a7e95ec8ccc166287ee7891c802a13ee2fd7ca76ac8c4f335ea0fbaf7961f8fa

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/10/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bootdata.exe
Size 1.2MB
Sample261011-2ncfcass2l
SHA256 a7e95ec8ccc166287ee7891c802a13ee2fd7ca76ac8c4f335ea0fbaf7961f8fa
MD5 858851aa9ff53d4cb1b900e1b6aa43e6
SHA1 8e982f3747c4c4fcad2d07567ba7fec9cd6bd76d
SHA512 9a0542b0849058da6a8ff62b4c7b5a06ef8a3a5b3fc313107a3bc9ac03ab7c5c83b3be5aa2ff6b36a256af0a586f53c757338ab1f8d08243de56ff5c5f615fc5
SSDEEP 12288:O34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilL:FSnnrFb4PM4MYgLxEVyGL5
TLSH
T12A4523B62ADD11EFCF5D19B1C1AA66C8E2056C62F876B11B7B417817373F20D9C91222
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4788	alg.exe
1520	DiagnosticsHub.StandardCollector.Service.exe
4312	fxssvc.exe
5020	elevation_service.exe
3440	elevation_service.exe
1084	maintenanceservice.exe
2372	OSE.EXE
4764	msdtc.exe
764	PerceptionSimulationService.exe
740	perfhost.exe
3960	locator.exe
4556	SensorDataService.exe
1624	snmptrap.exe
484	spectrum.exe
1496	ssh-agent.exe
5052	TieringEngineService.exe
3856	AgentService.exe
1764	vds.exe
1252	vssvc.exe
2748	wbengine.exe
4120	WmiApSrv.exe
3972	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	bootdata.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	bootdata.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	bootdata.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	bootdata.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\26dee954400c3f77.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	bootdata.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	bootdata.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_197593\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_197593\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	bootdata.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bootdata.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d93192ed259dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000069debf2cd259dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ec8092dd259dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ce6ab2dd259dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d67e82cd259dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8c8ea2cd259dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1520	DiagnosticsHub.StandardCollector.Service.exe
1520	DiagnosticsHub.StandardCollector.Service.exe
1520	DiagnosticsHub.StandardCollector.Service.exe
1520	DiagnosticsHub.StandardCollector.Service.exe
1520	DiagnosticsHub.StandardCollector.Service.exe
1520	DiagnosticsHub.StandardCollector.Service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe
5020	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1576	bootdata.exe
Token: SeAuditPrivilege	4312	fxssvc.exe
Token: SeDebugPrivilege	1520	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	5020	elevation_service.exe
Token: SeRestorePrivilege	5052	TieringEngineService.exe
Token: SeManageVolumePrivilege	5052	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3856	AgentService.exe
Token: SeBackupPrivilege	1252	vssvc.exe
Token: SeRestorePrivilege	1252	vssvc.exe
Token: SeAuditPrivilege	1252	vssvc.exe
Token: SeBackupPrivilege	2748	wbengine.exe
Token: SeRestorePrivilege	2748	wbengine.exe
Token: SeSecurityPrivilege	2748	wbengine.exe
Token: 33	3972	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3972	SearchIndexer.exe
Token: SeDebugPrivilege	5020	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 4016	3972	SearchIndexer.exe	108
PID 3972 wrote to memory of 4480	3972	SearchIndexer.exe	109
PID 3972 wrote to memory of 4868	3972	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\bootdata.exe
"C:\Users\Admin\AppData\Local\Temp\bootdata.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4788

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5108

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3440

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1084

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2372

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4764

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:764

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:740

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3960

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4556

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1624

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:484

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:852

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3856

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4120

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4016
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2836 2748 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4480
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2896 2888 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ca6e4095c038436d1c3acbe11983152ef5d10b702ed912a9ce092899b203943f
MD5 fbc568a2aa5986b1203672559772ad92
SHA1 7d53e5229a02283fbe3b4402b6030ec15b5d4bb7
SHA512 08941b62104e64bd6805653d5056e18b9c9dca2f175aaad2cc0fc5e902faecab7f4af6ecc2a348e4ea0b98337c82b07f5e197a6d76de4187e0ffc463ad63d481
SSDEEP 49152:tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn6j4MYPVyGL/:z3q6HjBsVb
TLSH
T19FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 6258028dcffa914dd42bbde702edb2af3a80b510a13a365d26393cf21cbb71e6
MD5 70cdd25aaf3b4f2ecf6fea385e514d9a
SHA1 eac29f637cfd136b447f94b6c35adabbeadeea58
SHA512 44a932f85e0889549361a8b4f47219f3404086afe35af122cf1d27364fe318f2ad1e37de5fdecb43bfbec715af352c6e7c7bbd18414710df4b4541c5c5957633
SSDEEP 12288:T1XLsswWkxy2lRq2czAf34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9R:JXYfDtczAgSnnrFb4PM4MYgLxEVyGLn
TLSH
T17D65F12977E408F9DD6B8278C8A28555E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 1dd3a1071a686db8262df933a17be66bfc4a46154ca2b0e2e51074305f5fdff1
MD5 c10e8ff15c92a5242ba26740a6b427a7
SHA1 b3a71c6839238d692ebaea418dc75697bec2350d
SHA512 f0b037a9c8c1f7ffd760ec439e3cc0b164d3d0d9fd290e59b8d105c1aa34e08916bdf70c38dbb583883816286e4de084ff3922412a0516e9fe156ffebb7c0bc4
SSDEEP 24576:t0Le5ji0hmxirMJSnnrFb4PM4MYgLxEVyGL2:tPji0Achj4MYPVyGL2
TLSH
T185859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a3027c671627c6cae12b77c8b5b0a5265a374c11d082a6d4fd68c3c6fe5df260
MD5 5e1d29a2052a03adb15526e5866f021c
SHA1 687083d1a722303fc27137b9945bf3ea16933caa
SHA512 75701961989e9040193b2b1e25808c1ec9745ea9b87e0dfda06b7ff3cc3cae12e1ec0255e34be27000cb2bbd46002914e4732e28cdc96c114ed0173fd013bac7
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyuTSnnrFb4PM4MYgLxEVyGLd:R/ezSC6vUzPvxHjy1j4MYPVyGLd
TLSH
T1D8755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 04dd441866a3b32f04f25c9886abc88440ac15e797e44d270d785651abff826f
MD5 cbe0fddded5a64d879f8b7cfef996428
SHA1 6b10dd399bd078b408203a2dfcc2988579627679
SHA512 c3c67be32466545dfbf9046df97fe4255ad23e0b772ce041b9f5c6750ce300ef92e94726dc1b1100aba058431b009107c77f118f8933d0acb8b6310dfd097bbb
SSDEEP 24576:dVbqPb88hv/l+6sSnnrFb4PM4MYgLxEVyGLm:dVO88hXl+Gj4MYPVyGLm
TLSH
T169559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 33855286595d715c6fcde06813d4fb31987454c91cc5ec7874d24c9444b8db21
MD5 a6e0b5a732655b078d1891c7a5afb647
SHA1 f5943c83a5b6b90b3f448a3622de378c715f9c58
SHA512 d29fec55ced41043a5cc02945cf5f51e209fe20e285b44500820c8aa4a2e51a99e3949db56b966cecaa4978ddc3ff9b88e6ba79595fd1a5273cadb0283c2efbc
SSDEEP 12288:bRO34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilK:bRFSnnrFb4PM4MYgLxEVyGLY
TLSH
T1DB4523A62FDC10EACFAE15B0D1B96AC8E2057C61F875B20B6751785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b921620bc3e810ff630afa27e1a1d925fb467b7bd2759625fc68891991f7373c
MD5 73dfbae6e8f43deb1289ac4bcfe6367e
SHA1 a784212b0e89184aaf5b6fa09ff3441e2e27375e
SHA512 d98cbe6d2b9b7daaa41b5797ce9ae6b9ddfa613fa7e021f78f3b76da6d779c3e3e694d43979171ff1a8a4603e31577266a98709ad50a3bf76b0ac553ef6048c9
SSDEEP 12288:/eBNUbTVO86Ub34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:/JIUUSnnrFb4PM4MYgLxEVyGL9
TLSH
T14E65D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD165820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a706a19159edc42ae91548ecc3a5c018274b9546501b2d8b278472a4b3885fc5
MD5 fc8bf3edacf50043787bc54ca8317e90
SHA1 66ebbc2c345d7eb78f4c08905e07380ea9cf6704
SHA512 f798f2f1fe314fc6ba493b8ef17d397f7227f1c3e033ee5ea7e16dfed1279dc457daa3faf9d8a55a6158f84049e3c142c1b2e31660a1dbceeb34233811f6d5f4
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THp:GQvGAdlCEL8c/yRNw5CZVW
TLSH
T1BC267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 a67fddcd03f47c3b476a0e38c41dc6f7d6e6a4d7dbe07b01e248d7958177e0c0
MD5 c27cffd140a9171128e18e1792c6ed5b
SHA1 91279fed420489db7b7f8a77dc1f051650d10c0a
SHA512 bfb0823d543ac3f6e3eacc674e78979249c3ad1b1ada5d174030a3a8ce025e1ff9c8f22ff7ed1bd0b04fb8f3f967e75576e11493a106b4ada3f639a8df32232e
SSDEEP 12288:hAwSfxL/2Dc34DLLmt0LDQewsAjx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAn:CdewsAj2SnnrFb4PM4MYgLxEVyGLI
TLSH
T16975E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 98671ced9bf7ca2555e3833d20fb9892715386422dc4c74848ef84cbd5b5b608
MD5 a6323bd81873d2ce488885fbc15c93d6
SHA1 4cb7e9a37639519611fca2bd7b6029275e5daaff
SHA512 4d79622777a1cf0b3c2dde14311980d6bc152e6c16099c0e68cf1856deea973b87631f397ed718d89f374684b4845a2981f1c7072450a9faf5c8bd5c9cca1865
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:EUEtQevvqc2W1cpV2EI32
TLSH
T114474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8429df2746b38b28cf3e3069fa0b1263957dc41e8003ca550b79f159231af75a
MD5 559f7d4ee94755a0bf278fe0144cf97e
SHA1 8c13594220be69376e3e571910a294ee1dcd39bd
SHA512 166f8f6fd886a00d644aa47259c19958f523b5a079670f03154ad86797d3115b29f64c87e574aa75783b2ad809d670453b175d7bc14412c77023383583b82452
SSDEEP 49152:uCbRquA/m2yL5zQfFiV+XenmE3/zxj4MYPVyGLs:DoqtVjnmNVg
TLSH
T10ED58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d0db8d568229b8f96f9ed8790c1474b812adac94bb20dbd979c98ef2e48d5211
MD5 7a329ab53706aac9b08d7458281cbd4d
SHA1 245f8d79f31514f1331228814efe5802d2148545
SHA512 651f7dfdf59acd38fdb71db9b184ebdc7e1f76c5f64ddc5275096c28b3ecf593fd1ea5ec1e8f6acc17ce219436922a2fdb846a59385fdddbfed17ddeb445a919
SSDEEP 24576:tAhGLJIFoiwtA5l7S533SnnrFb4PM4MYgLxEVyGLt:tAMyFoiq5Aj4MYPVyGLt
TLSH
T16B35AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 080170d79acbe4d4eef2cf1f5a94435bd92703eb220024678e616769558fd658
MD5 5604b7341cf2315deef1fff9c9a1ce13
SHA1 3f261da609ba968de7f3fc1984f03f65b8ab8c74
SHA512 f7c368523e464226cdfbea528b8ffda9e133fcec615b0e8cd63e42a757d8f2ffe51f628189c597a6532ec64ee1b55789e18f96797bbdb2bd31aaba4bd31e8af6
SSDEEP 12288:Wmw5HEjsChNVBFgl0WDm+Cg34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqS:PwuoOWaSnnrFb4PM4MYgLxEVyGLE
TLSH
T15465F14637E81CF9EAA74638C5978535F7B2BC122A21D71F1760C65B2F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5b2e1efa89538ab4f821b81dd859a9c47aff0fa9e3c613584fb3064c9612defa
MD5 63c334d3f6893cae684eaaf81b3f20d9
SHA1 fa192d7069e5044d1c614b9371daceb6fc0909db
SHA512 4f5c6b8fcb9c56cc1ed8badff4a9958b2e6c37afea4d9ec0e580ccde354cd94692893cab1f63ff66c9f90c6e198f940d4cb5adb2e5d1f8fa9ef5a77e0ea634d1
SSDEEP 12288:WBZ1Iyh34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il6:gZuxSnnrFb4PM4MYgLxEVyGLI
TLSH
T1BB5512AA37E820FAC6AB4274C4F55688E3327862B77293CF1750655A3F37AC55C35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5f277b695166b91ececb9092886b01e6ac1aae649dca9e563f9a9eb1a04baef7
MD5 024c015b722715e6228f9493fff2f44b
SHA1 763ec267962e4abb49efef095c37c0e898cc367c
SHA512 91685a64fd3b3a3fe0a5043ab80b2fdd5a2356fd2abcce79bf1b88f09c331a47225f26e36dfd0e85394f505ac719b0f6c22bc1919323e6add097623b78ea0646
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:6QRQyi36YOcPQLvw2gAf+PN34V5
TLSH
T1A9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b7299d2298befea413abc6260567def95dfc2dccde2c8f6e84536f3f2c902bf2
MD5 cd84e1cb4f571d136d8481c9a68e2c93
SHA1 1c33f47cebbbc99df2b571f422c3c4e5e9da493f
SHA512 8f971468c14a39c90b193c2ec5eb49edb3633d33aca4f0b48d4ef30f1d76cdf656b5869598c30a398158637d18419d36d78ae9846b3f298b7a934e8987f53e46
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ut:lQRQyi36YOcPQLvw2gAf+PN34VC
TLSH
T1F9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 50b466f5913ea671dfd1fdf4dc5fd71c084293d6ee61dce7b5545389eca00c9c
MD5 4712f2ba613ab9ede9d24de2685419b5
SHA1 95ee67c5e76c360194d86be225b0c88160add810
SHA512 17ad48304d1dd9f01a4339075173e6cee2b0adac33f29142d82c139e74b3cd3386eca061fa5d0e1bafdc51dae78ccc53af3e384f2a8245b6c4c90bb25e670dda
SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0BSnnrFb4PM4MYgq:268Qg55nhheWu7PNU3/hj4MYPVyGLJ
TLSH
T12AB54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fb7794fd76d5c1e38010de003cfcad781416fa2127e4e46143f833a0a389f62b
MD5 ea83060ae056502d4027eca0c5f2c37e
SHA1 02a67f3d290785c4273f6b6524af8fe731f70488
SHA512 44d8dd04cca643e49dc032b1b0c04f68d6b11bcebebb929cb299ecc832ea940acbcea8eaf33e1278c7e4881c3a8430e6d73d12dedcac6e9fa71e2e5cc0083dbb
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99r:Vy5112gYy5azzVvL69nLKnhZfVy
TLSH
T1C3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a204b617f0b7dce25286862ac7b700c59c3f3edaa826d1fdfdb2fa909d02e5be
MD5 c50b63695228c78623d23f59e0fd2904
SHA1 7aad4fe8184a881498b830627be7699d030052f6
SHA512 79df6cb9be9c8003dc4de957da1d7bdd051216437140e3451961f2133170bef7e566b3875a7cafd5ae71ffa0614f0d33ca53f8f54fbe86d77e62da45c5373b06
SSDEEP 49152:IB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glAj4MYPVyGLq:Cu6JmVxd2ddVW
TLSH
T19CD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 38eea005807405d1696e350fa88590829008121e124d1a78f4ca042548cbb19f
MD5 7ce03b908d1687c4a1d7b35834772ebf
SHA1 28c245e41034134f9fdf798b2e04367fb8ccfa19
SHA512 43e23d52c0504154ba3f6604f6fda0d2c1927abb30d1455dbf6ca708fa07c65a4a4e8bfc0351648ae1edc4064a61cb9801048adfe98379e2da6e93d56211c15a
SSDEEP 49152:A1hpsNoJpF1A6UU44CwH7R4xnj4MYPVyGLl:AmifPbRNVJ
TLSH
T12DB5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2ef2f412bcc857c49101c2e4e657313bf7695e0793b3611a9a2c5cbde93b6e58
MD5 57599df01467c0ff5f10a08371edd03e
SHA1 143fad8bb83cb56ad177d6316aa9d87dc8f542a8
SHA512 fd81802de04a7933b810df05c83bf941cc5427f5e71786a96dec725a939fb3f0dbc69b5231aaa164ad20d89bfc0d678caa38cccf96ac06bc61094c1cdeb1b710
SSDEEP 49152:qSuZQIY0Be2KRRVtOnks6NMHqqj4MYPVyGLL:05dKTi61LVP
TLSH
T169C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 10ba47ea3a799eb14f336e662533388a897e9f87d60f0d73a23e2a3d34f27e24
MD5 5730bc843edd554d13e359a37b12a73c
SHA1 870ff6e493551333a667967fabd8df9bf84af6da
SHA512 e20cb9e63dd876cc6a9d89e880b7ca9c235ea9f4659d6c19ca3c534a050478c0a0f9d81a420839fa599161d04cd98b61ae96f3bf777d821e37275af1a35f5745
SSDEEP 49152:phtSn8EApI0figngiDn0AP5wzj4MYPVyGLW:YX2iyphBVa
TLSH
T1AE95BE13F2D900E8D05ED174C7568632EA62BC160B39B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 71239339e05ed7beb4a39c5cfea32e1d1ce11f67384ccf74d10c52ae09661e54
MD5 aba2cdd6088ce00c811b2963b4f56c98
SHA1 a098ce45c28d11034878bc83148628725ee8d3c5
SHA512 a094f3024eb8e67cc85689f2d82ecdc539b409dbe9dc7cfc386eec0ea36630c8efc982d669aaa112ca222b14431a4d7efd8cdc0f1190e1148f15803540aed909
SSDEEP 12288:T234XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il2:TtSnnrFb4PM4MYgLxEVyGLE
TLSH
T1954523A62EDD10EFCF5D16F0C1A566C8E2097C62F976B20F7B4574073B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 350b571c85b372c30a723e94f7bebb20d768c93c9f77af650452e36a5bcc09c8
MD5 24921627f467d458b50abc89073a8523
SHA1 6dbf3c6d1f44383ff851e4bb5d95cb1e7928aa0a
SHA512 882b30098e10f04afac170aba3e8d92b2082628c8dda9b885842b81fedabde2bfd806cf86d748ce6fedc48bf977223a9c30a527f7c785a2befd8d7c0a928d274
SSDEEP 12288:DV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:DSSnnrFb4PM4MYgLxEVyGLd
TLSH
T1184523A62EDC10EECF5D16F0C1A566C8E2097C22F976B20F7B4574073B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 58e74d1376691c5d15a127470a685474be2943810bbf6305b5f69a0bb751cd62
MD5 fabaa0cca7cba7e81fbe589bf7773afa
SHA1 70f69e63723b79df822a466ec2bbf0d4a6f61a5d
SHA512 2a57799c90ce0b7366fdbceb6f2d69a1f27a264b0fb665c4862aa468a129793d42b06f9ef23c538de7ce108891a0f4230f9c43ec4f9b227e189f79ba6afdf179
SSDEEP 12288:kj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:k8SnnrFb4PM4MYgLxEVyGLd
TLSH
T14B4523A62EDD10EECF5D06F0C1A566C8E2097C63F976B20F7B8574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a9966ed895b8ec9503821d087919266573076583fbd921988f04b097d36bf44c
MD5 e31d3885ad64fc9ed2e8acaceb9e33fe
SHA1 59fa2cc1c3599607573c859c06b39f40099524fe
SHA512 93f9a5ad146a4ca362cf2c26a6d33818d1dbb85a98743159e9cdc3ef116b382569cd8f8a4a2ef93abb2007bcd537ea3482dac63c970ddbd546d5a1538b356438
SSDEEP 12288:mVM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:+SnnrFb4PM4MYgLxEVyGLk
TLSH
T1D04523662BDD10EACE6A96B0C1B556C8E225BC61FA72B35F6740381B3F37348AC71711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1219005bd5816f12e99904587bc3fcae449d1c69c31a1989edc9cebc1ee0ef29
MD5 6bf492a3733640fb3ded2a7a195c7f4c
SHA1 11be8654b37492a8d35277d39694341010e01da8
SHA512 d948c6fdee365fc63b5a2a826a1de2dc05a056abe50bd87493050cc49e72d5810616870e43dd4a60525e2c5b65a2e5838a4e01d3ac81176a2c928a399ab6bf8e
SSDEEP 12288:lk34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:lvSnnrFb4PM4MYgLxEVyGL8
TLSH
T1D94523A62EDD10EECF5D16F0C1A656C8E2097C63F976B20F7B4574073B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 91c93240b2badd5687a395b5e8962adad09045bc75646212b96ccd05d26aef5a
MD5 1593d9b1650ca59307fcff9366f05e8d
SHA1 2fabb8ff9ae7f093d61376d7fb1ee3fa188ec380
SHA512 36ec13ead5ea95249f8ed484b2455dc40029e3bc10304ce69ad21518ff27a694a06b90bb11f63ec857e1f3fe0610886ca52502b7132353b91874bb2283f3b787
SSDEEP 12288:n534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:n+SnnrFb4PM4MYgLxEVyGL8
TLSH
T14F4523A62EDC10EECF6D16F0C1A566C8E2097C62F976B20F7B4574073B3B60D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a301ae524016ae0a64d9fed26096aadf43ee83f1d58f977049062d083dd7aa79
MD5 e5e4b7011afe1a1fb84f5d539766a7fa
SHA1 4970fb5e8c0fd5b7088376e581967949a871d465
SHA512 38ae237a1d1f8b637d2c8a4cf72bb3ab1fa4d700bc7908b8a5d56b5ec24dfcd76ca4c8ca756842a94529df1f6fc801321062625a50f20bbcbdabd61c34cb6fe1
SSDEEP 12288:Ft34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ily:FqSnnrFb4PM4MYgLxEVyGLc
TLSH
T1354523A62EDD10EFCF5D06F0C1A566C8E2097C62F9B6B20F7B4574073B3B60D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b54334a17918a0c88222af96e3c7fc5ba8e0f93f3faaeb8f1787fa6b93a0d2aa
MD5 acddc1fea127b00d77e33236e59472d7
SHA1 e1d5f34f6d77e2d43ace9708dd059dd4c2888063
SHA512 ab0aadc0a40c69873a8d9cd7553ace5a7e94214de67fcc6e43345ea7305a3cb23d4854887efd5e98d704810518e9ff7d2cd6b38cc91274daf79888c1d11d1c68
SSDEEP 12288:XiZwb6zzFEoS2cPvy134XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2y:SZMSzFVSOySnnrFb4PM4MYgLxEVyGLz
TLSH
T1106502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 eb3684bfce789b75c8d723d4c06cd2fe40e709a4dfdbca0073d28f2038bd7ee6
MD5 c0041e7e8a11501e2e4359de44dfa192
SHA1 75af6c7fd20e0d7d60918ff6989994220f47e154
SHA512 3264ce8bc6fd1452eac1f41d05c172601fa219e0e48686292db5b3b1803c6fc647ae53e798340feff071e93c6179d45d2fc6cf02a75d48507705de2056ca2c2d
SSDEEP 12288:GS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilD:GhSnnrFb4PM4MYgLxEVyGLZ
TLSH
T1214523A62EDD10EECF5D06F0C1A566C8E2097C63F9B6B20F7B4574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cc56fd895f2d131e6c7a7d67f6111f48daa948d52b1bc6a2741c179877001449
MD5 02ed192b3305c85be7c90e695ab62a75
SHA1 0390262da2a0e82ce31b1081581a79a700573b5f
SHA512 d80ce2c18ae2298320e30e23abcf022cc652a7ada3f00006118005a9cbc636db95117e156a3bf9be73097f4915fbcb7a20ea61f8354308451c4a016f7d9857a6
SSDEEP 12288:K+34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilH:K1SnnrFb4PM4MYgLxEVyGLV
TLSH
T12C4523A62EDC10EECF5D16F0C1A566C8E2097C63F976B20F7B4574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 1fbbd476505770816b3f6b26d1b2d24b0ff4cd282dcb7735a6a0640dde1770bf
MD5 92cbf9cec1c204fce5e3f5767b2a76df
SHA1 529da4849db15dd641996be5eff785dd344a02f3
SHA512 dff06e537f43c2f802a2e6f5b1c4e7f0e7b3c0fe1ffe6cd697d7412a602882c3d069c61b6fbb5d52314901a3cfe685823d87eda2e05a0f02571d522954455745
SSDEEP 12288:MyPz5L8h34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:VzymSnnrFb4PM4MYgLxEVyGLd
TLSH
T19E55025737A530FDC67A8274C4A21A45F336B8329B309A5F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9d4b2d796fa6029351b21de42121eadc96011333832294d0d89666e595a58aa4
MD5 205396af5837b850991e8d441943c5e4
SHA1 3a1e4377c30cf5ec220296e17f1039a48c559fc7
SHA512 ae2561f6d9e16341aa51962a10a3dc7bf643f19a4218104eafef3a5b4a4a958835995b96a08b72ae945cf42fc54fa30cbf024ab1496bb7c4737a2dae171d3953
SSDEEP 12288:lS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il9:lhSnnrFb4PM4MYgLxEVyGLz
TLSH
T19E4523A63EDC10EECF5D16F0C1A566C8E2097C63F9B6B20F7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 20403cad235129eede8e0932717a044ed44427b8d315beb975372377109bc769
MD5 d4306aea6aab77f4b4a72108ae9a2107
SHA1 e0479440b8b8741a0878286a324bd40b5f36f7fc
SHA512 2573788dd39e4024c1238092b5ef77ced2b7d9269c11bad3a2e9460f8761a7c87a69a2f8f98e042c14bc7f5e0b0f175dd9223112ef0e42dcca0b1466649a952d
SSDEEP 12288:JS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:JhSnnrFb4PM4MYgLxEVyGLA
TLSH
T1A34523A63EDD10EECF5D06F0C1A566C8E2097C63F9B6B20F7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 34735c7966314991f030aeb93721b5cfbfe49b36120c9711db3d0749138cb641
MD5 4b3d256275e38270f09b758d6b2cb00f
SHA1 4718947531b187454287df9e9e4e9605d1d03f95
SHA512 5521c77a06dd71f28e9c2c19dd459e26fad9109d65aaf6f5f55908e49b37c24af40d1b7074435bbeaeb4741e82d6a215e0dc6491a55c6cd2087b08a65f4bcf84
SSDEEP 12288:5yPz5L8h34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilB:4zymSnnrFb4PM4MYgLxEVyGLH
TLSH
T18855025737A530FDC67A8274C4A21A45F336B8329B309A9F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 547563639f06ce8e46ca299fb18553dba1a4d1ee2a03f08fb736933cbf7bb65c
MD5 f02317ac200a940052c8e14a1baea921
SHA1 aefa32793bc307b51e52ce8d7f4dd8037694de9c
SHA512 7199e7dd98efb3a4de92ef4a515aadf4ff10ed2e4abb588c4cf1cde2d32a2e9154fbe03887693fdc69e3d07793e8695ce53d1cb5ff61092457dfe108b0607dbd
SSDEEP 24576:vTHaLl3z0zDMSnnrFb4PM4MYgLxEVyGLu:vT6Lljcj4MYPVyGLu
TLSH
T1296502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 73ff766aa50ccb779a6f56ff0a49b10bae93cd130131eb3a018d7ac6012f49e5
MD5 48e3a1d2af9e5c1b523af8343d2a642f
SHA1 1c57991ac16a8fb26c86fc516b5f30319d2d60c5
SHA512 09fec9e773d42a1475091ae09d05322d9d9f90cde5af211d96740cb10bbb52cc6de0c622c44938334a810a60ac63c3bddc34ea8059fc4106a7892dc1a3091a6c
SSDEEP 24576:m37d9CHKy7GZoSnnrFb4PM4MYgLxEVyGLg:I7d9CHKyaJj4MYPVyGLg
TLSH
T19775DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a32b3634727b6a607c641c3ea5b75ef2d2655437550f9f93647560b37b411d82
MD5 85ed2867455e4b40ae4340f806c8eb5a
SHA1 2e4e1c80697776b149ba7c71cbe0fac9353ca90a
SHA512 a14ad5e37b2197782fd32bf0b6e96ba85badd0cad931a18d02f35d7c02380b9890933ed8a69bdc45819caf4bfffdd078f94c0f6da4cb470e8e0dc83b7c9b602c
SSDEEP 12288:QD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:QcSnnrFb4PM4MYgLxEVyGLf
TLSH
T15A4523A62EDD10EECF5D06F0C1A566C8E2097C63F976B20F7B8574073B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 b78442e2663067728ebd8527c98df1ee3ee01c120d897944bdec099c3be54621
MD5 6c6fc18614fd27b4d7c55447ea729a9f
SHA1 787759276d6f870ba75d74f5a7f366a326fe3123
SHA512 7fae6f4578377f5118faa86cc3e0e9921190e2a07bc9a9b97eb8be8454db053705b0f5df239b05bb71adea24d6882b56051a9317b7851727a3419f750df7c656
SSDEEP 12288:rNsfi34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:oxSnnrFb4PM4MYgLxEVyGLd
TLSH
T10155F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b820d5725ac570f204cdae2cff1b4a2e207e177f6b901ebef6da7a6dded532fa
MD5 dab53ff5643b10057420671db5ea0d8d
SHA1 0e804fb5f0cf9c75c05879266c517916ba31c5c6
SHA512 50022005e91010d3f62c7a363158ba74596c7e1dacb85a4842ee579771cb9fdbb718d4c92825c5eec768ea11c48e4356bf22e5c2373ff5f4b9479fa296d08a3d
SSDEEP 12288:eT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:esSnnrFb4PM4MYgLxEVyGL5
TLSH
T1EC4523626BDC14DACEBD16B080B95698E20D7861FF71F18BB740744A363A6C99CB1713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 19bc7f1e5a1f3e6814d6b5fbc2db1d5634101594754646da20de9f1e6e06fb7a
MD5 f3ab8e8c94e2e84ff50dc3a74583c117
SHA1 d9af8ba79b6fd0bab3fbe5cc9d0a07635ef17b5c
SHA512 780e854e6ecd63a51159909be7d77a944cdcbb84de91a287583c8758602a15ba3afb71a2b52895e1d50461065b0d03b8e888e10f0f643428ee15fe0273b24e43
SSDEEP 24576:y8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCCSnnrFb4PM4MYgLxEVyGLf:zRZwQCyiHiQEaaPnMSj4MYPVyGLf
TLSH
T1C285B01E63DC46A5E0BAD278CD674407E6B278165731A3CF1290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 b519353b6e75edb967fcbeb8180bd7f1e376b1eae57d11793f3b7ef9bc9a53d7
MD5 b234fd6dc6c1b680479ea33f313c5b56
SHA1 15bcc29ccb09ae969c86dc40661373d1f6f8e4c4
SHA512 9369c03d357589c7c63714d34dc65099299b27ff57047a4958a3d496a1ff9771ced77b1b65f9b4901d616f3cdf3723d3a4391e6b8652278424b25c792a77aed5
SSDEEP 12288:BbxA1U7Kg34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:BbxA1UGzSnnrFb4PM4MYgLxEVyGLp
TLSH
T17E55127E26EC14E5E67A9178C5D68245D331BC22A731A3DF21C0913E2F3BAD89C35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 af1345342ab2f895a3c1c77d1d30837c21a6b7c32930b84c9c4cbc56b46904b5
MD5 642ca911c9674ad073453dbd29886ca6
SHA1 e56e7c9b4156fac1f8cbddb6269a2fbb33299ffb
SHA512 3f3883cbae42d23f642b501e9fcdaf512f13815d07bb9f42f7beaea1c663aa321fcb7eeea0e742626af6fab8a2889365cff062d132fa64c5f6e9676696771582
SSDEEP 24576:kjsmP0yHaqrVqHra44KDzMsrnQSnnrFb4PM4MYgLxEVyGL2:kjRP0yHfVqzlAsrnjj4MYPVyGL2
TLSH
T15A45BF2EF2B910F9D8AAD172454107B5FB71742D1F209ACB0170C635AF0AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 ab074e399c1c3290d8f81e6b3a66f61b19c7fc9d9332292bb89d215bfaaaeb76
MD5 6be5ed7804988e8d12fae0317e2783d7
SHA1 a8e03d89fc9c96f80ea4b0b432113655e430d006
SHA512 a81f812288f32696b5280ad24eb0bd75d0367b58a77100d9b1ec8de875776c7e871c8ae018d9c6671c9fae7fd47584465a2ffacbe6d6ab07e7f3a187e780d08b
SSDEEP 12288:Kt34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilN:KqSnnrFb4PM4MYgLxEVyGLr
TLSH
T1644523A62ADC10EECF6D56B0C1A956C8E2057C21FB76728B764074173B3B68E9CB1712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 aa0365e0d5ee88013a9dec0fa1f2e9f02506d16f9d5e2242ba17228f3ef0224d
MD5 bd587c231d0d1f6d579ad59e3e01d209
SHA1 2dc0a5ee2798a2bb3d73b26796dac1d4d4ae47db
SHA512 45c6105f88fd8e3e01c2bc85d7c9e0f7905c61d022d7ff8a8b6280d3cb6c7930d67c1fe4a15dabd2aef9ebf52e5c3b0e35dd46b7ce05d0f8a2b27eefd480f857
SSDEEP 12288:oOb9A4LWO+vAYFTf34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:FpLBUTgSnnrFb4PM4MYgLxEVyGLx
TLSH
T12C750155F7E800F9DD7B8138C5A28A16E272B85D1764E3DF03A84A662F233E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 6317a73c5ce7795218d0d44465be145b7ed32c25f57e335087019b8270de047b
MD5 fba5b90874243ea6ba459161caa5520a
SHA1 5e677d8e037d5c5921d03192d95cefd5efe625b0
SHA512 09763b7c674b8b3b2d4ed68b55b83b21be8885bbbf1389c8bda46a6337a6cc6e76a0096063ed31b879ba001c8df95a1c6a80e1a306db02cbb9b115fe693c947b
SSDEEP 12288:070VmvIYNvUyBpm34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:BrYNHfSnnrFb4PM4MYgLxEVyGLA
TLSH
T16065F12F66AC18E5D57B9179CAC38249F27378625711A2CF05A0827E1F27EDCBC3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9831fc4f2a2049dcce9d32452c3def3b9df0e3bc755d192862dfdece30167fc5
MD5 766f7921b7f364ca7e2ed58c1595c071
SHA1 79bfe58f7e645215895043912add418f390c56be
SHA512 b90b9cef210cdb08e62ed8df074cc90f5d498ef3d5762d3f00f681e25f9b4a68005b23a69a66c017cc439f0deb84e8e7bfbca51db413d0d375c3445a8d3cde60
SSDEEP 24576:enXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKO:enXoJJYH84VVS6AmEcJas+cHBjSSKHPe
TLSH
T1FC65BFAEA2BC04E8D5BBD17DC5C34506F5B178621331D6CF026182BA3F27AE59E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 841171dd34c51277825b527c3b1c5a3ffc0f16c5988c976749639f3037bf6654
MD5 22e8d481d4c3a84d6ac6b94feb5589bf
SHA1 7543b4bc252a315059c46c018c8a0487edd900f4
SHA512 4212cef1bcd94dc9841f64eab44df15a7620897361e75bc7a1b5d72667c4d1d5c520628fc2bb8db8f4c1180ede0529b14bcfbee4a312b3bedbabdb116b4faea0
SSDEEP 24576:Bv7Xbxd9Tuycf8M/TYlSuxwr2PClSnnrFb4PM4MYgLxEVyGLs:BDLL9TuJ0M/TYW2PFj4MYPVyGLs
TLSH
T12D858D5EA2EC42D8E47BD6BD85B79146FAB2B855273081CF0250856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 94c6a6cfadd35af6058089b30adb99c0a16d53d8041353aa177b7ec1754e2fec
MD5 33186c1c0102297e3d1a583c5615f645
SHA1 a818199df354f4a592cb973571949275d492919f
SHA512 3f25ed416202ad7cb80cdd6eda21fc6a588ae5217a90d2271d717b1f3d1bd33eee020484f2c79aaf46b39f1d100575886c40b677be1ebb35a21bcf02e52e45c9
SSDEEP 24576:qegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wgSnnrFb4PM4MYgLxEVyGLG:qngOJOmPOHhzj4MYPVyGLG
TLSH
T13B55CF3FA7BC15D5D03EC17D8A968906F6B1782213356ACF0560827E1F1BEE46E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 e9953730a195e4e6ba46a61426f9a7596d8bad6bb4ffb61a2d142cb9b817e761
MD5 f96f3f5aa2d2ce195cb73883e903b3be
SHA1 92c485f71f02d34c4367ac6c9975a2c164f0546c
SHA512 314da7f8cf0050de553b49a99f9f39372fc516c8e588eeaac6550cedffc7d0b676c3299c2711c7ed7270329803aa2d96314628fb6f85735459fc0f864b5bf498
SSDEEP 24576:BLJnJiTk3R3waE4JrOKSnnrFb4PM4MYgLxEVyGLL:BLJnJK8R304lkj4MYPVyGLL
TLSH
T1D575D03DD2A810E8D4B7C2B4815A1B96FF31346D2B2169CB69B4D4353F12FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2b0f55329629c9489ce0525b50c38a359fc1e4e60d3ca98ea765942014502888
MD5 61cb7d81287ecb061c8223c0ea84538d
SHA1 2db9f0b47c96bcd5454f94bb475f9056a39d7b91
SHA512 342597286b798fae118f9f010bc1bf51dde6b599c9424b7d64743125faa3ad305b4dd8a399799bc9fcb16312fe5a1943238e7c66aa44dafc9b6c2a690cd4f365
SSDEEP 49152:r9GqCzDScAZmlvTcFg8Ph6Rj4MYPVyGL1:vlVh
TLSH
T180955C15F7EB5298E8B3CAF1C96694159B327C409B34F7EF0A80C96A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 b36320ba1ed911abbf8b022f73efe3e505f76b8dfcce1eedf6526fcc15040311
MD5 f202cf0eaa2db133c11f60264b7465a5
SHA1 dc22011ba9760806e2c4dab7c90b5f3fcb21deca
SHA512 5ba7e540a4f220c00d222c21cc4cd1d8e09c7e9e4dac737d1cc6e77bcc264deacbafd4f13245985f1d9d84e42dc839bf50a0682d0046a9c63824851359218702
SSDEEP 24576:hlYJeXm5jUuEnSnnrFb4PM4MYgLxEVyGL2:hlYJeXmRUuEgj4MYPVyGL2
TLSH
T1C555126D3ADC30E9D66E9174C1A24A84E331F472A71273EF52D0D07A1F27AC96D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 d4c64316d89bae8f07e3eaf83cc78f47121c4fec0a9f165371d33f0009f79d8a
MD5 030fb95f894fba8deea5f4c60375df51
SHA1 05df19ef06a6c421bf9cb3e8c7cfdf0d5830b88a
SHA512 ca9691b141b7313cb4da00f181d941914007aab062e232460070ffdbee32e0e169fb811f9bf2aa9d44fa049cfb9598b8294951bf01811e60beb1c7a44e87d606
SSDEEP 12288:Kwu6kyY34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilG:KVtyrSnnrFb4PM4MYgLxEVyGLk
TLSH
T11B55125527D820E9DAB90670C5A242D4DA25BC21AF21A3DF6690F53F3F377C8AC71B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 6678687a8e08ba27a475e6493e017857805adc883a7dcbfc34c5ffbba77af4fd
MD5 432cc8ba6cf9676fc1c8557028b32066
SHA1 08e8e44f6c8e4df883c3494bde4c1a434f8593e8
SHA512 ed247e31a96209705713c5c2ef16da895c2f41a3355866511698964dd8441a925509d6a8e2be075585aaa65493fda9792041533a3f817058527b8bdb37bfe328
SSDEEP 12288:CPf34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilP:OgSnnrFb4PM4MYgLxEVyGL1
TLSH
T10C4523AA2BDC20EECF6955B0C17656C8E2157831FB71715F76C0B4363B3B28998B1B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 59cb05966be7e6d52729155fe1efbd4039124d42b66687c54a8924778ad6078e
MD5 131fa0a3c223dc6b47089c3294e2ec1b
SHA1 8a72648c371e690a76fe3052d263ba04c469e247
SHA512 03a84938e824fcbe0cd15cca7ac7ee649f922d6f2fe892826b92cfaf35036030f1382ec7408ebaaf7a307fbfcb63aff1f68c2c0b85af09c8fe0ecbabdc012753
SSDEEP 24576:NC+TyQIu93VAumZr7jmBSnnrFb4PM4MYgLxEVyGLk:N/TfIq+Y6j4MYPVyGLk
TLSH
T1AB558D1DA7E91DCAE276C675C8A34493E633B872137196CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 1ac5c71bea4367c10a63ea6a718a15400e590fd51fd8897258e5a180a44bc2cb
MD5 298910fddda9ec3b4222031a06864b5d
SHA1 4c217995d61a641b7352a4a0da0df495e1f5bbe3
SHA512 975656050b26c5989b1b475d9f22d836846756a431dbf7539335bb884a829ffb42b8bcbc3da28bc3ac33732e2d918be7688026ccb2de2e72f05855377ffec798
SSDEEP 12288:3cyrWOstaa3kcs734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilY:OLQikZ0SnnrFb4PM4MYgLxEVyGL6
TLSH
T16765F10FB7AE00E6D5AB8278C8954245F6737431972263DF0290C77A1F6B6E9BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9c7911f3cb2e3124d363d99c79aac6fec12ccd0192f7a6dff3e9766129040ffe
MD5 2a1fc15c45ddf307ae9e8c9ab9971258
SHA1 abc42e646ba86f65108ef53944a3cd945e1c3a6d
SHA512 68d25de15b1d91f0717117e8a9d9e9d0c1faf4ad99c03a8232ab8f2263f3f37dd9976f7d47a5158fa9af7a89769dc30720b0c967172a9ec7b8227f7c9de9e252
SSDEEP 49152:ppJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP0j4MYPVyGT:6pC7b4+80GTkSVr
TLSH
T17FA57C3DE2F810ADD9AA8375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fd64d877b08a2a52dcfcd96abd4cb20b4e6a7d504d1e69aaf7aa67cce1381e81
MD5 edf742fcafa692bfebfeb291a886260c
SHA1 61066a447132b7f559ab105e58f52b23397fd27c
SHA512 9ce61185c81a95eae8a133fc07cc1f02343094e444bf8b45e3113d83fc314f1793d6fe9f92dd2d96f5d34ce5532ad331ab855986ec69267b209e296c99dfabda
SSDEEP 24576:7SAwJPE1IDAo+4Kt+l44135UQoSnnrFb4PM4MYgLxEVyGL8:7qPCIo4Kol4/Q7j4MYPVyGL8
TLSH
T17A55B02AA7F946E5E17AC7B4C663C601FB727822133163CF5290813E1F16AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-280-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/484-415-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/484-286-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/484-288-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/740-266-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/740-323-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/740-264-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/740-257-0x00000000009A0000-0x0000000000A07000-memory.dmp

Download

memory/764-251-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/764-245-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/764-319-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/764-255-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1084-60-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/1084-81-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1084-79-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/1084-66-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/1252-420-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1252-320-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1496-292-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/1496-300-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1496-416-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1496-298-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/1520-16-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1520-25-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1520-22-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1576-0-0x0000000000400000-0x00000000005D7000-memory.dmp

Download

memory/1576-8-0x0000000000830000-0x0000000000897000-memory.dmp

Download

memory/1576-45-0x0000000000400000-0x00000000005D7000-memory.dmp

Download

memory/1576-1-0x0000000000830000-0x0000000000897000-memory.dmp

Download

memory/1624-412-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1624-277-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1764-419-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1764-312-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2372-77-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2372-71-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2372-90-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2748-325-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2748-474-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3440-55-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3440-58-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3440-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3440-234-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3856-309-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3856-307-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3960-270-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3960-328-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3972-339-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3972-556-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3972-410-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3972-394-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3972-332-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3972-340-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3972-378-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4120-329-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4120-491-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4312-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4312-32-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4480-439-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-451-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-459-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-455-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-457-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-458-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-456-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-453-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-454-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-428-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-422-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-421-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-423-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-424-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-425-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-426-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-427-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-430-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-434-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-433-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-436-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-438-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-442-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-450-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-452-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-429-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-449-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-448-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-447-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-446-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-445-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-444-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-443-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-441-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-440-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-431-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-437-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-435-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4480-432-0x000001DF71270000-0x000001DF71280000-memory.dmp

Download

memory/4556-338-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4556-273-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4556-418-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4764-306-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4764-253-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4788-232-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4788-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5020-31-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5020-233-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5020-36-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5020-42-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5052-303-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5052-417-0x0000000140000000-0x0000000140222000-memory.dmp

Download