Analysis
- max time kernel
151s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2024, 09:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe
Resource
win7-20240221-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe
- Size 6.0MB
- Sample240616-lfnweayard
- SHA256 3c34a8beaef3f8410fa26e6ac460ca13155fc6095b10277024fd7ff8c39f8415
- MD5 4e4693c60003209053327a6f692a77d4
- SHA1 342d78fb28169dd70a987ff95e1716fbbbb2cc68
- SHA512 baeee6104846efc490e5062a5df171fe1e6ef8e84ab23abd5eb898fe6e091aed81ec1e8e7c863f68012f5398b69bb05a41eb727f421e526ae4bce6df4ef6f2ad
- SSDEEP 98304:S3stJARnrlGCG8z1Anqn4UJw//4ENvIPpHdVorLu4TK/O4YPk6ZD5r:BjQnRT1MEzJ4vItor64Sa8k1r
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe - Executes dropped EXE 22 IoCs
pid Process 2576 alg.exe 4908 DiagnosticsHub.StandardCollector.Service.exe 3124 fxssvc.exe 1392 elevation_service.exe 684 elevation_service.exe 4912 maintenanceservice.exe 4272 msdtc.exe 3992 OSE.EXE 1068 PerceptionSimulationService.exe 3436 perfhost.exe 2160 locator.exe 4696 SensorDataService.exe 3508 snmptrap.exe 3552 spectrum.exe 3320 ssh-agent.exe 2336 TieringEngineService.exe 4188 AgentService.exe 4392 vds.exe 1520 vssvc.exe 3812 wbengine.exe 4516 WmiApSrv.exe 508 SearchIndexer.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe - Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\TieringEngineService.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\AgentService.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\System32\vds.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\spectrum.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\85324b28b3e2edcd.bin alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\java.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe alg.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083ae5abdcfbfda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ab4efc1cfbfda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f85e60cccfbfda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9a563cbcfbfda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000553fbecbcfbfda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004761d3becfbfda01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000609a7acccfbfda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000abd2eecacfbfda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fcd78ec0cfbfda01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CTLs 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CTLs 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\SystemCertificates\TestSignRoot 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\SystemCertificates\TrustedDevices 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CRLs 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\CTLs 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\SystemCertificates\FlightRoot 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\CRLs 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\CRLs 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CRLs 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\CTLs 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe - Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Token: SeAuditPrivilege 3124 fxssvc.exe Token: SeRestorePrivilege 2336 TieringEngineService.exe Token: SeManageVolumePrivilege 2336 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4188 AgentService.exe Token: SeBackupPrivilege 1520 vssvc.exe Token: SeRestorePrivilege 1520 vssvc.exe Token: SeAuditPrivilege 1520 vssvc.exe Token: SeBackupPrivilege 3812 wbengine.exe Token: SeRestorePrivilege 3812 wbengine.exe Token: SeSecurityPrivilege 3812 wbengine.exe Token: 33 508 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 508 SearchIndexer.exe Token: SeDebugPrivilege 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Token: SeDebugPrivilege 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Token: SeDebugPrivilege 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Token: SeDebugPrivilege 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Token: SeDebugPrivilege 3488 2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe Token: SeDebugPrivilege 2576 alg.exe Token: SeDebugPrivilege 2576 alg.exe Token: SeDebugPrivilege 2576 alg.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 508 wrote to memory of 2080 508 SearchIndexer.exe 116 PID 508 wrote to memory of 2080 508 SearchIndexer.exe 116 PID 508 wrote to memory of 5012 508 SearchIndexer.exe 117 PID 508 wrote to memory of 5012 508 SearchIndexer.exe 117 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-16_4e4693c60003209053327a6f692a77d4_avoslocker_magniber_revil.exe"1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:4908
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:5104
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1392
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
PID:684
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4912
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4272
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3992
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1068
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:3436
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2160
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4696
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3508
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3552
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3320
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3124
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4188
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4392
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3812
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4516
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2080
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:2396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
- Size 2.2MB
- SHA256 a635c03ea7a00ee19c4fd8c71220674bf9ec69a39df8ba00b5a1b03a3db68ff5
- MD5 3663c5490fbdbaafc9eec85ce59d32bf
- SHA1 f1d7aa2f28ce8897fe7098f0bb8dea0afd3c9260
- SHA512 3e911783c8c7ea78b4eda1f135659ea87aeba419f728ffa6d4960ef91cc9a9b9d59ed35fc878f21127a3be90c4c8ddc726e242fb6a3ea60f5914fd9ddea827db
- SSDEEP 49152:c7T3mwzv/iYlzGQMebksutsKSRGWD5/26u6uwvr5rE:c7Dr/hKuzRPk6ZD5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.7MB
- SHA256 a5fcefae202d6f93d4cf2f70ae44ae6f88ff8fb05d90ef5a02c6c215702c19a7
- MD5 893143a1d97d1ff4307dbaa77a14344b
- SHA1 a8619924a0d4bf413480c846d3e394ea5370e012
- SHA512 e0bbac98bedadec194f093d3d16c87bfd132c5cd3cdeb6f8a108c1bff226986dc0c0929ab01583750321d958fa00346ee6b363cbcce4662a6a04efe23f1d9cf7
- SSDEEP 24576:JPsJcuirGEOqD5PGs2mru6HOOFlM2rFvrAt:JwcukGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 08a1e325e5d7dce7f008fc3abac7ca1b065cf619d93ae93a26ee4c7a8a35183f
- MD5 6d8dccd4007edc90457093b533763fb5
- SHA1 76fb5f17c2f99f93ddeca27ddac8c205fefb25af
- SHA512 89a4d1fff9d158abc802d3bd3ee5c12c361e9ef20fbc3bb58432252ec534ff9f4b805ad03f51d5f54a6566938ad745922c8fd158ca5391af4fb3d61cb33f6229
- SSDEEP 24576:c+gkEzfh4CoHGEOqD5PGs2mru6HOOFlM2rFvrAt:ZgkEjSVGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 3f003447f4c6470c5a629a656aaf67e35e33c5726b9184af6ac9a3b520e23b31
- MD5 4fa2a05c47e51a7b6703995ebf31feeb
- SHA1 307ccff233c48d96046e824ac9c5d97c70c2c208
- SHA512 69f48698e723997a8aa9958bf67a3d50903a0afad7bb881f9d3b3d1cf8e4cfe3de9e4c1a6245b600fd0f0b4c5d3ed9b16b42ed8e1d92487feb36fa9aadc1962c
- SSDEEP 24576:OBpDRmi78gkPXSyo0G/jrMGEOqD5PGs2mru6HOOFlM2rFvrAt:6NRmi78gkPX/o0G/jwGWD5/26u6uwvrm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 9821490bfde738dc4d2deddcdfdc745e290e883c2a6e5ae80628271e8cb2230d
- MD5 3baad10dc3644388e379fb65b11a40dd
- SHA1 ff049afb2ec3e27d0d2dc97230c443a74d51d040
- SHA512 8b61c41f0b21d17a87b462c0aa6a31ee501797ce038ac5c9ebbc316aa085ed15355bfe950609d4a778d5b9781d9e8f7c388de139bd825d6fdd5b51bffdb11cd5
- SSDEEP 24576:TLOS2oGPIXVHGEOqD5PGs2mru6HOOFlM2rFvrAt:N/GIGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.5MB
- SHA256 5a4a4ba429af3d77e1b53edb2a27130fd45a58d1cfb81cacb2d3339d351b8791
- MD5 9a09c6402140c4e66379864e498dcf38
- SHA1 0d660a8e77e252c0ce7a5b684edfc8a12f4d28b3
- SHA512 0b374e8844eeedbecb8051fc8df6ddf43946e26985cb84c1ddb9bd640a50ad2aa769d27a86a4baaa57cba03929febfdf4ed65ccae2c6c894b658c3285a983411
- SSDEEP 12288:jhPnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:jh1GEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.8MB
- SHA256 8687446a7d18c268a09ac95ac2927f3f8b05c3a35192685585b45b3d9085131f
- MD5 f1a7213d0c62284682491421dbf7cd17
- SHA1 7ff3639717cdcfacbdbab7db2e8740cad42cd82c
- SHA512 aabb69ed49fe47f6165b9c487e62445052f6a8b293957a473282364d9a04991cbb070c90ddb2b9247435b8efc7c9a7b1fa3ff4b344ac53bc6588c40a727cc016
- SSDEEP 24576:MJIUKGEOqD5PGs2mru6HOOFlM2rFvrAt:MJIUKGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 e37c31ebc47e80b9788beab27407dc01b7aab1a1d9ad077ce0ae987c7c1f002a
- MD5 7e12b5703fe87c9d61dcd2ec1da438c1
- SHA1 c8a6e789278d1e637bb4c3cfd64c81c50ea31e20
- SHA512 4ccb06be30232ab219adc30fce1a9fc9c358021f951a76c6c60058ad5c4a60001a0d8d8793f4a1e83b4f5515a1a25ad5872a6084108eebb1268e100f92a18b70
- SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THZ:TQvGAdlCEL8c/pRNw5CTPk6ZD5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 9b14a0f1b678803f73bf0f6c89ca94a62f160c84c83a427482f36d465d1c79df
- MD5 20d71b87cc0206fb4daf09bb7517eb34
- SHA1 c728bc9d1fcf6032e4b5faa402767c6384a18dd1
- SHA512 d7351f8f2a08a76a3e25b053fbb49016b679211e2c57f198d3b20bec6e6dd1b0a6799ea8e4fcde37e301f72b36eb9e346ed9b30eb8f3e9c2c939d94df2a21911
- SSDEEP 24576:1rewsAjkGEOqD5PGs2mru6HOOFlM2rFvrAt:dljkGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 cc0737c463c93abbe41b256f8a047cb3d1d53e1c7d2fdf298c0b7c9a079723ab
- MD5 14e4f95de97688ef636f75c4e4216dd9
- SHA1 7cfa610350ccb735ca4f42cc1f9ff60abb69e053
- SHA512 3618627ace634634bd417b752b220f79d6b92f1b471cf8d8fe91e9fbb846278bcba5865f3ef8a2a5e4ea6addb99f1d0552e92220e5f84de6a070c57c23740dd9
- SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHc8k1r:KUEtQevvqc2W1cpV29I32Ze
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 6ff77f08983be1165497d0475093e2c156f6f3ef1af4a842900e89c04a104d33
- MD5 9c790c11086653f6e0b76723d17fdad0
- SHA1 32aa04eb0ea886e640bc0de7694e5e2765fa76cf
- SHA512 d8bfff36f32f3302c5d399b5b176c8b55a18c6fa9c41c2082ab29283629fc4da6025bba38edf3109b896285c68161238d633da7dedf1195c8c5450bcb7ae0667
- SSDEEP 49152:rCbRquA/m2yL5zTfFiV+XenmE3/zEGWD5/26u6uwvr5rE:0oquVjnm3Pk6ZD5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 433f170d41c38a511823d13e367f6a261248bae80538247ed4a0af7f7bed5753
- MD5 9e756beda5aed22592739a8a9e9791da
- SHA1 f47e3b42a804e1712b454cdf3b279b83ee8e86f6
- SHA512 a30c55d774fa814bb21bc00b32e8bf5d10559f1f51402259d8e7a19d21bc676a8255e496fdbac75741d87381da5f53745175385f5b8905c2a84924da8db0b6f2
- SSDEEP 24576:5AhGLmIFoiwtA5l7S53XGEOqD5PGs2mru6HOOFlM2rFvrAt:5AM1Foiq5nGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 10863fd867c117db7ddcdf90132cf7b0831436b6d6a12a9d0f0009b10d1b936c
- MD5 67b31e482179b2ffb4bab08e7583e771
- SHA1 bac7555b949656e57523738c8cf2f5dfdf800dd6
- SHA512 be9bf1c153afd22b344c2046a55e789fdf6bcd93ccfec3be7f1f7267fade83b7012846f11bb82c676b1897a4709d5598986ba51c22fcfb44b1366b363c4aba05
- SSDEEP 24576:RwuyOWIGEOqD5PGs2mru6HOOFlM2rFvrAt:RwdOLGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.6MB
- SHA256 2a41a046d967bfc4922d8e2a94c8f01de23b6aba37b5a38e2750f8277c1bf61a
- MD5 67476971b059dd82f302404eac651a35
- SHA1 dba740e4eaf021cb08d00b010763bf36fbedbbeb
- SHA512 14ef11f1bf676f34ff5989564f227fe6ea6b8b59c6c4f6ef0a2ab024d68a4cbe4ce1100dcd37905cab02686068f983eb04ee73704313b979d03b24426376c81c
- SSDEEP 12288:MwZ1IywnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:/ZuxGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
- Size 4.8MB
- SHA256 e9df4c48f3379f6e47b990e598808f02830988548d6fe10b565fe22bc120db3d
- MD5 f09b1213ce28ccc1277a0e22f559ff78
- SHA1 6946f07d2bb5debd35a5034453d76be618b3221c
- SHA512 6ac7ce3eff012b8464f40db77bcd1c177853cdb352010a8148b98b1da38e4830433079f37fb18fc527ee6af220f1d37b7e7fddc9c6f33d489e996cab6aff1c2b
- SSDEEP 49152:uj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbD7iIerM1R6ZP2:prZ4K5M+XD7iIewG+x6xZ14iPk6ZD5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
- Size 4.8MB
- SHA256 cfc71a6575c68b1cd4f6cab3840435dc3a8f1c5cd06ccae727ba418c291f5112
- MD5 c90b064c0fa8f365cb26690d84d97e5d
- SHA1 9aaf10765ebc078be152e91dc0807e55554bfa33
- SHA512 25adca0eb6e4f2bf3f0a0724cfa7e5be0c408a5d2540f479ec1d845cd7e7824e7911343af55c9759e434928d89086c73e72ca132161db54d7ddaeeb32cb1058b
- SSDEEP 49152:aj8f3jtqiCLg9LK2hIOR+k9jdAsizqxSiZ4K5MZqkL92c6nkdmbD7iIerM1R6ZP2:lrZ4K5M+XD7iIewG+x6xZ14iPk6ZD5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
- Size 2.2MB
- SHA256 65e17e3a478305512a909310eb58d096f07c826746f24094167fce94d1d88a56
- MD5 d76a57da01bf28d50c97a80474366de2
- SHA1 3959a67b56368b79f2998e83a4f2ae86b1934f00
- SHA512 bef5540692899a47dd15c7b0cf1cd710231cfa8a6d5cb5b1b78bb79dbd43a2a1b13eeb3171b1c509d3fb74b097ea18c27e50120684b177edb16ba1f120d8b78c
- SSDEEP 49152:LfzabJ8llj+SWxi2mkx+X+diXGWD5/26u6uwvr5rE:w5i2uPk6ZD5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
- Size 2.1MB
- SHA256 8af930da913ca1b0109c9096ed1b2958aa24afd5b781f9225b23efe29e9a039b
- MD5 61ee8fc88eb982ab332906f134828633
- SHA1 89a21e1a679156352342384c8a6b82de59aaf801
- SHA512 286bc5efca09f9b99a6ee5de563b69ca5a912d5121e403d2112f13a4f86fca92cb14098f226d2e946ca3ec78d68b9b0f9082304e140a686d858e84a249ecdfd8
- SSDEEP 49152:Pa/3xXBSZ4K5MJ1LvTMxbdsYBYSgxu9+fw4TCGWD5/26u6uwvr5rE:3Z4K5MJabdsYNbPk6ZD5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
- Size 1.8MB
- SHA256 8d36245b8bc4aff436aa4b246b01aebdf8eea9b5d00e90ee5afb329cd43ee8d7
- MD5 25810530e6fd92a6085403df2963d7a1
- SHA1 a6732f53c984929a25c08e1efa056605f2446131
- SHA512 1ee85d8797c88999912c725db1a96303e570311f1f7a6f93a26e05b167c33754b069207ce5b450db85c34f63a90c0808bb088b62ca8752e817f14cc1d5ab1b6d
- SSDEEP 49152:pgNJtUzDu/9gkPxHC4YGWD5/26u6uwvr5rE:APxqPk6ZD5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 1.5MB
- SHA256 52fbc81082ea0298c97c879bd266a9f3f57537fab583704c3f9e22cf6fdd3c66
- MD5 c5249d8c6867b552b4cd45ac9f352c9d
- SHA1 b727c8fca001d621e97b2ef06b7d17fc376ecce7
- SHA512 b0eabf2accd5d02d81533537ebc1eefa9990581010ff9ad57f2b8b5a022988e93e25d31e29c82d80cf3afd01b459daf589681d8c85a9470d02d7d9de75aaa3ad
- SSDEEP 49152:9OBynH1wM+v6UJHLQd7BHjdf6GWD5/26u6uwvr5rE:PnCLQd7LiPk6ZD5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.5MB
- SHA256 dcd201792c7e52fadd5456fb312560eb72ef5bdd8c26e7df94b834c2a04e2379
- MD5 42008df9eaf45f2f5375321eac8817e5
- SHA1 2ec635f540afaea9079fdfd30cf264395d110dbb
- SHA512 d3a7227fb11bce2d8be73f24e6bba1e7799f3154bed8f10c1577dc21805f3d6305dfb54b6aa7f068d12bfac363f54895cfe8e1b79ee9fe9ce9889cdbeb794447
- SSDEEP 12288:43nNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:4dGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.5MB
- SHA256 9ab7d1333c1ef2e5eeabcb53113925120439b865ba90bf34e296eee1e22bda7c
- MD5 eea6787e164c77a0e328c15e1d92b6d2
- SHA1 fde5b79aa6ad262081cb313f365ce802cd56ee07
- SHA512 0cd2301c922dd3ffe3ca3a0865c5c9585b78b873914f042f2f1c4ad79628370981c367024f3c9b9cf3291963f2084b0ec4862321989fcd83ae907adfe42c937a
- SSDEEP 12288:HcnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:HAGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.5MB
- SHA256 781ed97b19245d8979eaa246e4fca77d47d6b888857dc6ccfefb2f2005b2f51c
- MD5 c72aef6f14c6919f8508f369ab8df12c
- SHA1 b26c59150ac2ce12f174b5823592f04dab14cc2f
- SHA512 4c19577726fceb0064d1d7b407d8c0beca3e00af610539aa6fd352492f2c757558229a50de38afebf4d29ac334f77dd0b0ed009afda68eb63c0a8b33acc21b18
- SSDEEP 12288:W+nNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:WyGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 7c1540aa4e724f6afd91c097d7feb7f2d997c46c7b317ded29601b0c724796f0
- MD5 3eaddbdce1f7b62811bac86eac90d053
- SHA1 e1483dacae1888f4a53fb7d88cac3b04bea829fc
- SHA512 1d8cf28c40f32e723ebb6ccf16fe42fd55248661ca5573fb1f8d7b3620801ab3ecdfede067997259873b65c059b78cd3c54424f30058efdd52b076ac7a89c3cd
- SSDEEP 12288:DVpnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:JGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.5MB
- SHA256 6d8241277f3ee90d62277c1e4f443f2ebed75139f524d59f6aaa5465ef2d0877
- MD5 cbdaa96d42a99bf27f7aba935c9a0585
- SHA1 763b927ebeb1da02bac84781a8d794355c78017d
- SHA512 90ce06d55d27e0abf042d58d7a7230ee46d2f9c60cd7eb54a600c938e0493242a528cb877e374cc1c08dc97fbc4fca8220fa8774aa1fcc3a773df1f7881ab811
- SSDEEP 12288:6hnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:6vGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.5MB
- SHA256 6176a5f8aa50ea5bed525ff4cae093cfe54d375a555c52d3e0ee76295c23d264
- MD5 0d1e5cbf2b91b912a183f08566a16535
- SHA1 893e4096cc776a80a0c8206f1d8a43c9d5a3d60a
- SHA512 9b7e839a35ae45903104726f7a4823b76f72906680851f3d0541935bf136a95c09b03b235852ec1fb3e0f87a962e73ff7689eef5c62469f963bc61a37510ae8c
- SSDEEP 12288:DonNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:DMGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.5MB
- SHA256 fef4fa981689027bbcabe4b469e819fc26b48943319c71d904ada9e8712f994c
- MD5 2a6b1e3522350dd086a468ac69d3ee6b
- SHA1 fc5a54a540cfd014b3f7885de0d2e72879a61eec
- SHA512 9980f1fd11d571a5ee606a75c0b9b27ab54800a68fcd0a33d5f55957115f295cdccef66bb3eef995abda56f6cdf4529cb9cc0fea123d23a029a90ea335179a89
- SSDEEP 12288:e0nNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:eYGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.8MB
- SHA256 d32cd62440f3371bfd011aeecf0b06cb8e977d63c684851562e9b014c9f9fc34
- MD5 75bc2b41eb02c56ca98686673cb2bad3
- SHA1 2b1acb37dd7f33e82518980c60379faa67e40a59
- SHA512 2c8c1da4804afbf9c98d6c9cc91492f1a31eb5bf16efbb3d9114de1ae0d08ac94e25b3f90b2f5b5ec05bcd8c84489d9acb8d6ebb9754c08f01877f2ad3b4a260
- SSDEEP 24576:yZM2zFVSOgGEOqD5PGs2mru6HOOFlM2rFvrAt:yZM2zf8GWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.5MB
- SHA256 0f8ee65cf7ef566d181f390826782d48ddeb1bfe6fef41a84d165b8b2a77d9ca
- MD5 aac7bf80de3a7d7a8be8637c5db1d5bf
- SHA1 9039988ad418af77d26797e8ca4bcdf981fe4dc9
- SHA512 1c3092ca32284290a4c784e49de2e0d03094d59bacb64f08cf43626521128680e1b57ba6bb366f7f91906afb91281259446fa661ce8696e8c06956963981613a
- SSDEEP 12288:JLnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:JhGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.5MB
- SHA256 0c7f2c9cda3ce56b82910fbf1082ab6a2a7c0b151d1b84b12823619a9c13588d
- MD5 3d89786369734f8fbb2295b6981e8676
- SHA1 26b303ed10604fc86e571e507027d4795bf0a3d9
- SHA512 ea2a77911e92ed6abf1fb890cfa0b5b928aa3cfbd7bd9a71cb5ef8692ff369d436f63b1fbe903b17c48c904323f0cb5c1bb1d6969c439e919e5c9fd3b6f6ff3b
- SSDEEP 12288:t/nNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:tlGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.6MB
- SHA256 70bd9c9168571a4ea6c12d1f4f8f6275b88d0bd45336d57cd99ecd5aff4f4715
- MD5 f54faac2483cc9c576e6db9d8ab7bf7a
- SHA1 a41892b9b2387f27daac9e5e289d56d577c0eb53
- SHA512 49bfd307a717fe209a5ae01f729958a62a7f9d765ab328762937f232e70793a62b0f3bff4bace380308bf98d8d2bda637d41feadfb400ae54159f02ad8b57621
- SSDEEP 12288:8yPz5L8wnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:lzyUGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.5MB
- SHA256 15bfddce78ef0867b3dea5279ed53a6ce215a2335fac54b8f07d8f35ef0cd99a
- MD5 3fc534e923aa56080baec4d5d2759e99
- SHA1 79fb9a2fc0b56b3935574909e33fa6ee169ada8d
- SHA512 978471d46e80959b5f9eb9479b97e510a04216c1d1ed58bb01c0d545c7ef4cd0f1873c461b8df51dffe28b908c942e60d77e43833e963d2b583e888822730930
- SSDEEP 12288:YLnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:YhGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.5MB
- SHA256 63e18ef05984caeb5db0d6ed895b54a25cf1c3aa3979b9db135f6548b060c5d6
- MD5 4bb577b1238c20906dd35c802a647721
- SHA1 e11752b00a56f8feb643a55c34db5f6bd744f536
- SHA512 a58dd0d81f4a6f43f0350daffcc0c64917a7945575b37e6d7ca6d707d3fb2e808da94987f7a8a068d27e03a2ddacb01df2ccf0fa9acb33a367d3f512d805c7aa
- SSDEEP 12288:DLnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:DhGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.6MB
- SHA256 5ec661d39a37ec1dd905f57a64c18564f99019d2f1fa32262be4198ad81f48ff
- MD5 1b39abca12017be424b18175da2a1e91
- SHA1 0a8e7630377ef8921193d6c5679c10970c049a5c
- SHA512 19f84f7bbeaf4827b535eaf9caeb1b0cf68957f8eca04e8ba67491d6f66950d6c0b96b916549264da2c92ff1c6b90818936b4c7bc77153b2999a7eb6e00bda16
- SSDEEP 12288:YyPz5L8wnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:5zyUGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.8MB
- SHA256 4eadb9787e7dfc54e0dc7f923f539f1349f7fb439b8e915e828ea8a4da8bdb57
- MD5 841110856071b02693b569de3b83bfa7
- SHA1 33b511c66469966baab5b742da0f2c3220f081d3
- SHA512 b4421c4c000ec2d472042d34fa02756cb77c3cc9452c41faedbb8ba8cf69f3242408eff0268401d67cf6eebd1a0ebf740266d894da89025afbf40d474721fa8a
- SSDEEP 24576:xTzaLl3z0zDCGEOqD5PGs2mru6HOOFlM2rFvrAt:xT+LljjGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 2d54c238c13a87c3a2451f2cf6aca7dea73446252108bb0899108edd2e1e9c02
- MD5 01495f766bc1f6b2f7c059311055c786
- SHA1 e1e52a1775c13c0bed6814d117a1f1eb375fea0b
- SHA512 2ac41d4268e2f3586d6dc270ba93853f986546b31076b6f95a7cf8589aa5d06ec884bf613f31cb8d9bc418f3fadec1536ff8206a76629f802ca634a7252b228a
- SSDEEP 24576:RcP4mcvIjkGOxhKP2l71SNKbrh/8KB5GEOqD5PGs2mru6HOOFlM2rFvrAt:GP4m4IpOO67N8KTGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 55c88f4b565d10d6807b9cdf0612316017c3fd7940ecea1424f274aea7dcaa79
- MD5 63621b3e7d4a3a6100bab8d96c71101c
- SHA1 3b7dc3be5e50e0e812145efdbf52cb53ffa3c5ba
- SHA512 d8a1514070e7eb9e51b38318778488fbdddcd14b2e1ff99614793639b9f2af7f8e8b1d35eff6b08ba9424bf2541ffd7d0c70b6ea46c2829a2d1731f5446fbe75
- SSDEEP 12288:uFIq0S4nNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:ukScGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.5MB
- SHA256 d11fbf5b89817045faa29f4a26145893aff9a4084a0596c481e6a0e068d9cf5f
- MD5 8ef4f4f3781edc1c11d612d3160205db
- SHA1 d3ac9fff8ada217a2eb9adf1902a6a5c22992bcf
- SHA512 4b053a13ac6d9317b6ffc44e7e3d6a9e9e57d45efbc7b92deaf30de4344684fbc4a4e7c0a7bedd796531bb25d64521dea3c0832ad9102bb1d326c1866e7d4771
- SSDEEP 12288:+7nNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:+RGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 1b82d123a3fd6841807190c4c93d8a69aa5be4348eb115a62ba4a9e31f3aa78d
- MD5 b2940e44bba2afe4edd370a52af3cfb0
- SHA1 93dba093f52eb89ef6f3e38df9ce864b0f4b0858
- SHA512 d5326952121f40ab85b01567cb699ac1fe8075a25fba6d3095df6018f94cc1056c57bcafe83da11b45a4643c299d976ded22c70ce96716a1cd706c637ef90179
- SSDEEP 49152:la0h2GEkuAe73q3pp46zwwQvGWD5/26u6uwvr5rE:la0hNYG4JwcPk6ZD5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.6MB
- SHA256 f30b89f807d5d097d24bb4876aa6c2f09f717655f058275e1c3909d621d863db
- MD5 97e3ae61f634a5529ee0a700db3bc2f1
- SHA1 8c468e77f9752e563034154c10c88c0ddc4412b1
- SHA512 6c250fd639bb015ae79667458eaf69804947d3a2a72c0a480eaceb975b0d61a6fa25a4ca6186297ee04bdb6c7f130ee075d9e594cefd76b721ea2531ddfaace9
- SSDEEP 24576:xhbHjPQGEOqD5PGs2mru6HOOFlM2rFvrAt:xhbHjYGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 f93ad3e9f0606bcb19072a7576f2d8a0448e835632c102f667b2bbce9112e489
- MD5 7eb80483b0df0a5b7a9300f0603e9819
- SHA1 d402046e30cd3f24eaf8a5ad232b4aa31d597dcd
- SHA512 830b5b367554297e029def1ba4b5c4b90f110280872c69b86aec0ecf86f8f51b00564c05111a502e89ac530f540d54f00a10d9908e3fe1971d3ab18369dfaf0a
- SSDEEP 24576:U3YgnJcRTk4yti+R5dpR/IGEOqD5PGs2mru6HOOFlM2rFvrAt:UIgnaTk46ppR/IGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Locator.exe
- Size 1.5MB
- SHA256 52aa78bca4ab9b2c4417983685b8c60767d2e64035aac779ea59ecd08f94858d
- MD5 2e76e28f7d4d238ff5cd1f29f66147b9
- SHA1 566d5955db537ad7fce9e60bea5ca05faa5d7391
- SHA512 76c0bdc867ccfdc3e4d04ae5355d15c96ca0b607bd782f7e567192d29ab805ea2583b2aa59ff1ee936414d0ca91fccc6c4b11a8803b1656301a9acee6a59ad5c
- SSDEEP 12288:GvnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:GVGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.9MB
- SHA256 249433c1a0d2ac88b0f0b3388bcf5c035f39c89095287876a211359f62806e7b
- MD5 707391f549948128ff4f1e2baefbf8a4
- SHA1 a8c98983760fb13fe6a40a7697bbd21cc34fc6e8
- SHA512 b34fbb8dadb47e4c6100521fc26e733fdd2fd00a3648f6a9766b44649247d21029268ee5928cf8f9f47417df6a306c04d623d28f13aca00353c111c778cb1cbf
- SSDEEP 24576:r2L3UTWGEOqD5PGs2mru6HOOFlM2rFvrAt:r2L3UKGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.6MB
- SHA256 e6830f65ad420146d35905a8a14c6cba41af9b6d67de2c6889c3ba1ea46b0e37
- MD5 7ff4e2a70a44317646488979499e816e
- SHA1 bea457420bfaa0353441ea680fe0934103234bd3
- SHA512 68d4c1308a86aff8e0e3929f78ec9e926967ed7a1f4195eaa65af970bf2b651b0a72119e3b0e3d84827e791b3b4fd9d6707980200d1916b2242b8d08537e879e
- SSDEEP 12288:FpFtxO2nNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:1OqGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 8708391a30f754722381534c7c15d4b9ce11c056355880e1028b1d14055be4af
- MD5 1b1edcb3ff10bc2ea25ac89351c2e566
- SHA1 cebe4e9407f9a494947e739a801a6c9519c1d029
- SHA512 42b3d0901c1dfc662835940674e251d98528dbfa19e9eeafdb71e85732ea2dbcb380083fa2f125ebca4dd601775ce013d2d6ddc7dfe79afe75d1563c1514183a
- SSDEEP 24576:T7NM9YmZqmWMUkPjZM48Mv6bEhshGEOqD5PGs2mru6HOOFlM2rFvrAt:T7cBWMpPjN8DbEhwGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 5428698d5c27b83be19162c7a385d1cbd513cda1f72e710f579812edb0a02dd9
- MD5 0a3a0856d87542cd4b80b90405114d3e
- SHA1 20248b29db6d56aba6e469028a3fbc7d4e41b341
- SHA512 583b38d5f2a503413e6dea2447477bdc804ee0622699f55e7f5791f980798aca27bef29dea539de9156a6db0fcdc003d4f46b0bca85f6a760315a7b3376369ce
- SSDEEP 49152:pF2YuHNETovcvNYf8kmBGWD5/26u6uwvr5rE:c6tCf8kqPk6ZD5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 ebc230a88a49ee99352c64c49c5cac9dce154fd0af83ea9bbd9af22d3d25c77a
- MD5 7167e3b7ddbbd9b9813304cf41ec8351
- SHA1 a3f940c39adf04eb04a15aa495f5bebf1a0d3229
- SHA512 767e70d7b8bdcc647122b19409893e4d992653a4bf3dd2bfc51d3a9026168accbb8795648c88c434ecabf7de02e6ac9ef2e0320749a1367a5d068bbec711a2c0
- SSDEEP 24576:jAFs06+Omlf8NXEbTo+GEOqD5PGs2mru6HOOFlM2rFvrAt:sFs060lYXuPGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.8MB
- SHA256 a3baaa5fb75da2233d37be4f78efb85eb37dd158c9ef1d71d4955c65f2fdcd0c
- MD5 985797e02a601c12a65b1e06d3289dfb
- SHA1 9074ea205aa8b6ca0512e1f2745d02288f90c8f5
- SHA512 384ae6969f7d7161556c9411538903a1b7f07c6198da35d5bd562fea89c94e1c6427e74e4ad6e1b6e79d3771e4d0b5f9747efdd3df701b55f9b60a7b732041f8
- SSDEEP 24576:8JnJ5D3WdPGEOqD5PGs2mru6HOOFlM2rFvrAt:8JnJ5DGdPGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 c57bffbc34a3611f5cd48a3c300245cce3f2d0572e20601de80c09791cf79ae1
- MD5 c41936033873f2fe95e1187d7a727faa
- SHA1 9c8eea29c137debc923f0746771f9f702e6b1649
- SHA512 e83a838bb9b11b6ef0b02d5e5f8d5e1a3e6d5bc6127f9487015889ea7b514983e0bd816a89337a4fa7b83b0332773e034c69c668192b7bd404ce115cc483ea74
- SSDEEP 49152:do06DIKdwc+eQnSt65aVdGWD5/26u6uwvr5rE:KbPk6ZD5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\alg.exe
- Size 1.6MB
- SHA256 234e1cd1847460276fcaa39ff76349b19bb431b42687030cce6e95f5ea4358af
- MD5 9ae0ecdd6d567ef08d03c0dc448599bb
- SHA1 976788cb9496d598ec0ffdb51112eb104b98cf1b
- SHA512 20e6fb3616aa7dbdfd1d1a62ede8672194c87f2c55861148b7863def6d3ac1d643b203d975fd8e0dd566714a6461bf6340dbcb26c35de9478e5a9ecc82a3fb43
- SSDEEP 12288:mEP3RYVnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:lYDGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\msdtc.exe
- Size 1.6MB
- SHA256 a1263af95021a1adb2ad4b6304f86ead7dbeab6f98c54cb4eed23712508bf8ec
- MD5 a7cc96933e9ece31b9feece0ebdf6883
- SHA1 cb4da76d3eea6d5884edbec3f2b843cd19b23513
- SHA512 3165aa9c574efb6605e3703ae198399428231031b3567a040dfcebe983645bac1615429ceac83f4c614d6340deef194376cce23c3b5f639e672f02a230acb1e4
- SSDEEP 12288:xjkycnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:xIyAGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\snmptrap.exe
- Size 1.5MB
- SHA256 6db8cb696a65f85ab64c44e254e4a1f0db77fde058e3a19a821b58b5f7109365
- MD5 5ee08e9de57dc41cb6a097f847faf53b
- SHA1 e14b215eb48206f2609fdb203dd887b1cc9c01c7
- SHA512 58ae143310fd1f9c48cf1e69af724c6a15efef8f67ae165bde745e4ea2b9477a308c5982afece505cdd17076ca4611933e2893fb7a5a516e0bfbaa90430f8f07
- SSDEEP 12288:1gmnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:uaGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 7ddb84044e681e885f925f0fced9d92356f6bf50b96726c226383a40901b47bb
- MD5 52497c1a406b91c6d3226e85ee523cec
- SHA1 286953e65182537b925e4f675db4090061037509
- SHA512 ebc042196c4236260b1cce26a62802f90ddee3aac6a9cb6f85b4a70326d74c172b59c511f7658aa9799117e750ae0325b27f87ee5aa157e31dc2ebacb795673b
- SSDEEP 24576:rQ9MxZKdcz97w3JGEOqD5PGs2mru6HOOFlM2rFvrAt:rVKXJGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.7MB
- SHA256 f8a8cf5d25d1091a43f9a7aedaa874e0fc605890179b1793afb76a0c233a0462
- MD5 0cc0ddb6b969b24a16ac147e5d50538f
- SHA1 6c01a560ac70c90e326fd12c8d6adc4482dad225
- SHA512 ee1f6ce62f4186901bbf8f2b59edc766583181ee77810c8bcf6a3a719d067f989756085986a1b856cd85efc3fe3a31eadc29ac526db521c256e93847679dede4
- SSDEEP 24576:1yocWApkGEOqD5PGs2mru6HOOFlM2rFvrAt:IocWApkGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 03131ec7552c7a3ddf99da5df2765300a7f4ef658cd7c78aca3618164857527c
- MD5 cd327a6461e56407a60d4a2d76c45f90
- SHA1 84018a66740226b313207e043e346212d008cbe2
- SHA512 853605cf302eddd8967f35af8f18e2e9ef3c2a76e0b429b7906a30688a03d558d37f9bbc0cd49888083fa64d994f2f1a4aff5cb641891174ad2664d5b0bc99a7
- SSDEEP 49152:RWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKkGWD5/26u6uwvr5rE:J0zuNI4Pk6ZD5r
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 b936b2241ee9360f543f89f961ec139d7f1b9213761833f808085dcb0f7afe7b
- MD5 cc0b46fc18a5681a65bff1b86556059f
- SHA1 b64d96dc988e6d9a4d8080d78f3f6c8b1e2b9ec5
- SHA512 2440d0f28bc843c28e14b4493d6c7661c4e40c6a4002f0a52c87f3a679bde964a34099fd6daaf2346c600543e38694f1ac3eb5d32f87eb375ac6e1acc35af93b
- SSDEEP 24576:l1QT7EcpfxR+N5AWAz3ooiYqjMqbDGEOqD5PGs2mru6HOOFlM2rFvrAt:ATDxR+N5YzTEjMKGWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.8MB
- SHA256 9e4bb7cc7b59347faa62b680c3f21dacf1a17fab69104a588dfb635d91c9dd64
- MD5 c66d8b490201fbdf1fce5973009ff33a
- SHA1 186921b7d2955d3271a40c8b1d01adfbbcae25ae
- SHA512 b01ce71b2819b1ed397d867f5ed14a5ed80da280b62d5390c9e429408cd45b78d5f1291d4113471bc27d7daa96589841c8b67ab3a7a5e54860bdfced91ef5a83
- SSDEEP 24576:kTMdOz0FFS+GmSL3GEOqD5PGs2mru6HOOFlM2rFvrAt:M0K+GmSL3GWD5/26u6uwvr5rE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\msiexec.exe
- Size 1.6MB
- SHA256 a1291e7eb1f9487f7d6db08a714a19231b63f6488a57b5f40b0f2c5f4586e92c
- MD5 ac7c80606413a0ddcabf9d946f508762
- SHA1 ea528448e05e13736aa46a91489ef6c732a302ef
- SHA512 2640a50da60857cdda7ab7ff24396ea56528a252ff6b99bbe5f4deed84ee0dbfef9e20d42efc5f797f14e22e7a3bb1309aa7cd666659a88ec4248d7625818d0e
- SSDEEP 12288:L4aSnNhUyPOqD5Dk0/OzZsZwESkru6HB67hdq2UUSM2rFc/8rAFLV:/WGEOqD5PGs2mru6HOOFlM2rFvrAt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\odt\office2016setup.exe
- Size 5.6MB
- SHA256 9ea55c87ff543c58cb4e16ff9c338892f708e7db626c18058cfe17b6d422f2f6
- MD5 85812f0eae05ff1b11b059c5026945ac
- SHA1 45d6ed3fd8dd28f2879ddf432cfc38471b6daff5
- SHA512 bdac4b96f6a7e28ad5a225999f7bb23b8e716e37b296d97d9dd3d265fb7119262f2e137bc7e008b2846f14e117587be9fb81b6a0bd99c8e42d000d0136c1a0a9
- SSDEEP 98304:f7M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGt/QmvD/cTwY2h3FoPk6ZD5r:zM7pTXexZPGzURnBh6gGtF+W368k1r
- MD5 SHA1 SHA512 SSDEEP