d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
Size 6.5MB
Sample261003-ptr2rsydra
SHA256 d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e
MD5 afe3310f5f2ca740ecc95d1b4a49d215
SHA1 c185df864c23ea742599e70ef41ff84c1ffe0507
SHA512 e4c0a67ac5808d26a0ef0337bd6f09d8a67defb6d83c78d289cdfe0604711dfafe60d4d7bd089a39aeaa3c4cf9a09ff8cc59c3941df881e40b93d0d0ccb4d9aa
SSDEEP 49152:zvFPq9OGJG1nL6+9AdzjPD4fVbIgFgeSat1dYNBFRsvYWMIw7BcXAY+zABwlNAz3:Z0a9Wsc/7D6x+UGzjm8g2o0E0fq9a7
TLSH
T1F1666A03F19900D8D059D179CB6A9232EB71BC494BB162EF2A507BD52E76EE0BB3C750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
968	alg.exe
2388	DiagnosticsHub.StandardCollector.Service.exe
2940	fxssvc.exe
4204	elevation_service.exe
1876	elevation_service.exe
3464	maintenanceservice.exe
5016	msdtc.exe
3548	OSE.EXE
3844	PerceptionSimulationService.exe
2384	perfhost.exe
2324	locator.exe
3204	SensorDataService.exe
2796	snmptrap.exe
1872	spectrum.exe
3836	ssh-agent.exe
3816	TieringEngineService.exe
1764	AgentService.exe
2856	vds.exe
4460	vssvc.exe
1224	wbengine.exe
1156	WmiApSrv.exe
2488	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	alg.exe
\??\F:\	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\280ecc889b11239b.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\wbengine.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\System32\msdtc.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\msiexec.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\vssvc.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\AgentService.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\System32\vds.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\javaw.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004d0be043453dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b0690033453dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efb681033453dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b68f3f053453dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000316657053453dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae9101053453dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1944	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
Token: SeTakeOwnershipPrivilege	628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
Token: SeAuditPrivilege	2940	fxssvc.exe
Token: SeRestorePrivilege	3816	TieringEngineService.exe
Token: SeManageVolumePrivilege	3816	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1764	AgentService.exe
Token: SeBackupPrivilege	4460	vssvc.exe
Token: SeRestorePrivilege	4460	vssvc.exe
Token: SeAuditPrivilege	4460	vssvc.exe
Token: SeBackupPrivilege	1224	wbengine.exe
Token: SeRestorePrivilege	1224	wbengine.exe
Token: SeSecurityPrivilege	1224	wbengine.exe
Token: 33	2488	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeDebugPrivilege	628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
Token: SeDebugPrivilege	628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
Token: SeDebugPrivilege	628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
Token: SeDebugPrivilege	628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
Token: SeDebugPrivilege	628	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
Token: SeDebugPrivilege	968	alg.exe
Token: SeDebugPrivilege	968	alg.exe
Token: SeDebugPrivilege	968	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 628	1944	d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe	85
PID 2488 wrote to memory of 4304	2488	SearchIndexer.exe	112
PID 2488 wrote to memory of 4540	2488	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
"C:\Users\Admin\AppData\Local\Temp\d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe"
1⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe
  C:\Users\Admin\AppData\Local\Temp\d31e8b57c5db79bef00c0dd1974304c87103f97366cf11ddfe1f544b0572807e.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=125.0.5729.21 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x1405bab78,0x1405bab84,0x1405bab90
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:628

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2616

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1876

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3464

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5016

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3548

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3844

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2384

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2324

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3204

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2796

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1872

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4364

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1156

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4304
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 129262c0eefc6520ca503fe84b4cf8f3524f973b2c7820aaacd016641c37119e
MD5 85098a7ad0f07b214c0fb6523697e65b
SHA1 283884bad8d0b0aeff96b41dd772f7d9f6903a32
SHA512 a7d9fad9e11491a0835eaa76b64679b9aefd158976fbd2dc45a0d9d05c13eb9cec85df5b64456cf97cdb4f45353d4a412aef148997c65719852b14f360303d16
SSDEEP 49152:mb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnO0iHTIfLeMYa7x0:Y3q6tjBZ0E0fq9a7
TLSH
T1DED59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 adae7d52a1a913eb038920ab0e8f7191409b53863ada642dd2d7eb23d1b2b38b
MD5 a0ce8161ccc41f3f528e7ee04a586ac3
SHA1 8f9043a6f02607ede0b4b0272b777bad4812f7da
SHA512 dec82bd56fd08567c3b5634eaf428315ba35b1a41685ce1dd07a62ba567790d953204b35ba19338a8b840181bc69ce3d7a540d63350bb4d1fe76790467aff1bf
SSDEEP 24576:QXYfDtczAT7Vs7iHKBcIfL+9MYEhnbhdxKaANp:ntco0iHTIfLeMYa7x0
TLSH
T17F65F128A7A509F9ED678179CCA18502EA737C954390E3DB03E499761F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 243b7d16bf0dfd4d5f09de7ec9b871c7afd296d89e467bf76bf912850c015eff
MD5 91163dd698f658fda90f321049ec7727
SHA1 51af4c3786c0e089715bbe4a0acc83d8942582a5
SHA512 610ed0d0b3d21f059343062aabd6d234102d7294a032c368fa2b7563d182e9ff8bfebbbc283b716f0ccaec0323697e9022df4a5fe0add412829c40ba16477576
SSDEEP 24576:10Le5ji0hmxnrMa7Vs7iHKBcIfL+9MYEhnbhdxKaANp:1Pji0Axr0iHTIfLeMYa7x0
TLSH
T125859E56F6748331D073C0B9C5D2A68AEE72308657308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d6341a6b0ee7fff6321956c3f26550b672e0207153a332d166d4177fb9c4449d
MD5 d96eadbe400be25e70601d1dade9a7b0
SHA1 f677e7cdff4633d4ba9a094ca5314df18e3b2394
SHA512 e7979a067b9cbf202cff20b8629f78162c08d8cea7d229df896d35f87352afcff1eaea7af449a8ce9564fec3efbbdbf87385ff562298aa460bacba468b2d5fa9
SSDEEP 24576:Ia7/ezSC6vUyDZaqgrvWx6q8wyug7Vs7iHKBcIfL+9MYEhnbhdxKaANp:P/ezSC6vURPvMHjyX0iHTIfLeMYa7x0
TLSH
T1F2756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9d7788a2cf7811eb22de5f9038443de5ca880de4c2c624c16333655d8f91e50a
MD5 e50504b6dfb1a13a74e422b944c348e9
SHA1 9096611665d574289dfc095376b8c34e93556121
SHA512 845ba81ea16226fc1de4d7f421e2dc6f41e6936c27423755862ce876b9b2178f38a5d0ee1a02eba4367ef7f4874d9d51f8976fcd3c1320efaac37600a2cfc181
SSDEEP 24576:TVbqPb88hv/lV7/7Vs7iHKBcIfL+9MYEhnbhdxKaANp:TVO88hXlVt0iHTIfLeMYa7x0
TLSH
T1F0559E66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 8aeb16db049ed2fa9e8dcf0f0a13f84a900085e9bc63b98b61ceba0b1180bcf9
MD5 3f2b296a31bab13eacd63d9a96fe984d
SHA1 cd74cb4ecf7e40c8c1873ad61006c97f93e1cc70
SHA512 2db0600077e4ab93f5fc082cc48d1bccb8e5db40039461897a0ee3d122ce1b6aeffb4aa91854df4e6d49d6642598019a8d752319b6621ed55d4fd913ea817c51
SSDEEP 12288:xGGn7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:xGG7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T110452395C71DB620DB3B65F2A8EC7EC79E567CDC90C002620646FEBB5676108DA538C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f3d33b16cf82ecda2cf50ae0848cd24f4f09bff2e571241cbbfb3d1fb7860c3b
MD5 36f479a2d7ff526a70dfc70c77c63301
SHA1 698c1c9ce00fcefad2e85da39cdd036da60d4f28
SHA512 634cda78255d1a45da476c9d82b46ab805db749a35577e2d84a883f71e5afd69960070a3fd50962f4e1bbfff6a4cd7ac388d1d5b90ac7c73e82d0012ad3fda0b
SSDEEP 24576:tJIUX7Vs7iHKBcIfL+9MYEhnbhdxKaANp:tJIUR0iHTIfLeMYa7x0
TLSH
T1E265DF3BEE28FCE2C27A9CB95A918740E77278704B51A3CBD165C20EDE235D05E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d6ebababa226122b212d7224b4a3e85722700da307348558f3a6ee0cff068c59
MD5 942872834f84c473be05b760ae03df54
SHA1 145f495044fdd15311031d7b745b5c05ff1910cd
SHA512 bfe6996fc33e34b35f7682c1ba980ec9f57ec66bbb256db13668d2e057a8af6cd46bb41a89c893b8ba80836057b39034599f4be0151d996b641289866f0c0607
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THh:xQvGAdlCEL8c/pRNw5CI0E0fq9a7
TLSH
T1C5266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 c3f5e11d419ceecfc7f78c1bc729a18a9d7f85672a5f95714c515f43aaa3c7c2
MD5 09c9b04116ede737a4200c6f39177622
SHA1 c7e5aa0000101fcb540ccf2f7d56c6ea04815354
SHA512 eeabca140f9301ee3dc370d4ebc6f3491a9792701ea173a36bcc190418da06a50845c3750e656449435a4bb6ca122a020282acccfefddd2e4aef9d13510adfe1
SSDEEP 24576:MwewsAjN7Vs7iHKBcIfL+9MYEhnbhdxKaANp:1ljb0iHTIfLeMYa7x0
TLSH
T1F665E031FE74E032C77B0DB21B76D706586D79604B911AC3E3A89E9E5A302C22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 eac352ee3d6780aac7a199388d3990f4fe63e414db8e73dd5ef3e8aed2520f2e
MD5 f4b20b03d216f5c63b36ddddc8397694
SHA1 03cea445dfc1b6c511053b3543f6de8209f22780
SHA512 2ee4c0da73cbe48ad9f5d39e09ca54f573f3a6d2b9a8635fb0cceb971200abb2a691aa6f67b447be7fc90f51a61f20d62eb09cc74f9ef65a1b49a85ff6ca5b4b
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH9z+:7UEtQevvqc2W1cpV29I32R
TLSH
T161474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 22702e6f7e2dedf30e9876b97b147a588d453eeb045c7482ea1af47fc92465ac
MD5 4ac1d773aca3c0f1dd18ed1b27d80823
SHA1 dbe0a3cda1d85329eba14850b693513630ebf241
SHA512 55a537db4696f3386968d86a5208181d130a5b1d9e9f03da54a2be4d0abf263d4d563e7d6b34aaa17889743e65d72fcc0d06bae96cd1247b14a66fc69d966a7b
SSDEEP 49152:VCbRquA/m2yL5zTfFiV+XenmE3/z70iHTIfLeMYa7x0:CoquVjnm00E0fq9a7
TLSH
T128D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b4f286ac9ab4b6672368330253b8d6346812ab0b55022487f1e01d49236ca8be
MD5 7787c43722ee7b4ff0def6ffa14f9750
SHA1 dda7c65b6e21a3a5c15d7713d4a60e7c343d8489
SHA512 851d623a61dbdc7b862d25f2619f6c2cfc082279e4c29d214ab3e9b9494e6f763a3ca46c1994dccc895c45e091c68a328767b9b872a8ea7cca0697da5178d17b
SSDEEP 24576:YAhGLmIFoiwtA5l7S53k7Vs7iHKBcIfL+9MYEhnbhdxKaANp:YAM1Foiq5k0iHTIfLeMYa7x0
TLSH
T12035AE80EBF955D4F5B3AAB899B69571EA76BCA95E30C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 93f883438032614c8b9a32a24a4de28c2f4cf6bb94a7834355272b9fc2a4b15c
MD5 5bda51822f7f525e0d382126532748ac
SHA1 e9d29c0eead1ea5f40c025947f3f80f99e4cba82
SHA512 e6a99e846a94fddf417a4d28f4f3036468f1ed36dd236bf41420ffa30ff670c62e21d3ef08f220c2431651172e1fce22284cc1cc75d71243f4a531588a1e4e4f
SSDEEP 24576:PwuXOWh7Vs7iHKBcIfL+9MYEhnbhdxKaANp:PwQOA0iHTIfLeMYa7x0
TLSH
T1B655F14677A81CF9EA6791398597C536FBF2BC452620C71F0760C66B6F33310AD2AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 34d018c938e267963e57da48699c02ed290c6c8af91994e9dfd68d59b5a4eb41
MD5 4ae41dcc4ea7bf445b15cecd3bb1b58f
SHA1 ceec0cd97774db37a231f9f8bc9966e4e52f9328
SHA512 d8c7646413f4d15a971e44181f87f5abbf619383ddf12c8c11fa958f3205a9a896d178f383aad8e630a4ee17ef5e3e3eacc419bffd74982c80007bd73576fc0b
SSDEEP 24576:xZuS7Vs7iHKBcIfL+9MYEhnbhdxKaANp:h0iHTIfLeMYa7x0
TLSH
T1B445228963A871F4D23791B9CCF45A86D7723CA9636103CF065586BB2F33AC44E36762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 259c934939ee5d9f35cca483aaea4b23752fd11c381c294ae7f5bfcd928aef89
MD5 a86c0b7c42f7bf968157b04598c864e6
SHA1 90ab87bbc659371c430aba758f4f2a325198c076
SHA512 1e2b24d12ef7b3c1c36986c4e3d93c5183f0e3bbeb10d374f4b2f927619b5e2d7589fcdf1d3e0f0548f383dc0374eb609488720c145b1b84ddcc1f3fb194aed5
SSDEEP 98304:rQRQyi36YOcPuLvw2gAf+PN390E0fq9a7:aQyiKakX+PNnz+
TLSH
T1A5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 13fb64fbff8258b3a45c3ba026bad3ecf0ddbbf8c404a232d329f3a3e4e49b6a
MD5 fce1783f7bb9f9a31f2414be9cb6f6ed
SHA1 7ed04d5f1d28b3095da87f70d358284f761ae44f
SHA512 9a6811cab920c7dc5fb110e1f04f0826ac1fb5e2d00fba85aae03b2f29570155bb6307f41192d0b574c37f3113798d03060e3a142427d2b2f05b5c8770aa5f38
SSDEEP 98304:uQRQyi36YOcPuLvw2gAf+PN390E0fq9a7:1QyiKakX+PNnz+
TLSH
T13E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4a4ec46930dfeeb9da0dc1e067f3d3783b60e82fbe0f96add12f86b98f973745
MD5 98ac4c3a7195a36ff5e020ed7b9ed46c
SHA1 04edf4b23f73f69e98cf341b43247a00654d40fd
SHA512 9741bbc0dbef3f6dde8926d35cfb0593205b93d48837580f1d797c2e39a05a40c68a00c8b276a2d79c1436f4e3583f7a8cab9ef74ec77f465fe5475b1e808d9e
SSDEEP 49152:M68Qg55nhxeWu7PNU3/r0iHTIfLeMYa7x0:GthGRc/r0E0fq9a7
TLSH
T1BFB55933B2F600A9C44DE1769F4A972196D27C758FE0E3DB850172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f4806a0bd972706d1e43be0bc9a875debdaf7a5f4d3c88a9c7b07669122dee69
MD5 edbd9ff35da7a4c416cd176a0843d669
SHA1 15584ff1037c5efd35bed8bf5fe3ec1607fb51ef
SHA512 3823a3389a503286c6b8e9425f6fb126cf035b0ba76518439fae7efe2537ee0f0a1953938d8ecc2eb40cbe8fad42b6116a0bd9f4c83cdca1233cea1ca5a66333
SSDEEP 98304:5y5112gYy5azzVvD69nLKnhZK0E0fq9a7:ULIH+Wh8z+
TLSH
T14E167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2fd786d9dd06cf4ae891c09ba69e368fd543bf7e7e7650de3e6b9f690e15a773
MD5 c3c6ce2997501f83b094638c51521def
SHA1 de2d3718118d8ebbd0f248c14cceca63d89f8665
SHA512 06135d037e7648557c5e23bbe30607f3100bea29cc9d14b9c609f1226abdffa9bc97a4991acd0300b7118fd6f2b9f62bb44a5a3de1cae044304f85fd05dbec6e
SSDEEP 49152:qB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glF0iHTIfLeMYa7x0:4u6JmQxd2dF0E0fq9a7
TLSH
T1B6D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e5e3e35b77a60493182e067fe1ace182bf48b3548f1efbaf73247a2fd3f16c55
MD5 8af0157d71beee0b00dc7422119aba72
SHA1 b748861cd5fd9c13646709711401a34cda82a686
SHA512 84803b0a175a9e3bedf50736241f7a5e35237a22a22d8177df1407a0cfcb6cc266b19aed812bde573dda6ceed49c7f647b1bbbf186ca3979189e8527e654c758
SSDEEP 49152:01hpsNoJpF1A6yU44CwH7R4xx0iHTIfLeMYa7x0:0mifPVR00E0fq9a7
TLSH
T182B5BE13F29901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BBE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a7717b15e51cce4dee7210417950681a64e72d890a3ff2abad34be053a8d01a9
MD5 2c9d4f8efa0c7a3571b4174ed6994dd8
SHA1 4a707ee698689a1adf653bc971b6616dfcce622b
SHA512 7042debacdcd688d5370cbdec029d30e78c1c0a31db640bf5552428871003d9519eedac565cc5e25a0b75a3bbe36705935b76353777ce57d6b9b8cb287b9a139
SSDEEP 49152:fSuZQIY0Be2KIRVtOnks6NMHq+0iHTIfLeMYa7x0:l5dKOi61+0E0fq9a7
TLSH
T1FEC5BF03F2E941E8E0BEE67487659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ec6d23b4399c4b7e838d55a73aaa37eb1f3b338d5c5ebdcaa0a95a3dee0d51f7
MD5 8db99b4ce81365ab3934ccb6f0775299
SHA1 991a1b554c7fbc7a74f93941083cd676e6349556
SHA512 66e3bb780501511f5ed0125f8a2758c3ecf95b089e9160af9f742e43c620d807b61a70d4f5c30594f0c1fb91881c43c1bf307ffa89ed7b9e677287864df76094
SSDEEP 49152:ihtSn8EApI0figGgiDn0AP5w10iHTIfLeMYa7x0:DX2i/phg0E0fq9a7
TLSH
T13995BE13F2D901E8D06ED178C7468632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 bec4d38cca0dcb77957c3a1e2784133c227561b0e3bd9a1c3a2df32e948bbed8
MD5 07cfb8e9a1983d671abf5f34c96e69ab
SHA1 a431088258240ce946206fd37d2c8e1415f61180
SHA512 992bb3c321afaf68c7d7cb125b4f7548d85abbe1d3648be9edb2180c60f7485387ac25baaa75543fd26c96c821d0e8f17bfe1638846ea04ca866e4ec9dbd828c
SSDEEP 12288:ien7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:ie7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T115452394CA1FA721D727A1F2D8E86BC6DE4A3CDCE1C002A2174EE9776B771485A53CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 b0c7d3f3cca209792705fe07551b4bc0cdf2464b8761fa046b0164fe87fbf4f6
MD5 b08725d102d4164afe869d20fe95a02d
SHA1 9a09627f33a3d7e2762febf85ec901b85cc2d6a7
SHA512 7f2129ace003bfc29f98d7a1fb86a6a5ba8e95d9be78100a6e5a07a2c1eaab55298ddad484c7f4402999d232b55c32406e1677f23e791f182454a79b0b70f48a
SSDEEP 12288:Tpn7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:Tp7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T1F5452395CA2FA721C727A0F2D8E86BC6DE4A3CDDE1C002A2174EE97767771485A53CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 0221ccf787aa69979d5a956923cab96f2df655cd9e0bb7485f7bd5cd7b6d042f
MD5 0da9bbfbb97887ee0af613f80b100fda
SHA1 0de376c531471236002d0265844eb4f655faa6f4
SHA512 77e2630bb1df809cc7440dd00acc3c88a11197c56431c4159d785b8ccfef1451efed70c46505717ab4be40b477428459b85b2bda0debc34e467518a60acad7dd
SSDEEP 12288:Kvn7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:Kv7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T11E452394CA2FA711C727A5F2D8E867C6DE4A3CDCE1C002A21B4EE97767771485A53CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 0e1fde5e3ba800b2d943c5c991468655760230e2cd6ca8b031cba13656f94990
MD5 3582cea61886876e6ff97e25d1b98367
SHA1 174126b38b29bc6f213280ca7d71f677dd1ea176
SHA512 14a67f0a9771a6a4b2b4e7738fc1fe6fc56ff9ed93a8573c184fc3f6f3c3af74c551f8c7e0ab2af08d131eea1007acbaff0977b8ce7230ab8a16ff8178467a8a
SSDEEP 12288:nVEn7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:O7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T146452355D72E6290CA37E1F2C8E466C6EBA67CECA24103EB0B45997B1F723485D32CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 876c138e767ec716b25b0c98751ab8801d30dc61327b47745e86c74ff045b259
MD5 bd3faad1d3497b4399812a6e3240bd2f
SHA1 21b3c6e79a7bc964b09d83b61c031c9ce17d4892
SHA512 24d5db7468049c2fd158e0e38883580794a8c514390f908d0abfe7c8b327bf22d95160fe0a5e0fcfa3d89dcb8f1343f429b81bc312216eba7ea28cb5ed6318a8
SSDEEP 12288:osn7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:os7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T107452395CA2FA721C727A0F2D8E867C6DE4A3CDDE1C002A2174EE9776B771485A53CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 0b40cccbebba0289dfbed746f7b485b3e032a3447ff9b0c03023f39d055da540
MD5 1cd78045c09795d9a7d7c380ddf15bff
SHA1 ad7a930dba65c583e85261af68793efaa7aafeae
SHA512 b399acb98ef7cdb8895f1cd81d2b6fa7cf758b5425f9f9b3462b87c1869281490d065f74cb6bce2a19f26d1ec8b2d9a5d5ab7146793050f3b093aec067425760
SSDEEP 12288:1Fn7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:1F7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T18B452395CA2FA721C727A1F2D8E867C6DE4A3CDCE1C002A2174EE977A7761485A53CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 7c18f9912d6b0ea00d6c42dc1244f9350e63aedf3a08d8cc41984a71bba33154
MD5 bac1d1f7a0fd5821777a88ae5cecce01
SHA1 c58e54e65ac64ae9f4e31cf1385db50e023943e1
SHA512 927bcf05bc29148ad6de2e3d0a9addaa2193b1a7941a4923b3f57c98c43d575fc21821544d38aa4cd83cca7db2569db55b26d0153492e9cb5c6d41a1074219db
SSDEEP 12288:ORn7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:OR7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T185452395CA2FA721D727A1F2D8E86BC69E4A3CDCE1C002A3174EE97767771085A53CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9b23ae341225b7ae6b19ffb38080caac24b1bd35109600e7ab726f5d48f5222a
MD5 f0995f3ea3b40da78c6b07f5515e6cb7
SHA1 0eec283d7a91cb50608d184dc829e125791aea53
SHA512 cfdd61d313cfe3221cbc22cea1bc006bf1e6e9f07f744fc214d5e0aff511a01700e703ccd83bb80e1af2919d1149af1229fbad90d535d9aa538c2efb02b30750
SSDEEP 24576:+ZMJzFVSOJ7Vs7iHKBcIfL+9MYEhnbhdxKaANp:+ZMJzfz0iHTIfLeMYa7x0
TLSH
T1C6650195B36018F8ED67817ECC659946D6B27CA907A0C21F03A8366B5F333901D3EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 8f739c2c324a95253df63c0ff16a63b2911be0c193249c1e1471037ca26a8821
MD5 cf2882113a9b817e341d5d01d2f0c8f5
SHA1 fe80ac285051321ad4b7ba4f9f4cb74f111f0dc6
SHA512 25e3e3d7a8b5dabd70a1bffbaea780990cbd9f19047681efb415ee030c4dddfec62dda9dd3081089bc576d511a5ba64fe48a6068d135ae066302495c99d50be7
SSDEEP 12288:tin7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:ti7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T1F0452395CA2FA720D727A1F2D8D86BC6DE4A3CDCE1C002A2174EE97767771485A53CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 2236ed19047c5aa6dd91f619c69cb3029783478caaee254e385f83646617fd56
MD5 7c018e31b7563f0997f0636a62f4aa59
SHA1 08f2830d88705168e848832a0589c2813a96a2e5
SHA512 05330698b8f7704390b1d7a0c85e5f458396058d137292ce644ef434c889832e94bb8a3bbabdf9ae4801d1c8ee28240f730563ab5142f1480793d4ad4f4383c4
SSDEEP 12288:YWn7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:YW7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T194452395CA2FA721DB27A0F2D8D86BC69E4D3CDCE1C102A31B4EE97767761085A53CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 46dd0f595710022bafa665a5c51b9153720569d5c63356a3ac3e289e1269892e
MD5 f0d1f4123d34d7acfcab73992d138e92
SHA1 5fc4f50aaf9c7e262464a40bfc6315709c910397
SHA512 c263ac70bcd196d523e5ff2eeed253d2e900529693038f98cf168939d364967a8132a5d1517e52f3f431c9f937b1c1c57b041dc728a144933860f3d5fc5a421d
SSDEEP 24576:Vzyd7Vs7iHKBcIfL+9MYEhnbhdxKaANp:Vg0iHTIfLeMYa7x0
TLSH
T14D550247A36631F8D6379279C8A11A42F7767C79435086AF17A447772F332809E3BBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 ef8e3e01d5fd7154ca38e7890e396f43428f66f31caeaeef76850c4e9728a690
MD5 ffcaee2ecde5d685243271e7318d55fb
SHA1 621357065d71cdc5f662f6e840625e28f784c5ac
SHA512 cb674db91728b2bd93a407bac3d2dd8ae951ddd79e912262cd330d40ee05191989c2c32d21b4cba3619f0c7b8c66dc82c2882b839f929e771b56eec9fd5c4440
SSDEEP 12288:Cin7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:Ci7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T1E2452395CA2FB710D727A1F2D8D86BC6DE493CDCE1C002A2164EE97767771485A53CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 9be69db6f9736d42073d8c56feb7a3c66e062034fdf6ae4d71305df21fa1403a
MD5 2e51dbcdae195a514f587b38f6a4964f
SHA1 c432f6e4ec171a8c86fec9d32f255fcc41b52a86
SHA512 f2adb51b56ad8e8974ca9f4e1a3c0aaf6f016976ce304c6ac8b8ced6faff960bcd475c202c7857a676d010acb36d21751cf235e74b02e824ad763300e24a0975
SSDEEP 12288:Jin7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:Ji7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T1F9452395CA2FB720D727A0F298D86BC6DE4E3CDCE1C002A2164EE9776B771085A53CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 fc31ba10f246569448fab95622152c5cc454c4c18053812c187a469e914a1c7d
MD5 f42792625ade93a257b73d868d159951
SHA1 b9c8838fcddba053d3d63d68fb505fc14b101e71
SHA512 7ecba41616158e893de2dd139ab537ae3793588ef156fc5ac8b453287ba5dd0c06d692fdc20a7b9a4cce49e8f408fbd293cc757412eb3efccc95b58ea86c8d9e
SSDEEP 24576:zcP4mcvIjkGOxhKP2l71SNKbrh/8KBK7Vs7iHKBcIfL+9MYEhnbhdxKaANp:IP4m4IpOO67N8KI0iHTIfLeMYa7x0
TLSH
T10765AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 5074a2c4b181a92d9622633d93333215f0bbc3f89d99feb3aa66f728cec0310a
MD5 dde09f288598b3eb801f3ab1f05008e1
SHA1 85fc74371d95afdaf3e451bc83c35fb2636f61cd
SHA512 69b544517a87698e619ab7529c560bcf6dfe5979b89138dadda001bd35aa94766999a72ac525aac4cd518e8f04423c8f72bc4e7c15c1c92c0a1e9e1317455c4f
SSDEEP 12288:FksfSn7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:VS7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T10E550159D25852E8C12E61B6CB955A81F7333CA883D1C3CB17C0F93E1F766849EE6A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

280ecc889b11239b.bin

Path C:\Users\Admin\AppData\Roaming\280ecc889b11239b.bin
Size 12KB
SHA256 c33c77994390012c031a3183c1bfc84f07b5e088585db1a9ffa9b9eafd79d896
MD5 2a0a5c14df6c76c3bd277cc8f5240d6a
SHA1 e25776e316c72ab73c150293debc347d6c59cd2d
SHA512 006250c8ceb72947445ed01fa7f00ceb29d958013e395e85b3730bffb71f8d6f1494277e8e78da2c4262e049dfc6c349fd6cdb17d5437ea4b29c7267beab0000
SSDEEP 384:lFSV4TB88wiBmKv4JGhKuwhOOo71PEczTk:lq4zwDKvcGhvwhO171/Tk
TLSH
T1B742CF249CFC5D36978C0FE140CF43D4BE5D9F86B99ABADEDA3126A1809C109A01EE90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 5caf1be3405fb7de46e9b0fbf28249aab03d680286c2a75d78cc6f5ea194eab3
MD5 d7768c9e52d2285bb46709ce260e7537
SHA1 cc7d2e40fb42f519611ff74df6afa01e57bb5f77
SHA512 4414d0db31d57d442e72ea219ff4e4bc6ec988e7cd376d0e62b4d74ba475a40f477b039725ddc2b18794935f5a49e1c258b5c20c6557c0e835cd91481b78925a
SSDEEP 12288:Zyn7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:Zy7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T143452351C72EF611DB3BB5F158E896866A0F3CFC928042932649EA7B6B725448D33CC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7170f046c7170316c7564c11c916b3f37df27856eb80c03829a772a777e963af
MD5 f528c1f7377a36eab8e3e60dd2c5ce50
SHA1 cd63581c5c060fc8bb7025c3eeb33e26a947ad4c
SHA512 9c15c612b8cf5597f8742d68ae7996cf3a6617014d0c8e19ec46c04e0bb93c9964ffbddb33ce3e5f536b8424446b8a2ece793becf51de771da74751bbbfc583e
SSDEEP 49152:ma0h2GEkuAe73q3pp46zwwQM0iHTIfLeMYa7x0:ma0hNYG4JwT0E0fq9a7
TLSH
T19085AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 39ac36b893d12f50f924b854072c27b3a1236ddd4edac156d85e327ac9532454
MD5 38ae3e79201961bc79743d87158a00d4
SHA1 2411f41632f5470c05e09ae3ac310e0018dd3f55
SHA512 5701e8adf25cb756ebcf7422d8ee01272690b322550fa7f8fcd1fbd822938e9c7b88afbc2bbbdd9e7b75c589b51be07fdf840e5dde341d5aba726005b86c16a7
SSDEEP 24576:ZhbHjPZ7Vs7iHKBcIfL+9MYEhnbhdxKaANp:ZhbHjH0iHTIfLeMYa7x0
TLSH
T12945127E576D2194E632E1BD8995868AD731BC69130153EF23C2C27E4F37AD84D32E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9448dcfbbf60b1f9ece2dda177639a3f62643c00da34090b4449a12cf9a609f1
MD5 2689abac70e6c9fee1a388ad7d8363da
SHA1 d85f308a77064374c1d4b52d03369b1dd6b8f33c
SHA512 d2ed508b740b841df75e46065c92a413c6742bf09cda1699060c50a9e48bc34387a7f91109b7b4068690fd178d2520da20d82ebe8c2ff3542be55241fec6fcce
SSDEEP 24576:g3YgnJcRTk4yti+R5dpR/h7Vs7iHKBcIfL+9MYEhnbhdxKaANp:gIgnaTk46ppR/30iHTIfLeMYa7x0
TLSH
T1EA45BF2DF2B910B9C8AAD136854147B5FB71782D1F2096CB0170C638AF1AED89F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.1MB
SHA256 9a3ef888862b725f51871833e5fb000d6a3030c6386bbf67e2a384af6ebf3e58
MD5 309a85e26e6e0644c739de891e14d0a3
SHA1 b5bb60c83dbcf7f1f0055cfc6e3cd6faa7317902
SHA512 e66dbb601eabfc41e2d59232cf747ac22deb9a6fd2f8e9a0a65948344f1e457b91dab9ac6f862dc5c806e7b7daad976cdcb87c1439bf443a0cd6e4d32990b2c2
SSDEEP 12288:Lmn7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:Lm7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T1C4352394C71EB610CB37B5F298E86BC6AA493DDC938103E3154AE977A7771C85A338C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 9593cd7e8f873c4d33f8e13c7a78e41a7c443a79ef180a609fea3a8da3d65794
MD5 6fbecd10b05bbc4acda7b04b4168c64a
SHA1 01d952a29473a94fe2371817c863429448946837
SHA512 8e49043e4949d9edbcb5158dcc5a5a7f21d294c2e3a696d2efaac66c577ea2154560004da467d7d339f12ee8257e6b0c10375d9629e2a232db3b220991cdddea
SSDEEP 24576:GtL3UTT7Vs7iHKBcIfL+9MYEhnbhdxKaANp:GtL3UR0iHTIfLeMYa7x0
TLSH
T1B7650155E7A500F4E93BD17CC8A69A16E672789D0350E3DF03A88B661F233E54E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 49f9c9512ead6f34fa9623a22230b1d57586a273e6d0129815792bf2065711c2
MD5 7194644f3ab24ee117149d9f9f1aeb7f
SHA1 af42abf0f65ff2296ac933c1d0b08f5495e729ca
SHA512 4c26e1781ffc150dbeca71192e4d71d2268a46fdbee65189ca3798dc02dbf835bbb7fadf8ccba9ff103111d2608cb8475a7e0c75011d834c974912115a4fd99c
SSDEEP 12288:QpFtUO3n7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:zO37Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T19945021937AD20E4D636A17D89D6934ED772BCA9034103EF06D081BE5F73BE86C36A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4f8d07b13d5ce76a17e9054fb8b7ec247be3ba9be59befec3222c09ce9f189b1
MD5 97b616d3cc532bf84ef5c293094c6d11
SHA1 824549702c397110d4dde370a3b061252669f88f
SHA512 e8697f62dc9480925ec4192f5d5d0d9c1053fc9b0b33bc1ee27cdc3934506121b3ee3725d1275bbb2356dcfa14789cb127f1713ec09384cd5dd57953a0134c16
SSDEEP 24576:L7NM9YmZqmWMUkPjZM48Mv6bEhsi7Vs7iHKBcIfL+9MYEhnbhdxKaANp:L7cBWMpPjN8DbEh/0iHTIfLeMYa7x0
TLSH
T16065AE2E6BAC81E5D577D13DC9E28205F6F2B4611B318ACB1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 bf5df49aa26d3c51548728afda0a764f5e7b998b451e9412974c3f9045d00d28
MD5 4597c07ed8b6eb5c5d115f5b0561c11b
SHA1 bdd21db0dfd1a22567fc2622fd27b4ace5eaa56e
SHA512 b708734ff14d4bfca3712430493132461b17b4a8e2d2c7c69db583fa694da0cc260153117a43b00098b53c6c690a3add9958439c10e2ffc61d0d1e7a4d38a9ca
SSDEEP 49152:qF2YuHNETovcvNYf8kmO0iHTIfLeMYa7x0:j6tCf8kx0E0fq9a7
TLSH
T1E9858E2927ED80A4E0BBD27D45F6D246FAB2B8551B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 58685ba2789a4ee77ce1a79f4d1658cc044e5fec1713bfc6070c4f5db1c20179
MD5 f93b6f8a72aec1eb1a61758a6a27a889
SHA1 4ddd380fb6455d9b06063b9d3d846f1c6245d0b9
SHA512 0163c8861ca20161fd9a56921ac07a3e31b9b2e42d3d12f13b14ae9173ac3f261147eda393105289c58f6b74a971648458d6625877876942d7df5fafb96fc6d4
SSDEEP 24576:fAFs06+Omlf8NXEbToL7Vs7iHKBcIfL+9MYEhnbhdxKaANp:oFs060lYXus0iHTIfLeMYa7x0
TLSH
T14B65AF2F62AC00D5D07ED17E8997C91AF6B1746703255ACB0260C67E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.4MB
SHA256 562eb40e14abed730db76da7566ffc837c7618871fc2edcddb41d8e7c249f019
MD5 3ac93c011bc1676d488d285fc3594a10
SHA1 0f04277de65fd1647a919f9df6eae09f602fdd9e
SHA512 32a2667556ca92778436ef9402fb28412d4cb085547817edb53a4fc9ae3b1f60f9a2824c79022e7dfc98fe8368727e49d5a6d726c76409a226c6855b3e33aceb
SSDEEP 24576:qJnJ5D3WtM7Vs7iHKBcIfL+9MYEhnbhdxKaANp:qJnJ5DGts0iHTIfLeMYa7x0
TLSH
T1E565D02DD2A810E4D477C2B4819A1B86FF72387D2B126AC728B4D5357F22ED09A79F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 074b619f7718665e32275ae42240665d982caa118c551d1b254e11f3768fdd74
MD5 b945b051c9fe95bd8de8500d450bcf01
SHA1 f282840799a9ceb0bb17d37c278fa9992b5ac6db
SHA512 738468f7ed269b8a058ebbcf41a531f18f80ab9dc6d734ee9b9546d1c04f60fa716c8637378a55a4c1743bbaef318f6b909237e7d5a42d2cb29e5890a55ef77a
SSDEEP 49152:Ao06DIKdwc+eQnSt65aVS0iHTIfLeMYa7x0:NQ0E0fq9a7
TLSH
T1E7956C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 8eb2be2aafb2dc565b090e8b15be5fd4603284f23065b810aa2ccd14762cec72
MD5 fb055f47500cbaba51240c13e388bb28
SHA1 68832a61d034610ae0fb86eaaadac0507689318f
SHA512 8aa325c66606886d1df201ae595d70677638adfaa3ea087d32dd6916828cd0aa37cd5d864379ed45a7cdb35fc8bdd4534e9ecc47e788ae2d152d90613b6c5482
SSDEEP 12288:5EP3Rr3n7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:Kr37Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T15F45126DA76DB0E5D63AA0BD84D08685D372F4B4634213EF0691C23E4F77AD81E39E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.2MB
SHA256 b2070d3bdc2669ae187425d84c5c046e027c8e25c9b5549d6426a9bcc89a7e13
MD5 b1013d63b3455a44d859aca4d9b73504
SHA1 24a89e4a097b1bcd2d42afefca20e2dcb98fcc66
SHA512 da794ff03b741b3bf4b1c23cead914f67499d6a4f2e70347b88c18f20604207e5895fc70051d6e01f3a8525f3a13933c0ec6f1c105c569038a0c3463e25532c5
SSDEEP 24576:pIyp7Vs7iHKBcIfL+9MYEhnbhdxKaANp:pI80iHTIfLeMYa7x0
TLSH
T13E5512049358A194DA3A56B9D9A682C59F35BC74970043EF1180FA3F6F37BC4AD32F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.1MB
SHA256 939b8c48207a51ff1abc9912187a5c73f268ffe3447a29724ba0609adaf70db2
MD5 9b66d4f9867a5c650d6ccd0c6a4441ce
SHA1 5ec6595435b8cfdcb24bbc5acb87301ec7d58371
SHA512 f3a86d7032456ecd1dab76e7feb7595cb7d625d62f704d13e8be527ec4ec674f91b36f46b2d72cdf89aeb8f830652fffe465a9994dfbe0f94418a712df91f2bd
SSDEEP 12288:HFHn7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:lH7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T118452358C72AB664CB37A1F294E86BC69A553CFC538002F715C5EA779B721C85A33CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 af1f1c4f98ce1ad2a0f82efcbe6287703b15a0a43bc0c1fb7d36880ba66a3fdd
MD5 89a2777527f2c677f4299ad4275d44a5
SHA1 0ced2d14ecd442f9a382f9d49180ffc26d7c2002
SHA512 b3cb61d624a635371b01195de758dc18539149fae11923ce0767d719d70284e0daf8a6999ecc68ba81e64775ea1bc9ddfbb1a4ad6b4738665135a078aeecb579
SSDEEP 24576:iQ9MxZKdcz97w367Vs7iHKBcIfL+9MYEhnbhdxKaANp:iVKX20iHTIfLeMYa7x0
TLSH
T171558C2DABE9059AE177D27594A250C3A673B4301B31D6CF2448D03D4E7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 19b2d00f68b05da9783bd3aaf70ad6009f5763a49d8f8b511561b2241a06663b
MD5 ea4fddedfb934395f5a12cab5d60852f
SHA1 0643d431e8adab3a0f44f14e9190cb5f7fdad351
SHA512 2f885c92d87dfe8d49d5434ec9ddf992bceb38d8137da1633a815f99d884c3ca1fec8b652f917358b0e0aa431b3bce7e1427b170f8008d159b9ecc254150b8ea
SSDEEP 24576:VyocxApN7Vs7iHKBcIfL+9MYEhnbhdxKaANp:oocxApb0iHTIfLeMYa7x0
TLSH
T12E55E01FBB6E40A2E136913C88858785E773B4745B5253DB5681C33E8F33AE8BD35A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b62efc3936579f8f81fa9ed713ec03cca689da6c374d61690a03d21f6ac7b28a
MD5 bf01fe49fe12c5e09976bc86654f43b5
SHA1 88fc15a6c24c8217a030dfe94f92dc67f2d142be
SHA512 dffe752ec91265ff06d8f6ec75e7d50e975b608fc7f8a0bfc4847a85e7448e6abfdceee228793123d01f77732a70eb72b0cad205508494e597e49f22f0df7da0
SSDEEP 49152:BWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKb0iHTIfLeMYa7x0:50zuNIn0E0fq9a7
TLSH
T160A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 078a6a5a5ca5c47baf16cac1e4e88b00337d49a125a3dd8b91b448057a682b90
MD5 b4596280c18db1c444fb4bd03499dde3
SHA1 b0e9304295c1b913b180dea6d1e7597100829c0a
SHA512 2699557bacd88cc00e5a56157caf84b495ce85865186a54c29d3c33b63e16c8f807f83405d5c2e1dba5efe5130ec2de253f1922a47836376e1a9a5eee8af700d
SSDEEP 24576:i1QT7EcpfxR+N5AWAz3ooiYqjMqbA7Vs7iHKBcIfL+9MYEhnbhdxKaANp:/TDxR+N5YzTEjMR0iHTIfLeMYa7x0
TLSH
T1EB55BF2EA7F815E9D17EC5799A23C502FA727861033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.4MB
SHA256 ee5d62419702dd10fa28e7d6d0d3a8e4f143a017b24a05ef53d0ca0d1118266f
MD5 e828232fd73a6553b2f6b7e589cfef58
SHA1 ae8529fac8e809928043191c3e08cc50297524f9
SHA512 619a0bea0db1036fb27a3fa432e31bead46aa93f2c74ee9219bcbacc536b0b7bef3601c98447cfbb9647213504d1c0e3a99d70b6f4c576879d57b69efe33be48
SSDEEP 24576:cTMdOz0FFS+vmSLE7Vs7iHKBcIfL+9MYEhnbhdxKaANp:00K+vmSL00iHTIfLeMYa7x0
TLSH
T1EB65F17EA36D14E4E53BC1BDDA438906EA7238A5031166DB06D0C17A3F67ED43A3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 d653dc51edad1ad8f4deafdce24cd2f2e12fc0b105062616c78bf3d3f2503e7e
MD5 896db29875203afb48c1eca0d398d764
SHA1 ea75f198681f7c2243b30a06c1b96c47627e7c48
SHA512 bf34f054bfa00642f86fe0f9163b34e60621b22acdd2017c266346c74746f6bd32fe5f9d61a84318271feee032d9828071e65a91a552114c26e08cbacbead1ce
SSDEEP 12288:x47Tn7VK5nrLZdjUAiHKBcIfxE0+sUC3YuyOhOY/MsR2pydxKaYYoNceQPb:0T7Vs7iHKBcIfL+9MYEhnbhdxKaANp
TLSH
T1E945125C93EC30D4E537A1B5C9B946869A71BCB9234012FF25D4DA7B4F336C89932E82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-35-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/628-123-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/628-11-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/628-17-0x0000000002000000-0x0000000002060000-memory.dmp

Download

memory/968-33-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/968-37-0x0000000140000000-0x00000001401BF000-memory.dmp

Download

memory/968-135-0x0000000140000000-0x00000001401BF000-memory.dmp

Download

memory/968-27-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/1156-271-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1156-623-0x0000000140000000-0x00000001401DB000-memory.dmp

Download

memory/1156-265-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1156-274-0x0000000140000000-0x00000001401DB000-memory.dmp

Download

memory/1224-259-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/1224-262-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1224-253-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/1224-617-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1764-214-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/1764-220-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/1764-223-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1764-225-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/1764-227-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1872-465-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1872-184-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1872-178-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1872-187-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1876-79-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1876-81-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1876-73-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1876-199-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1944-8-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/1944-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1944-6-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1944-21-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1944-413-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/2324-150-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/2324-144-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/2324-273-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/2324-152-0x0000000140000000-0x00000001401AA000-memory.dmp

Download

memory/2384-141-0x0000000000400000-0x00000000005AC000-memory.dmp

Download

memory/2384-261-0x0000000000400000-0x00000000005AC000-memory.dmp

Download

memory/2388-39-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2388-47-0x0000000140000000-0x00000001401BE000-memory.dmp

Download

memory/2388-48-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2488-483-0x000000000BDD0000-0x000000000BDD8000-memory.dmp

Download

memory/2488-284-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2488-299-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/2488-624-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2488-337-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/2488-315-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/2488-287-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2796-173-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/2796-175-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2796-426-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2796-167-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/2856-229-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/2856-235-0x0000000000A80000-0x0000000000AE0000-memory.dmp

Download

memory/2856-238-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2856-535-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2940-52-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/2940-51-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2940-58-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/2940-98-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/2940-100-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3204-155-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/3204-415-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/3204-430-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3204-286-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3204-163-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3204-161-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/3464-90-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3464-97-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3464-95-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3464-92-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3464-84-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3548-120-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3548-124-0x0000000140000000-0x00000001401E4000-memory.dmp

Download

memory/3548-114-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3548-237-0x0000000140000000-0x00000001401E4000-memory.dmp

Download

memory/3816-486-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/3816-211-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/3816-209-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3816-203-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3836-197-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3836-485-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/3836-200-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/3836-191-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3844-132-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3844-249-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3844-126-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3844-136-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4204-186-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4204-68-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4204-62-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4204-70-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4460-584-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4460-247-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4460-250-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4540-494-0x0000024AA61D0000-0x0000024AA61E0000-memory.dmp

Download

memory/4540-495-0x0000024AA61D0000-0x0000024AA61E0000-memory.dmp

Download

memory/4540-496-0x0000024AA61D0000-0x0000024AA61E0000-memory.dmp

Download

memory/4540-498-0x0000024AA61D0000-0x0000024AA61E0000-memory.dmp

Download

memory/4540-497-0x0000024AA61D0000-0x0000024AA61E0000-memory.dmp

Download

memory/4540-493-0x0000024AA61D0000-0x0000024AA61E0000-memory.dmp

Download

memory/4540-490-0x0000024AA61D0000-0x0000024AA61E0000-memory.dmp

Download

memory/4540-491-0x0000024AA61D0000-0x0000024AA61E0000-memory.dmp

Download

memory/4540-492-0x0000024AA61D0000-0x0000024AA61E0000-memory.dmp

Download

memory/4540-489-0x0000024AA61D0000-0x0000024AA61E0000-memory.dmp

Download

memory/4540-488-0x0000024AA61D0000-0x0000024AA61E0000-memory.dmp

Download

memory/4540-487-0x0000024AA61D0000-0x0000024AA61E0000-memory.dmp

Download

memory/5016-102-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/5016-103-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5016-109-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5016-222-0x0000000140000000-0x00000001401CE000-memory.dmp

Download