74dbb1a36ac7bf11007eba51b039e4d6a6372183c7444f3e53f952025f1b95044e7aceea1a30b00363bc447d8a2ada7897cb
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ud:aQRQyi36YOcPbLvw2gAf+PN3kKSIx
TLSH
T146666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 710cb4117c5c5850c4d6d60829154b20fb0506efa36c4f1ce0f7cd900b3397ac
MD5 5d7bd48bc94ef397b9a83f7eb276e720
SHA1 ff8025da33311d013635d19919ff7c839aca590d
SHA512 7c66c649fc1f667bade67c5b10d97f0cc975d70da2821228ae5ce49d815e268c2bee1952f5341b830ee76e0e398989179f3e02967dfae51c452980c8c3f3b16f
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UU:+QRQyi36YOcPbLvw2gAf+PN3kKSIx
TLSH
T186666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 156d76b4f380b2dc1a6e1772e67761dd09c05c4bcedb26ffd6b22440afe03354
MD5 d96455e488c05158163e3f85a02c875c
SHA1 d29b4c4e3d7433f61fe4b3c9c700a3490b59e012
SHA512 ae9f8163c1ca53a4486cc025cb9ca15ac01c50481f328bf0cea9a0724f348f2f0c184b62bf390eb6be3f3ee46c63a5863cbbbc5b6da5b7545205d03ba91163c7
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0V22Hb5Obvb+ISe2:V68Qg55nhceWu7PNU3/LW8zjSIxC
TLSH
T124B55A33B2F200A9C44DE1769F4A972196D17C758FE0E3DB8551720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d40047bdd084a988c3a55a5ed8d0939745a0ab4966f4b7ea69ebc722d20ae403
MD5 11e0dd55da74591ac10df7ca7eec52c9
SHA1 b4b804d0c24ea751f0a8971fa5fbe112460b0dd3
SHA512 d6a94900018198c8242364c6de7ceb6e933a456604ef4033b8389ad7c5e48c6f7989b5ebff9b7c9a18307f17c57c757037b3c3ca25ba2645addd5732ee2a555c
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99w:sy5112gYy5azzVvt69nLKnhZjKSIx
TLSH
T198167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 13f4480d853d04bb13aa51dcbda7a5f347c3d6e8da39f1e24ab83cb963c982ba
MD5 e7883a56b38b1e15eb46f93f6e5f72a5
SHA1 1837f12a55f10ef5d75fa82f1c2e30833e243ba5
SHA512 4341d69253ff90446c345a65a1e00bb08a473ccac5ff55688c5108549f9da62ebbc555c26992eb202dc24422bca3f4b5d4880df8793b141f77640e125cee9a0a
SSDEEP 49152:FB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glBW8zjSIx6:ru6Jmdxd2dcKSIx
TLSH
T1DDD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f9fe491b19e76a985c373fed57aeead97fe4b4fbbcffbf1132cb7277c91ce53c
MD5 14c6b765f145b578f3b2d49802267975
SHA1 c70e8f4d3201606282b099fbcbac94103796bf72
SHA512 e86eb5a633e9afdf22b35b3715c4aac973b45e41b0994ee876ecee54b9425e65251a02977d76e1460ffe0ae01e3dbf9bba7f635c2bc65bfa3c691a52dbcc9051
SSDEEP 49152:c1hpsNoJpF1A63U44CwH7R4xlW8zjSIxS:cmifPWRNKSIx
TLSH
T1A0B5BE13F29901E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c0d4d8eee42d47f49142ea80fd474bde7be264e95bbf67f64ab1f6ba371898c9
MD5 636efc1b55ad8694d1fd716c91dc6dec
SHA1 097195b7e0f8d124d57f09e84c0c0853997c476f
SHA512 99c7a1f54ba41d3cce1694d7cbda979fe293fcb72e25161d8120367c9bdd411bcaf2dbb583dbc30899e05af4a54a15577603cbe9678c1f47dcb01d320f79a972
SSDEEP 49152:iSuZQIY0Be2KcRVtOnks6NMHqYW8zjSIxs:85dKii613KSIx
TLSH
T141C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 58a226f7f960be3aaf529236f2c9d0a8aab665e7091b1ec781239404bb541596
MD5 a3d44f9a823cf14d646b0de91b06095e
SHA1 4cc8b2dc5024ab9cf77af14119f54ccf03d10ab7
SHA512 1b037eef6e1766e0f53dc2c39891a466c3442022f60e5caa280cefb681d21120d7dadde44f85934fc8bb3b0ff080c8790f52dec551ed590ae3894ab93b4542aa
SSDEEP 49152:OhtSn8EApI0fig3giDn0AP5wRW8zjSIxY:PX2imphpKSIx
TLSH
T16995BE13F2D900E8D05ED178C7468632EA62BC160B35AAEF0A90B7561F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 1e2cd7a97f0fd6385d46e7e87a59932ed02f33741ae07919db4d46bf53f9fafa
MD5 2e71a4409955e434dd7b381721179aee
SHA1 bc1467a9c6178fdcbd30bb0fdbca3b7779eac462
SHA512 75a71918fcd3f500804b83347bcc4a7ea40866157b080946a3f20e59defa9679690cda9870db2dedc71f2fe8b16912564bd35e97a7aa0420f3934c983bc4a262
SSDEEP 12288:AdH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NE:AB22Hb5Obvb+ISeZxNE
TLSH
T17D55231AD613F5D7D76887B4CDD1B0879208AED3AC01149B0AD7790EFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 4a04bd1364a2f579e2dac8c5cdcd9f8d60b1c2d82ab24048b67b822b811914b3
MD5 9b0198a0067c21850c28be0b4ca6eff5
SHA1 d75e127b857dde33a9b371701952c9f50d5c166c
SHA512 842cab3f87c12fe242ba4ed5d828994b9f8a9c1a38e3deb9f5852e20df5d1967883915767ee0a1a6ad798c82abf3ddb079aa2153f96dc734b8b1ff1afdc6a7c5
SSDEEP 12288:h8H73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NE:hc22Hb5Obvb+ISeZxNE
TLSH
T1E255231AD613B5D3C76887B4CDD1B0879208AED7AC01159B0AD77D0EFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 e85ce2c55591b29e80b4f70eb0bc217a71981e8e71af050d1f749994485e5634
MD5 cfbd9903a7aef59776cdc7aec0576bba
SHA1 c1ef22f291e59b0a3df8ed28242bae4d63ce1b24
SHA512 32add04c1725197b8be132dc960e9132092cee394998b0c0c1350259676b7f3f06ff3e02c683f7626e1367fe7fd0fe281e0e533a4b3a05d5473615dafcf0f055
SSDEEP 12288:mGH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9No:mW22Hb5Obvb+ISeZxNo
TLSH
T1BE552319D613F5C7C76887B4CDD2B0879208AED7AC41249B0AD7790DFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 e67c58fc319154fad400b2c57a5f07a3de278fdbe7fdcd907c80f0358049cbe4
MD5 f5f0931f6a6bb4c9205809b2db919070
SHA1 dd2494c4051d74ca512435c5780c6d3c19797465
SHA512 95577a567e13622e0515af021124c7673edb3cd781cc7f2f2f9bd875f5fbfc2e464ab7376692d4b698de3d747b2e5a9ca84fce0793dc563d9b4d2b7adf39e626
SSDEEP 12288:tVPH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NV:b22Hb5Obvb+ISeZxNV
TLSH
T17055231A6753A1C2C7B5C3B8CDE2A046D225BDD3AE1156DF0AD23D0E6E34BE05478F29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 a4c866cf1e6f0d7024aef7952d4f600ccc13a9048c0b25173c30c70ebbb0bad4
MD5 c4fb3ad53ae20e64e38617ed5d4193f3
SHA1 0556a3caf9d33803af44b8774afb5e9ed9d21c95
SHA512 b98a01fcf5c3933f1874fe18564353278300fab7a9e7507e2ef65c5e3979d2fe3d7efbdc4b958fea1a9af7b4896ff9d99309931c0a0c095147d64ef81447431d
SSDEEP 12288:s3H73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nx:s722Hb5Obvb+ISeZxNx
TLSH
T1D9552319D613F5C7C76887B4CDD2B0879208AED7AC41249B0AD7790DFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 50b84efe51707966fb5293e7f4139c053e1f35cf07b593b6642b5ba8b17c3143
MD5 29d12d5ec164527d156803c3c804a868
SHA1 2f9d5eaf5f325f94d025b8ba1b161d9d5cbde7d3
SHA512 394e25c946d3ec60e4b925a43e50871955a9165f46537e8959088526a491d243760acf149ea1319d71769e74121a2a2cf2af12c455d40a07b3e929811e64f7e5
SSDEEP 12288:YgH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nx:YI22Hb5Obvb+ISeZxNx
TLSH
T1B255231AD613B5C3C76887B4CDD1B0879208AED7AC01159B0AD77D0EFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 479dd617098973306de710baa988bdf739af5d8bd9b1e7703b89dcf197632425
MD5 361996e719c5d1f86a0b2a82d03a64c4
SHA1 34be04de486b74ff6347a1a307a0a43aa35c8d0a
SHA512 d74a45a527f6d7ca51afa760e7b5607146131c9e917e2edd177bd23557d3b7bbb4ab923c23e981eb2e8a3c6a099c2d19dc24d56869e757a5fb514116f3b4d3e7
SSDEEP 12288:9EH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NF:9k22Hb5Obvb+ISeZxNF
TLSH
T18B55231AD613B5C3C76887B4CDD1B0879208AED7AC41549B0AD7790EFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 05b24fcd0e79dfe97a7620400989e0b7b5ecc0ca01b92b618990ef063f72478c
MD5 212ed9866a42ddc981a13c0d60f58fbd
SHA1 d8c51bbf40abad524d02746c40a7dd3be63c6404
SHA512 c89b574d8c1e5a8859222142c5b7b9e55dafa77624b44fd752f29adbb722c68664196674bf32eea5ea3aead80833959b3b2fb871c6a623ae954ffc9909d00ab6
SSDEEP 12288:fiZwbVzzFEoS2cPvycH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NH:6ZMRzFVSO822Hb5Obvb+ISeZxNH
TLSH
T110750159B35118F5ED67823ECD519906D272BC5A0A60C61F03E4362B6F337A11C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 8eb80a3a6f82ede9e9d1599319f076926dc50d3df447c4b816d82b0562523e29
MD5 97b8d544fd8b1692be050dbada1701bf
SHA1 9eb6c5a05d06d23624219ec596814eeb93d44215
SHA512 04e71dae919fdec124c81b5124d3c30432a873d0abab98126b2893bf59a666e6b00f1018b4c2d617e0df2d40b33d6b9d4192c2d0d4ef938b726e3d19ccc6d11a
SSDEEP 12288:JpH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9N5:J122Hb5Obvb+ISeZxN5
TLSH
T10655231ED613B5C7C76847B4CDD2B0879208AED7AC41249B0AD7790DFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 2a7a473b5659f011a0714597430487b32eb5d6899626974539eb497685d19297
MD5 88800615435bafce9ffbe70da357e532
SHA1 13776b4342b86e97d5fd456173bbe37acc7e08ab
SHA512 8033993bfcef3a58592066358aedd1e1e5219438f80d8eeda38a4bfa7a86e05e58eb3af123d8b736e181672bcd14cdf87330e757561dd5f23800e50e099b8526
SSDEEP 12288:L1H73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NC:L522Hb5Obvb+ISeZxNC
TLSH
T19355231AD613B5C3C76847B4CDD1B0879208AED7AC01659B0AD77D0EFE38EF150A8A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 7ffe3675260b6e484e6db81d7b408f6178379b31563e574fe2e97e1ed83176e8
MD5 655a867b84cbed702f1499953d589ab3
SHA1 9a5c8c99332705ba31834ab4562e9b1f46d3a63b
SHA512 eb52dd9b76348c08d5b67ed02c189f179dafeb6e6dab04a058246ff0f46f2c27aa92a8dbfb8e0a2e157f5a2d721b73473ddd596579756ddd0a1ce211b9b7461c
SSDEEP 12288:AyPz5L8YH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NE:xzyg22Hb5Obvb+ISeZxNE
TLSH
T101650217736230F9D2768238C8A25502F335BC724B109AAF17A4173A6F376E15D7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 7750750bf297d819bb0f34527a3eaeefb8f90e5c3150bbecc3716b55b82585cf
MD5 b808074edccf45fbe0fb2ee8ac2a137e
SHA1 2490e031b5530a9fff0112cdce9321e00c2f0fdf
SHA512 32095996c00cdfcf4dab3b9b7555cc12fa7c4c58d82ce756941cdacd8d1c6bb99e9a2c375c3fbb19e023d0b1bb179c9c8271e5a32919ddce3ce6724a2bd1acf4
SSDEEP 24576:wcP4mcvIjkGOxhKP2l71SNKbrh/8KB922Hb5Obvb+ISeZxN8:bP4m4IpOO67N8KuW8zjSIxC
TLSH
T18C65BE2DABDC0096D0BA917885658A4AFAB1742A1F3286CF1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 5df78416f3c81b646deda2df2969425d9951a99b410d836d1b5a18f0e60967fa
MD5 3391d319a51a738d31feabde09d06484
SHA1 55b0155f524aabb6d181bfb69724b84d8502a60c
SHA512 14f8a0a0c7d10c93022fd58eaa7a829c148c1dc5bdf272cfba44bfca56a95444691c6a637c6ab5802606368831007e4e1b917e13281a4fbb1c9fdacfef0f9b3b
SSDEEP 12288:CbsfZH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9N6:5l22Hb5Obvb+ISeZxN6
TLSH
T1FB65011AD25412D9C16E6279CB929641F3237C628BE1D3CB16D0F93E1F3AAD05DE9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0693de9-4d10-4a4b-b80e-3822dce1cbd1.dmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\reports\f0693de9-4d10-4a4b-b80e-3822dce1cbd1.dmp
Size 332KB
SHA256 959248f0d4c56997bdffc6b0258355a8d66170f2981432cfea99dc5a4893331e
MD5 23c2bf7bf2c0eef70d0cb6713e4c5d77
SHA1 bd3c464a8c1ef665f5cd825889eef343c930a510
SHA512 fd8a2b8d0dea8d610900150f5edf52cff4dfc09e09c2047112cc0b982179769d0d0de97d8a560fe72a5f5a9f578f97442c98cd535a41de4df26435b61684e389
SSDEEP 6144:anM+ik20r2K7v8uXFXZWuaby4nOg9jI4XPdri5nJ:anik20qK7v8Wxk1tOg9jPdreJ
TLSH
T11C74F656E3E616A6C13AF336C5C79721BBB2F82117024BDB1350867A1E677C0BE36B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 a91de8eb0620e55118c849bf2ab1297dc3505fc9471e3d6e5ed0f5ef6b130abb
MD5 458f52dde975852fe9dcdd2b50ba86e2
SHA1 c7e691740c1e0be14c0cd6306311b82d64c671ca
SHA512 e945594cb4fde83f2cf5e264153d3bbffb5af509d00a2d8bc61d97070619decd2716a2d2ad77fd78344f568abecdd912cbadf4b7280993ad56cb061ec5356148
MD5 SHA1 SHA512

Submit Download

d515a7f99b11239b.bin

Path C:\Users\Admin\AppData\Roaming\d515a7f99b11239b.bin
Size 12KB
SHA256 3b49b1cf51ce5e7ade0f2044b957fac14b3b22027e71b44cbcf1bd67cd918dd5
MD5 b9e0dd96101e6bd9bd09a8edd94668bb
SHA1 dcd396208a8736ecb1f2b4a9b6a44478501024c4
SHA512 ff16e2f631231749bd73f52b555b293f5651ff3c929fccf6c5e7e43522f7edddab0f4511aa69c6820c6506e8002283bc88efe2b2063be84629bfeeafd7f6119d
SSDEEP 192:x846R9wgsXrAI9qZ9cLhuL0rH23irAdMtI/FZ/c0d2efCN3XoiNwIEfL:xzi9LJQU9cLhfr6pttFHdfCuiN10L
TLSH
T18442CFF50A570A5F3BA29A9CD5743DB906A08D919483602F821FB114C4F9BAEF0153DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 60afc35e561db61115af50b3de1c0ecb42b6b97edfa7a863def65a3a28e2d5cb
MD5 5899feca5f41b02f32302eaa5bee54c6
SHA1 c275a4e92ec84f7e60d87a466d7d06de0fb702c2
SHA512 cecc8ac35d72679e774b9d39916f106172424b1d3bb8fffa3cdf4a36d306412ad9e4b8ed51b31987b6d1d813e1022415179f84206284f86f35131ba57f0bd8c1
SSDEEP 12288:c5H73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nt:cF22Hb5Obvb+ISeZxNt
TLSH
T11755231AD357F583D7B9977088D2E016521DBEE39D00948B59C23A0DBD38EF198B8B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 72620b5560cb42f6bd5b04ad41f9a20712efbd127b176a4901a3c13f9bd04b78
MD5 95cf94364251845750672c391afdfb13
SHA1 e9047196771c9a49f8f7a523a4f9cdd09fea161e
SHA512 3110ebfc3abf0f31eaae7f37d7f833be555e3de90866f446db98221361ad023ab77a9c01468b5a462522617a65bdb0729b2f4b0832758017e9baf3e532728aef
SSDEEP 49152:oa0h2GEkuAe73q3pp46zwwQKW8zjSIxs:oa0hNYG4Jw6KSIx
TLSH
T1C685AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37EE44D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 a1ca57e7b17dd370f623ed548a222c6c23cc1cd021dc91ab7d1966a5195b1a54
MD5 df270e61b417572843c1b137455bb0ee
SHA1 c89f330270e85398dc01b0000fb390e19192bcbe
SHA512 4c3d9438cf01be53ff8274e70de97123a84d1509c1a034a8c24fa3b88d961fb185c101066f3792b6c06bfd9f71330dea9ee380b276d6daa9bf41358bb6ff61e8
SSDEEP 12288:thbHjfXsH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NE:thbHjPM22Hb5Obvb+ISeZxNE
TLSH
T17E55123E16AD20D5E275E27C89929106D331BC661B11A3EF12D2923E5F3BEE45C38F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 3f9359f4571642a00803fccfa1bad88090bbce8651220822e5946750474f6e33
MD5 5abecb4fe22aef16e46d6ca60504079e
SHA1 2678d874cb8e10b8c4f4d2cdc04cf99ea5548c13
SHA512 9bc0a20fca665e9a30e5d2b9e7c773ff496945bb03e376230d95c47b10ba9be79a779515a878eb264eff7fdfdddc9b4a158ac362d48dbe95fc27f52719eaa205
SSDEEP 24576:Z3YgnJcRTk4yti+R5dpR/022Hb5Obvb+ISeZxNd:ZIgnaTk46ppR/fW8zjSIxz
TLSH
T10845BF2DF2B910B9C8AAD236454147B5FB71782D1F209ACB0170C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 bb8c308b8e7f8a7ada8e42e7bee86f2dea2ffe2e63b1c0aec8f048c3ae0d49d9
MD5 2472bdf1ebacb0969cbb7576b045f628
SHA1 1222c36ed1911db567525718eaba25ceef2f21e0
SHA512 30fcc4b9b80e0774193df6d8e9e684b72525271bcc53660be574429796133a19a5c31bffd1d7f18948eaf867a3cce24eb97f175f1df20216fe12b47efeea1e13
SSDEEP 12288:7FH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NJ:7J22Hb5Obvb+ISeZxNJ
TLSH
T1825523199213B5C7C77997B4CDD2A0479208AED35F0115D709E7790EBE38EF250B8B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 bc7dffc0ec780165b9b05ec54e351f46c0b40bbea8f6abb15f61dca6eb0a416d
MD5 59c7092ba716259d6ee14b4666ba644e
SHA1 b135b062a9c0c0c2c7945ff5dca583ad2afa4098
SHA512 29fdaaa1e205e8065051e3eb1007ec314cb42ee7dacf7515317b949506169a58b0f4797fac188f2d36aa7532bd724bd517cde1a62a31fc51d8d542fb33d16c5e
SSDEEP 12288:gObfA4LWOsvAYFTiH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NF:dbL3UTa22Hb5Obvb+ISeZxNF
TLSH
T1A175F115E79510F9E97BC23CC9A29516E232B89E0760E7DF03A94B191F237E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 3d173f1b8e36a11c200659e4366e76534ae9b12691911000a44e9bd0eea5f20a
MD5 b0ec1ccc9d5eaac7f1b624981d5a598a
SHA1 06245c98f5759cef73ec4e9b8342c273ee9d6914
SHA512 320245124e3e23314e57e24f8f618e880300014cda52bd6a964ddca1021732e54f0f8fd6fac2d82420f1711a0ac32f9aa66446196fe82a5460dad92fb777e26b
SSDEEP 12288:+pFtIOuH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9N6:lOe22Hb5Obvb+ISeZxN6
TLSH
T1C565021E33AD20E5D279A27C8992920ED331BCA20B1257EF06D0952E5F67FF46C39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 077aa9eb208436c998bc03d2a17ebf80067c3c45686c0a745fe539f91e967355
MD5 85f50159f3d0fb4f5bf4fe563032ccff
SHA1 0265ed5eccc29757c04c275c443b03be0612b3a8
SHA512 3570cb096d91bd37c1f6443a776abc34db1102c01904686cb1b310326a86f502252273f6f7ea5662bf3cbc1a8bd69a90e91e6efe10260480e9efa4b95418476a
SSDEEP 24576:T7NM9YmZqmWMUkPjZM48Mv6bEhs122Hb5Obvb+ISeZxNM:T7cBWMpPjN8DbEh3W8zjSIxe
TLSH
T1B9659E2E6BAC81D5D576D13DC9E28206F6B1B8611B318ACF1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 4e4b263a944e934e7480de9ccc8706e19b86608f851356d19cbcdbf0cc1535fd
MD5 e0b6449e752317d3c0b708f1f870e48f
SHA1 15277a29910f798f21a7ce66bf0219331d2f1859
SHA512 fbbdd1dd57ddf2f8d3faebdeeaaeab70203360d019c5d7c5c4787173821725b242335c1406eaa859c01f45318106e8ed45ea12f984628ccf92347fccc24c58b8
SSDEEP 24576:JW6BApg2YuyuNDYTabvcRvNYf8km1322Hb5Obvb+ISeZxNK:JF2YuHNETovcvNYf8kmIW8zjSIxA
TLSH
T1A3857E2967ED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 343a4b56e719f0f35811cb0886723c44eae5e0dbf232454f6910cf91c92dce2d
MD5 a8d80558f2e4306902b76fdb6a96295e
SHA1 36f06636accb554cea94f685c2eb2b06f869117a
SHA512 0b58ccbe8d41e12fb88dcdc5460410f75e2636ef68ca183174cc0c1852fe1c901b16149733f094e440aec36b67114a858afcc3279ea9acf6e60e9ecaa84a1997
SSDEEP 24576:iAFs06+OmlfkNXEbToS22Hb5Obvb+ISeZxNp:bFs060lwXuqW8zjSIxr
TLSH
T17E65AF2F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E7F6BEF85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 61c561562a8ce5721b7a8ed7125dc6f40e7ee478a240a4e946375ea2f90ebe76
MD5 c14c6950e8de264c267b86cae58634c5
SHA1 a877c88da0d639425434920e869e0c68f7ef7549
SHA512 cb0f09849f012ca3fb3b5bdc67021b2cb63670839232cd82a3753f44d2223f372ae39ad86aa2815a416ff8852f19800232a25629bddb32b1d1e6b0340c190ef6
SSDEEP 12288:GCJnJ5D3VkrlzxJH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9NO:XJnJ5D3Wtb22Hb5Obvb+ISeZxNO
TLSH
T10375D02DD2A810E8D4B7C2B4819A2746FF72387D2F2269C718B4D5357F12EE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 76778466ef894bf9015dd1cdada125b70b4b66ccf47342c5aee76a61dbfcf19c
MD5 1923e0616ef936083d46592b7855bfce
SHA1 916705561f6cee910e33d0ad411f3f3c3dd041e6
SHA512 d0fd913eea5ee2f7964e50e26155cc67fb75b240d6bc36d9cefb96c4fef2f3f4cd06ba1433767b7a7811fba34b5f1bae118a7761f5244dd413ed31c2db41a82b
SSDEEP 24576:LEPohm6/7IIXdwcXrif7qQncjlP65i3Vu022Hb5Obvb+ISeZxNE:so06DIKdwc+eQnSt65aVEW8zjSIxe
TLSH
T119956C15B7EA5294E9B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 4686e2de56e57f2040855dfd6b43f078829c1bc99bb17f7f633bf0764ab93b8e
MD5 0c2ed2c0e12e472658c2abc720b6a5c7
SHA1 4d0ef499aa656eddfb3e0543e2596c7753c7ef9c
SHA512 c9d44b86fe9135a95079514f3133bb9ed4bc84d0577a36001993ad9584cfb9a0e8a90310f04184ee5c087d1532ff347b940a3ec6f902278b24f66913066d38c1
SSDEEP 12288:qEP3RraH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Na:JrS22Hb5Obvb+ISeZxNa
TLSH
T1EF55022D675DB0D6D27A917C85918145D332F8B26B0227EF06E2E23E8F37AE51D38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 bee58b37f1ff8121ea68f4618592e4a054b164ef32a5ff9fb507a913840e7778
MD5 b9c54ecd917387c592619c4b66439eda
SHA1 73ec7cadf75667c2b8cea2af1c5ed99134cfd5c8
SHA512 e5f05b9164c69936273cfb5d26ed8fb01c9556bf2c7e57ba27472cd37ebbe1003d86dd73e24529322b2e6b82c93085dfe0dded6e6c16d665fd7f743248dbbbd7
SSDEEP 12288:Qjky8H73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nb:QIyc22Hb5Obvb+ISeZxNb
TLSH
T17B651208A395B0C5D7B94638CDA391918634BC626F1152DF15D1FA3EAF3AFE0A834F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 4334226f5ed48b650ff56fa86d19462ab2452ecc1f0aff772e1127c716291d2c
MD5 c1198b638b1dbe95a5728f7b9f77e04e
SHA1 d00cd49bc223a133e634560aad11264c5d1caec2
SHA512 094a477aa7f76ce3fb3b8be618be7d917a0edcafa3d3ebc9453a88cc90b42ccc519457a7556929f2f62f1f62852009c80457c9eb4401b209a031a8e0fda70753
SSDEEP 12288:lF+H73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nq:bu22Hb5Obvb+ISeZxNq
TLSH
T11455231D9213B1C6CB7547B8C9E1A1468214BDF36F0124EF09E2BA2DEF39EE150B4E49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7d9eaaf0d5f6751e79b460c900916b437c4255f020d8170fd5f1e1b195799b45
MD5 1c388f17a328490a65294029f3cb42da
SHA1 b2d7c9f0c5b806537d71161813145e7acb30d8fe
SHA512 708768c65dd33bb8c0af8d00ff1370e452adfb4ce3e5f1b8440ddc95699d697e27d4f44e0800b6c822fdeab4c39ed26545208430f37a62a392750a07214dba4d
SSDEEP 24576:tQ9MxZKdcz97w3t22Hb5Obvb+ISeZxND:tVKXgW8zjSIx5
TLSH
T141558C2DABE905CAE177D279D5A250C3A633B4311B31D6CF2448D03D4D7AEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 68b6466832220f6aa2a49c4c9b1f255baa378b2f18327407dc1a49aff71d8cf4
MD5 71a58b6c75ba9a16257a130f68054894
SHA1 637c42b694cf4a7e5619a42d15489c0382d3f6f4
SHA512 9949bf8249485c380438ec1123216fd18162ed360f4fcf16c52c366ddc26cc442b574d3b92a9e4b7fae8f2265c45f68749af2cdde19bd9c5cc62226fe98879e5
SSDEEP 12288:jyoKo2HRple9pIH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9N6:jyocxApQ22Hb5Obvb+ISeZxN6
TLSH
T1A065E01FBB6A40E2E176823C89818245E733B4715F5253CB5692C73D8F27AE9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8fca789f628628a0e46cb299cb7b01f77a22a10649dffca6fb5a0a724e3861d3
MD5 e761a6a09d3d98fa83180592eede6605
SHA1 2c45a13514949fd3a90b6e9a0152a9a3fb441d35
SHA512 4c9760956d91b5f78bc0b65c4ffd92d2a38810d66eaa8e2e3010754321958d00b459505e727f73c43e970f5c662ee80ba074309a21b57f912f63097339a58c46
SSDEEP 49152:nWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKbW8zjSIxA:f0zuNI+KSIx
TLSH
T1EEA57C3DA2BC00A9D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0ccf87005f8facd19018cfaf84afa89affa7ceb003f30a2d76f78776e7060a41
MD5 876e8a9d1ec7d9995f9f55e0ef6f6fbf
SHA1 c5d31dac19df1c7d61d104bb02373423a316ad7c
SHA512 89ec7af5238dd67422faf133e3165490c177a235b0887e4a1991bc59ca34e72b4fbba5122f3e397a1b40fe9d9c08ae7ed7c0654d2e1a8521bfd1e2fbed444436
SSDEEP 24576:F1QT7EcpfxR+N5AWAz3ooiYujMqbP22Hb5Obvb+ISeZxNy:gTDxR+N5YzT4jMFW8zjSIxY
TLSH
T16655B02EA7F915E9D17EC5798A23C502FB727861073193CB42A0C13E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 663fb27aafcb6993a3911b50ad75b52dbb62a4553a753a70f03d0422f2b2f0d0
MD5 1e23108a28fe525cea647417a02ed8b3
SHA1 64928e2c52a500543460ccc6ee3201ed633cdb0c
SHA512 a4fbaf27bd88e5292698f22b23ca6253e9a75bea572c746297a7ef94f23af00d790999fdb74e55f9c6162105be8634a0c51595391bc1cecc75df7ba4431d81c7
SSDEEP 24576:5TMdOz0FFS+bmSLz22Hb5Obvb+ISeZxNa:T0K+bmSLiW8zjSIx8
TLSH
T1D575E13EA36D14E5E57AC27CDA438906E67278A2032266DB06D0C17D3F5BFE47939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 c8ec350c4abaa21b358c19ccf069dde2a7b5cac8970d8d9df22ecc334da28482
MD5 3ba01ba4eb995e829efb9966b354cfc7
SHA1 c1633c4260a4308128e2d4460103b730ae11090e
SHA512 798ec14791a9f5fdaed677512cb2df8a7b794d447758ad9b5aed990b2074a48fe50360c4c93044fdd621356e1e18ffd0e896209e299d3046e76f25d6bad02633
SSDEEP 12288:C47iH73s32H+2xfhD61sDIpxvbKfhijiuDymjscGCRPhZp9Nn:ha22Hb5Obvb+ISeZxNn
TLSH
T11B55121D53E930D5E6769374CAA251468230BCB31B1126FF29E1E93E9F36EE09478F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/452-81-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/452-87-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/452-372-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/496-152-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/496-375-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/496-146-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/932-382-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/932-231-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/932-237-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1128-384-0x0000000140000000-0x0000000140227000-memory.dmp

Download

memory/1128-257-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1128-507-0x0000000140000000-0x0000000140227000-memory.dmp

Download

memory/1128-251-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1236-162-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1236-156-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1236-376-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1236-485-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1236-487-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1884-378-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1884-177-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1884-183-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1928-371-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1928-77-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1928-71-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1928-506-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1984-388-0x0000000140000000-0x0000000140230000-memory.dmp

Download

memory/1984-121-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1984-127-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/2328-379-0x0000000140000000-0x0000000140263000-memory.dmp

Download

memory/2328-188-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2328-194-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2472-110-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2472-116-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2472-387-0x0000000140000000-0x000000014021A000-memory.dmp

Download

memory/2500-505-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/2500-40-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2500-46-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2500-90-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/2564-219-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2564-208-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2564-217-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2564-214-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2848-494-0x0000016D2C260000-0x0000016D2C270000-memory.dmp

Download

memory/2848-495-0x0000016D2C260000-0x0000016D2C270000-memory.dmp

Download

memory/2848-493-0x0000016D2C260000-0x0000016D2C270000-memory.dmp

Download

memory/2848-497-0x0000016D2C260000-0x0000016D2C270000-memory.dmp

Download

memory/2848-496-0x0000016D2C260000-0x0000016D2C270000-memory.dmp

Download

memory/2848-498-0x0000016D2C260000-0x0000016D2C270000-memory.dmp

Download

memory/2848-489-0x0000016D2C260000-0x0000016D2C270000-memory.dmp

Download

memory/2848-490-0x0000016D2C260000-0x0000016D2C270000-memory.dmp

Download

memory/2848-491-0x0000016D2C260000-0x0000016D2C270000-memory.dmp

Download

memory/2848-492-0x0000016D2C260000-0x0000016D2C270000-memory.dmp

Download

memory/3332-380-0x0000000140000000-0x0000000140243000-memory.dmp

Download

memory/3332-204-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3332-198-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3488-167-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3488-377-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/3488-173-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3496-8-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/3496-6-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/3496-36-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/3496-0-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/3932-108-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3932-106-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3932-61-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3932-91-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3932-67-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4028-374-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/4220-221-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4220-381-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4220-227-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4260-11-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4260-17-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4260-488-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/4260-20-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/4348-385-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4348-268-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4348-483-0x000000000BDC0000-0x000000000BDC8000-memory.dmp

Download

memory/4348-508-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4348-278-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/4348-311-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/4348-294-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/4348-262-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4628-383-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4628-247-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4628-241-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4736-131-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4736-373-0x0000000140000000-0x000000014020C000-memory.dmp

Download

memory/4736-137-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4880-57-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4880-51-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4880-386-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4916-103-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4916-105-0x0000000140000000-0x0000000140236000-memory.dmp

Download

memory/4916-99-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4916-93-0x00000000015E0000-0x0000000001640000-memory.dmp

Download