9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cb

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2024, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Size 1.5MB
Sample241022-flks2sydpd
SHA256 9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cb
MD5 519746ead81e3250d039fc26934435e0
SHA1 e214105cfe3d891f1cb4836e10acff90a14cb5bc
SHA512 cffc5194d0930e480f1dde949cb77701ab163cd8b642325450e1a84235fd25679b37bf4e9792078a95fc03e781e14c67553ea36259d85de65e1599ac68faca7a
SSDEEP 24576:bomUFhNImLFj4svqaShRsUiTfjo5ya8j8Tt/sBlDqgZQd6XKtiMJYiPU:bCemxj4svqaShRibza8W/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4920	alg.exe
2132	DiagnosticsHub.StandardCollector.Service.exe
2256	fxssvc.exe
1648	elevation_service.exe
4720	elevation_service.exe
4348	maintenanceservice.exe
3900	msdtc.exe
2432	OSE.EXE
2756	PerceptionSimulationService.exe
1516	perfhost.exe
4292	locator.exe
4496	SensorDataService.exe
4868	snmptrap.exe
1644	spectrum.exe
4420	ssh-agent.exe
1068	TieringEngineService.exe
2896	AgentService.exe
232	vds.exe
2772	vssvc.exe
3644	wbengine.exe
2924	WmiApSrv.exe
2580	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\locator.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\msiexec.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\vssvc.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\dllhost.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\spectrum.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5aca999dc1221773.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\AgentService.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\wbengine.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_73343\java.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007104a9f13e24db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f65caf13e24db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ccc6ebf13e24db01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea77ddf13e24db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a966abf13e24db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020c50af23e24db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d64e9f13e24db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019dcc0f13e24db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Token: SeAuditPrivilege	2256	fxssvc.exe
Token: SeRestorePrivilege	1068	TieringEngineService.exe
Token: SeManageVolumePrivilege	1068	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2896	AgentService.exe
Token: SeBackupPrivilege	2772	vssvc.exe
Token: SeRestorePrivilege	2772	vssvc.exe
Token: SeAuditPrivilege	2772	vssvc.exe
Token: SeBackupPrivilege	3644	wbengine.exe
Token: SeRestorePrivilege	3644	wbengine.exe
Token: SeSecurityPrivilege	3644	wbengine.exe
Token: 33	2580	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2580	SearchIndexer.exe
Token: SeDebugPrivilege	2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Token: SeDebugPrivilege	2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Token: SeDebugPrivilege	2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Token: SeDebugPrivilege	2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Token: SeDebugPrivilege	2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
Token: SeDebugPrivilege	4920	alg.exe
Token: SeDebugPrivilege	4920	alg.exe
Token: SeDebugPrivilege	4920	alg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2796	9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 1756	2580	SearchIndexer.exe	112
PID 2580 wrote to memory of 1756	2580	SearchIndexer.exe	112
PID 2580 wrote to memory of 448	2580	SearchIndexer.exe	113
PID 2580 wrote to memory of 448	2580	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe
"C:\Users\Admin\AppData\Local\Temp\9c27646cf2c6c9b6cb65c2aa155d6d857f7110748532cc9a4bb5e8c87c9810cbN.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2796

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4548

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4720

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4348

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3900

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2432

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2756

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1516

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4292

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4496

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4868

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1168

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4420

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2896

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:232

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3644

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2924

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1756
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
Size 2.1MB
SHA256 5754a9fef82182c41330ba05df1efd313fcd8b06c7a8ae765b5123ec3c80ca13
MD5 8aa0297d726e727221eaef4a93f15753
SHA1 b0f36a4f3f11912b1066e0d5a97e3322736d4926
SHA512 593bb5c8d69f5e224ef14090afac50c474ae60be9382d31cde29b1c9e88090350be4fc058810f243d0b5b31a77db50ac4a997536e29b490ab24c6aee1646906e
SSDEEP 49152:WuYk3H5koUafTqkkYLO/W2buywzMbOX+T7z5//snji6attJM:WCfTqi90bjEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 789KB
SHA256 bd738300fa3d229d7942033a3b38736ab12880d8b8cdf687089cdc3540bee5f1
MD5 c51ee7f10bbdd69693e95b52ef712053
SHA1 6288a35a76137f5675ef3d4ea7299af84acad692
SHA512 67e2212bfb2ce5859f63059d776dbb41d9c946df67712657a224d0dce2dada7339e12ae7a24402dc0544dca59032a292928db176713f3999f1b4ba9e61d0e6a2
SSDEEP 12288:7sixPwEsHuXzWGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:7ZFwVuDpt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 8e337fefabf1f57eef7865175bb75a70ff669811ae7bd20db2e7ca7ad465f1ae
MD5 a61e9b5790fe7f51720cbfe1b816ed98
SHA1 fbb00802a90f7d50bdc8dece6bc09a21e2b5536d
SHA512 6059999d7a76c06ac7d22866eb104818a95beb74ee88ed8ff1c00f0bb8ffe13827379f90b5594039d51966daa14626c7d9b36e569f1ab23774d42841e894c742
SSDEEP 24576:1+gkE1fh4Coet/sBlDqgZQd6XKtiMJYiPU:cgkERSK/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 34c1f845ccc236f712ce3d04cce18e82520b9764e0b9a1e257d8f35c8422cfcd
MD5 226443d0fd8417cd9dffd2783c4afbff
SHA1 3825bd614c02aa75d3c540f5d0f0a0d5d3073aaf
SHA512 aa41cf5cbfe4da78a8a90036092958ba160853c34f8cf8960fcf1399672cb74d07a40ce4b8d2b8c8c55767dbb6272cb8204863eb8bd23d3257b82d80993489f5
SSDEEP 24576:4BpDRmi78gkPXlyo0GPjrJt/sBlDqgZQd6XKtiMJYiPU:sNRmi78gkPX4o0GPjf/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c0d6925d32135b849f5f7022b62fdb99e802651fb849bb57521f8cc1e6eedea2
MD5 cbe2624e2d9e729c74857ba776e11932
SHA1 0e03cb7c6a4af632954d59fc17ba8ec93ca4022b
SHA512 75533b7d54b0079627fd72dbd4cb462e64550862fd820312421b167553b8c088f8cd4554be35c4e26a0307483ac18be7123389a88dd298aa8ad6ebc34ef1b585
SSDEEP 24576:zLOS2oPPIXVet/sBlDqgZQd6XKtiMJYiPU:t/P3/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 cecf3cffae7635afa5d61a2002ec7b10da979dd70cb2d7cca14c724b4abe3074
MD5 563e88cf150cd96b3a8e5744183c00dc
SHA1 543d1b9763222cc91c05732713fe12db3431323b
SHA512 4c51c03b322a6f02791230257b3be8670f60e6ad2db3e1b32e80006613d1e486be78baa16ec62351f6dbcf148c7d4996e2c7d15ff4ed25fe44bfe0e02c0528df
SSDEEP 12288:PZ9Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh/:PZAt/sBlDqgZQd6XKtiMJYiPU/
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 fbbcc745f56dd78581eb5737fdc56da551307944ae68a8a36eda4b01b728ab9f
MD5 ab4a4a20fd34b0d7146d7eb0e8066b94
SHA1 3bfb9a03d7b51da9640ca83241f284fe134217bf
SHA512 102e8e76fa77b3285bf3e0dcd255628f15cdf78be5b9906a3d9938c1724835e0df957c458168c5803a6de1cde21c49f5abd3978bf63322104574f4c9d4deabb3
SSDEEP 12288:oeBNUbTVO86UkGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:oJIUrt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fd473551f2187a24b215f3c88dafc8f453b2b15069122d9ca9833fc10fdd626a
MD5 e4b43de1fc561ff533b9ec6f5689258f
SHA1 0381769d333b120ce7496418eec523de9557cb53
SHA512 8df28fdf1032ab5409640e8caf4f961099146ad8ee87766e919ce776468dd83a0e15819b4965a4c089f177356a89ca15f87dcebcb3399f2f50068257376b1486
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THY:5QvGAdlCEL8c/RRNw5CwEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 45bd97704942bc9eff3fc507bdc52ba9747f825cc8e43ea2b2c238d49750f162
MD5 b8a33fa2920cf80f43cc2fe7c4a81ae3
SHA1 baa9eb3bc8c3d69f7a9042ffdc38018eca8cd604
SHA512 6615c9cd12a6a9e304d994180dc49ab4aa994afbd605ead9c73ed2531b753cdde70c111fd32094e9a63ee660ca0c5cfc180bfcf45be56a7c751d75c27ec51482
SSDEEP 12288:mAwSfxL/2Dc3DDLLmt0LDQewsAjeGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5w:7SewsAjRt/sBlDqgZQd6XKtiMJYiPUp
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b7abe9c9c58472561c0f2e4810d44646ce9a3af452f752de9bffadd0414cd2da
MD5 037fd1914d3a2e4544c951983250ef41
SHA1 72fcdd93eed654e7e556e478364ffefdfa86cb10
SHA512 490e59ac4528a285773cb7baf4062ce3bcc89684c3bd666f847d66d53a1d2344d5d5a5b41ffcb7ff6b8cc52b7c6089976f7fa5b1f914922f682b4cc7da747603
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH4nW9:YUEtQevvqc2W1cpV2RI324
MD5 SHA1 SHA512 SSDEEP

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 146d21d9dcb7a499ae46994e6a4f198018fc5ddb7b5c5061178bf50ab11f1c9e
MD5 396e70600b39141740a8c42af91d5259
SHA1 bef412567a9062ff0d88ab9ca2ab7007a1ec6b16
SHA512 ac5f224dc2faa0ab34e112890947767ff75d2f432955e682571e0337c2218d409216fd83ed3d1f52283e48b65cd5470462bad1c2c3f8b009ba506a4700e519c7
SSDEEP 49152:VCbRquA/m2yL5zifFiV+XenmE3/zD/snji6attJM:CoqHVjnmkEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 69a94b39cb1b0696ec3dc819b7c06e5d7b9dc34e1394738f2039451a89f4c218
MD5 8410a1d5cf95180b7571e4fd49748970
SHA1 352ba3e782886f642a23d5883b97d084271ced0f
SHA512 e01c2d07b447c1e4c30e27bb33b70883fa01e3e2e5c247a8086417f9d8231fe66f31f550d3366b15149920028a1307a34104df32c0525c61f2a83676248a3a96
SSDEEP 24576:fAhGL2IFoiwtA5l7S53Ot/sBlDqgZQd6XKtiMJYiPU:fAM1Foiq5U/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 ab333c482b0c7610c5236cca093192db2c4a536b54415a1dde9df5e55489719b
MD5 872e9a83efe44cb00d20ff682f07598a
SHA1 2371cff387e21c351f13e9d007f980f0ddde1120
SHA512 1982fbf568ae29eb85cbf94d22a4ed806b53741b8455a14081eda5305202ff67c273de33c33da6f9684e73edfad53c65d31923e6fa94dd524766aa199e4bbccc
SSDEEP 12288:Mmw5HEjsChNSBFgl0WDm+CLGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNA1:pwuXOW1t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 6c0ed7bfc39f49118b191ad31b065955ab3c5297da9c3adc9757c48e4faf4002
MD5 7cffaa1a859c36581f058b83e6ab4fa6
SHA1 81e2f0af9155d0eaac3a575474dd75a22c3014e9
SHA512 d07a7c3280490743ceef29ee2b83bde99af60f1eaaf0a69c080ca72a0ebd9091ef9c1dd31556b32bb07c629e71acd9187c40b269c2410b3bb27fceebedea0535
SSDEEP 12288:k/Z1IyOGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:4Zu8t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
Size 4.6MB
SHA256 f72d3baff102e9c14c6f204ec51eacdefdcd28e4d0c122fce8d3e385641abf98
MD5 64514568e84078db918e6189e3ffefe5
SHA1 1814187d8f51d58fcd890e4ac081acbc4af119d9
SHA512 8666cb07b58d5669f528ff60240917a7e1f1f4ad78ebfd4d80c7c496d2efda9d378ab8b01c30c624d46d855fe787313e8af74ac0efb587939f8900af5b7862a6
SSDEEP 49152:RyEKQ5E3ieGR0PEtBFUow1b89eX61t+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEs:9q9ceqP+2xl/SSaywEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
Size 4.6MB
SHA256 90f2071f4f71342ed5ef9c868db0dd5dcbba7ba727ee49f3fc08565568164a46
MD5 35df02a38d875a0a7c792a3840d66899
SHA1 6479da6a8a26507839e0856be6e87cb252171f07
SHA512 e98c4f5b23938be07be839eaf4a078acd3b28f79899458dc895e058805c7e1bba11716b6f6db1c87f68a8d007b05dcfbbf5c691de6854275d21d60e810ad23f9
SSDEEP 49152:ryEKQ5E3ieGR0PEtBFUow1b89eX61t+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEs:/q9ceqP+2xl/SSaywEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 0b896dcc9df2b8a50522b398445ba1c89917552259d98f998d798be3abe6e1a8
MD5 c098cd68efb53dd92c1c184033293fa1
SHA1 d871dfdccae1e543b39a4338b9382e368e500d8d
SHA512 81c1035dc3ae6178c5fd6904e1a517c27cc3b37fe5dd432f46c34d81152c25c56c77d927d44efe851e4f2ae889a9a9c940106b0cc2bc8cc27b3ebbd8e46f8361
SSDEEP 24576:rVN8FYh+u0m/YOn/xvNSut/sBlDqgZQd6XKtiMJYiPU:rVOyh+u0zyxD/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
Size 2.1MB
SHA256 d19f79f1ca4645980de466ccf2ca831ab0921627b8a6b43aaf136e688c8acf2a
MD5 dd7e001560f80bd72e67a5900524ff7f
SHA1 75374249d5d658992f8ed2885ca54e99f6ecb265
SHA512 94271d7cfc610d842ffcd1db0b7aee6fe4ffa57fdde6052a193389be57ca224b7ccc7166f76d0f157ad0eea3ef5ac6a69cd06a2c8c6570b01bbfd05a82d96eab
SSDEEP 49152:c59PYHvI7wi/AIKuLFrFXlMWGxbgV/snji6attJM:cGgAIKgM+EnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
Size 1.8MB
SHA256 1911fc69042a4d3f24002b077f9ff608219400977c031329eb8639c9a91fcef2
MD5 a2361befc3bd591650d3cf00516b9be9
SHA1 cbc8e8bf1540edf13f266de4bb2a5d6cfc888d94
SHA512 c79f9c4761d1be960570821aeb00f68317b8be75d2e785d45feb22bc6a7c59c39f9af6ffce736e94d709979a36d6ace238915b23983a699e9a97d386ae1d60a4
SSDEEP 24576:bb6+S3zFphRwMVrLDnyhECINqzWipIxhMt/sBlDqgZQd6XKtiMJYiPU:bbrUzFjGMVPDy9INqZb/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 0656ee3f7ed3d77c0e2e43b0b46092d91e12f2fabe757b4863ebd30b13124e7e
MD5 72bf64b48d6e432535b004d0bcf9434e
SHA1 98748762f960bcbc0613c3f606716c224ca54678
SHA512 72b34d9ac6099b5a4610ef40fbdd4a678c39b83c9b7ff3af724f83b369e6c69a40c7ff758dd9dae9d9fb0faa10ac033e313dc3f23c0f22cfc58f4fa71dcff7a8
SSDEEP 24576:e436epN7wcPROWFW9sQ0MtJVt/sBlDqgZQd6XKtiMJYiPU:e4qiwcPASW9mMtZ/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d3bbaa071e10e27bbb42ff9445ccdc532cd0c00b4078538715b453541ba0b0c6
MD5 9f7d8135170ee5e2ba0f7bc29864ec8a
SHA1 79f35d488913340a89422c1f10b9aa92e3373d4e
SHA512 9b73cef80ca45ef730e4fe5f09cb9cb5a5cc180112c78b38603df731a584150f0c1093f6dadfb9cf8216eae82c5e690fc9a929c4240c2c030df552704ac12bcc
SSDEEP 12288:j1Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:jYt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a41fe71a215a14cb966eab8a67f741e0b262bd848d26c5d91dbc374aec9d31d6
MD5 8c58afd5b7a995303c039426b28f6754
SHA1 39170254fd2062fe4354adcb6c9b55e4353ac192
SHA512 8ca28ff8c1f10b0c7f6d52e09b0d31d10a28b12d9346799f3f102e0b38cd1d8a9cc7b1d4196fe4c5d545672c02c738f4fac9ee1a3e05d7c6f3949d6c22a18f6d
SSDEEP 12288:N6Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Ndt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 0b70d0dd427f78ab3d3af5f8334206087ede4418819ea838e9888c1b88476fda
MD5 2890b17c8cc1db9b0690842a3f6ae7a3
SHA1 98ef00c4668fed4a8bab692551564a6bc3ce888e
SHA512 3702dbbbf2fbb7c1f4de94c1b7849bf06c154d13e6054944b361fd7e0e03b940d8c81599588d32e281a5fb6744f6d7c735870c9e4de4182c663cf45dde007615
SSDEEP 12288:58Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:5jt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d9fef484b1a418c03c54b68b5ae058a44e7685d14924b210347b5d8b0aeaad7b
MD5 cefcd1f19923a5c7bfbba221e6eb5c23
SHA1 772f6c85b6279928dfde7f6a6ff04aa08e7e5504
SHA512 0974841e272b99036da2f0335cca16eb48ec5f879814570498e7d881a3891ef831fb6e8f54388d8b0a553ad7f041c26a3f728e1d672542c93867cb8c6cd447b3
SSDEEP 12288:EVPGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:vt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 14eabc72c1b7307a6d86296361893200d9899548956c88e62f295038d064d3f5
MD5 1af3ad3835439bb2d2783007b54cef08
SHA1 f5f6ac67d3d0ad746f835e8c5499b648a204a2bb
SHA512 fbb80b5e47f45f5ac0a14c786b2620ac96770246c5eade847a400c8c34decc9b2873e61f8d0127d406012c7b0072b88f274bf009233d12d6b8daef4f773954dd
SSDEEP 12288:P3Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:P2t/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a8c7fe8609d608e8f0c18099e4b82172f9709a30409c88cfefd2aa947dd6b368
MD5 a8624711e568a5a60943d6b8295a9460
SHA1 a6c32f79685cc881bd93a56f49968cda4894155b
SHA512 0e82ce61ef83ebc6625c4ee9e0e895508e66a67faceb18db8f6afec1ff68bae438ef4b6675e0bd200f6d48a292e846d1f01081acbd973a4cd1e87a091dadf656
SSDEEP 12288:p2Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:pJt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 0ccfafaa10ad193174a64f14622e7cf39a55053165244fc58c1ed55da82f0c6b
MD5 485263a8add98476c7c942815d60d299
SHA1 b4b717b2737f4652f8e526f63b08bb87004f5385
SHA512 e349a79961b9bee8c2932c3e434942b73edf540b48077cab4f41e23399a3c6e7c14f3da2aa579d06f954e7d63a3151560ab79102ea72c7b1a33e01eecfdb9c71
SSDEEP 12288:jiGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:jlt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 202b53f5fa3e6dbb08c2bf5387413d48a8883ddab64b23847abe8c0f0e65c2b6
MD5 aa68511b18b958beea522ae2b14537df
SHA1 1162d3d04b928c0ec7c2fa94451a37caf8a107e0
SHA512 a5cd774007edb8b189d9db7869a4d5d71340f726043a5c6074f03470ff0716e7820a280e8df68e2a696b598a1adcede6ff448ee420e87f8ab36c9f282af19c31
SSDEEP 24576:AZMMzFVSO9t/sBlDqgZQd6XKtiMJYiPU:AZMMzfb/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 a9028e4ee22788c38383c13071148284544ea8389778498b6a58decea5b63c94
MD5 86f3f86cc8a494958156bc3b629e5a75
SHA1 1343942d0172d6ab7f6dadc55dddcb077db81ae5
SHA512 2aee15baecbfa488bdd628f26ab1d12e5939167bfd2ce05669e418acddec9d347156d08f265fe3f27f65b6670d25179045734e1ce8faaaada816695d0c834c54
SSDEEP 12288:EpGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:EMt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 3bdefe88ea6c8be4d33ade32d8200064d9091feaf005298015b1e89cd2cac118
MD5 6424228bc54878927402bae7db259089
SHA1 ef276d581c4b2bec961705128513c3b49405c4ab
SHA512 64251ef2ecabaae85bd852c34f9a105f2e4e15119310a7ce9fd771f9a24fa87ea6b657e28e077317d1e615c7b3ccbfd224630ecd0ab43c606882a69ce06d75bd
SSDEEP 12288:6tGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:6Qt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 0982e4333b2981979a6cf54d005f1fabcc7e3a509cdf09e68eb436c5934e2032
MD5 ecf7de1a021ec75dcb2b8c62a479c232
SHA1 892e1b2a9650f511f13c6cfbcc9318bd2a865828
SHA512 8e5ef8f2e26bed28e630a58dcc511c82140b7ad1ccbb8fea13522fc0fba340dc79960e6fba2ccc0c80ade9fbc21438882675f4ab570d497e0a827f33574f8b48
SSDEEP 12288:FyPz5L8OGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Mzyht/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 ca90af1e10c1ce0b15551b6bf85fa10a88837217386002f80366014f4a9a9f8c
MD5 ad317d68f9c7131a8753e177d878a435
SHA1 72df06209ea4b86e54b053e12b2703282bdfffc9
SHA512 c2026a2b55458dc0313e971c233a1ef57e180cdc2cc57d1ce18e7b4ef9fa2b08be97daa9586ac4ae322c11c769b8a5a2cfecc5a56c6af5dd1e03d42fcec614b6
SSDEEP 12288:NpGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:NMt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 3ffd54737eb06ba8bd02909ead05d694a1d6306814e8fdec662241cf47329184
MD5 b308f6d073cc4e310b5e824907ff26af
SHA1 1e1308cb803540788651cbd6dc15bd0825db653b
SHA512 775b68409067e435b2d0106476e9dab5ea1ec2cfa448d8b28e54b52d6eae5cbb8df10773638414ea45f9fcf2f70c51a6a7401fbb9d9ad901ab11fb32c96407e9
SSDEEP 12288:mpGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:mMt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 9834f2922573d1b8bd46d19ad7683ca363fff2ce36e3e50f66c97f5de3863a20
MD5 45e8c9b0c6767fe4b8c57461b8df05e5
SHA1 aebb42b5bb8e8b8ff260696f2d5deac1ee7dc44f
SHA512 76ca66036e46a4a58e982b662965807d51756093e4688c454d648fae2cfcab88835c2ebad0e0746627c8a0b89f42d0cd7ab6dbb8e172a7908fe956a1408212f9
SSDEEP 12288:tyPz5L8OGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Ezyht/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 081957c252e53a0fd8d56c76796208e5e45c64fbc83b4c8a6208c46810436f02
MD5 1c4bcd7944b0db55171e3599496deae6
SHA1 a0d5984d907e04fe49e5eb054d93c11d1b2557bb
SHA512 66f2f4a4253ff22407e536531beedde91c50afeb57185a1c45ac6cd9bb5f9e18ed88f2e1b1c7a8af47a9f486ac3f44de66a77cd881c336d6a9dea107a5c77381
SSDEEP 24576:yT9aLl3z0zDTt/sBlDqgZQd6XKtiMJYiPU:yTQLljA/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 799d33d6d8d88e212b46e3917421c8289d1fa3a8707a8fd82730cb70a1ef1165
MD5 d0f55c3daad055104efee3ffac1c3450
SHA1 c50079d1ca2aca660dd8ece09c5724acd9a2437b
SHA512 e49eb1aa1386693da7ff4ef9185d9895e2baea6f9236e3f76aafd1172058b79f72f55ad477283a921485fbe7058dad36142682d5d238362b713bb1e2c081eb97
SSDEEP 24576:c3td9CHKy7GZ/t/sBlDqgZQd6XKtiMJYiPU:Gtd9CHKyab/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f0cc6053b2211b51d8d46acaedb129aabb6db2c88185d5062b93e9b1b07b21c1
MD5 676fa0c9b85ff343713e0368033a4c3c
SHA1 75935ba26242641d6d2cd7f6eeffe208966c82b4
SHA512 31a05d45aee606721584d28175f1bb5b68031f9a4d69d7349507d2a81c0086285360e4c0ea5d639303135c7b908823de64d70e8c7befd00922b2657014190d90
SSDEEP 24576:pcP4mcvIjkGOxhKP2l71SNKbrh/8KBUt/sBlDqgZQd6XKtiMJYiPU:eP4m4IpOO67N8Kw/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 701KB
SHA256 16ffe99a2984918e2b94c8893b6bfa42ad3ca3615e5795a113f7bcef6e269db7
MD5 019bc210fac5a45784c431ad47a9533c
SHA1 0bb1d806ced9aab9bc5f51d27a100f07155c822a
SHA512 1defc9c7edcb73919d95a60e6a3819695bb7b1d020289e14ed1344a74c4cb9021507758c5a2752c69f2b9fdcefb71a78e95f8137f59d282f654daa71a0932253
SSDEEP 12288:3UFmDDLIGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Hvt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 58b751b74b80ff8ffb2a1ae020f8af840ebdd5d08962d5ea96e7fbc1303d270a
MD5 426a192c6730837b0a598c8b52899948
SHA1 14d8dc1be00bc79ac9e48bc6f5b8f55b44e213ef
SHA512 5c0ddd47ac53d4de83c0063a52823b60ed23ce3bfd01b875e7c8c359e55bd7667c63621de520045fe42ae0d8748049d3fd8b2450d1ed2087e1f7715228cade47
SSDEEP 12288:2ZGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPhq:2ct/sBlDqgZQd6XKtiMJYiPUq
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6f8a5bb9e80c138726708612dd7782cf5ec920009632bbd7a997b2b118e64c76
MD5 b1068649f4fbb8a04ecc5365a27ec46c
SHA1 d9da0bf094ae8ccb6fa65060bead17be61e5986b
SHA512 0f576cc0872ad2bf64a992a109f691584da91175ed78a97bd6293dbdeec1ac05728c112c8a20dfbfebb5872a17c6448f459f05d4b058d04c7f75de8581e198e0
SSDEEP 49152:ua0h2GEkuAe73q3pp46zwwQc/snji6attJM:ua0hNYG4Jw7EnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 865d22abb7bcce9e2dcbb1ee40fa5e255e6a2116b7f71aa62f513302682c1faf
MD5 9512c79ca49178e3cd37d9d9fbb597dd
SHA1 7347d70a06c072f98f699936f2a9be56aab733cb
SHA512 a747a7e2232b835d3b83f68152cb60e9b1101a9a97dfc4b07d91e12b19716dab2cf479f2f7fdd5f99ecdb8a99ea8408eaa0ca672a4e73ff410b65a5878fbb92c
SSDEEP 12288:4hbHjfXKGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:4hbHjPNt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 5cec834556f164f123d87c1b97e03d2a96bf938986e2b6f2ce04f44076c831fa
MD5 472143f7fb92a6e06655a65a7a415678
SHA1 49087363c828daab73bc52fdcd1026abe23596a5
SHA512 4f1ce486d2f8a702ee13e9e991bd4553a7dbc54d4dec4cda454f1f7fb65a837ee8657ea421f72a1994fbb5281563dc3fe3f53e6dae21bf8aa4030c4edb92aa29
SSDEEP 24576:i3YgnJcRTk4yti+R5dpR/1t/sBlDqgZQd6XKtiMJYiPU:iIgnaTk46ppR/3/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 aa538b082ef30c9bb3e164b51b45fee01f1a227524253a8e1d00b412fb49674d
MD5 b18f2320eeb714975a8134672402667a
SHA1 e297b0a8d6da34c9577917e59dce3a6717229f61
SHA512 f27c8e87cd419ff74cbf20a376402546150cdb9d16b56debfbe74a60913a86550c4a7438940a81878c6eff43bd3ecf59929347485c3a431e5ad1530cb9d42da0
SSDEEP 12288:DdGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Dgt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 a3ee4c88f3d068a6a117f799e507c5382feff869255544fd4f446b7820f4b6e7
MD5 61c1f4d112e8206382bc9eef84924b52
SHA1 52669685d66918e76fc8c1260de6f66c630f7e6b
SHA512 7254d8d8ef9cdf015b541f2b6b3f75068fecda13f1d598970ce689983db3594abaa83880d3ce4f64bcbbc730da84c8e9d8d1ddc3a78f7110bac866bf8632a8b4
SSDEEP 12288:4ObvA4LWOsvAYFTAGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:VrL3UTnt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 ddbb9a2873f59357134f795f153bca0f8ce14a3be0a18cd3bd105301c13ac125
MD5 0a97c68bdbbcc6d76728d313fca18386
SHA1 1054ad6d0e46ab6aafa30c783130569d38bdee3d
SHA512 fe4fa9ad2346309eca4527595148f5dad7cddd7d7d72d8168d174304d56e08dae5188ed2237e7ffd4692241587aae821aeff32a98da4ed7ab44099472a829a25
SSDEEP 12288:FpFtYOEGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:MOLt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f3b41a7f65d0f1bd4253bf637755de6b619c9a7459b76b59d533e6562aa32102
MD5 c5bfaa3fd10c66101fc1d6a52c7f8e09
SHA1 8446cddf2554458e8cb51258eb26bb07a34cd49f
SHA512 d6bf21724940f02c2ecbf3f8b44347288005736d1652569d423a2cf459042710557a928faab1067d66c774733dcdd1d841b49b0ca2df4117eb8c9ba2296f45ed
SSDEEP 24576:+7NM9YmZqmWMUkPjZM48Mv6bEhsMt/sBlDqgZQd6XKtiMJYiPU:+7cBWMpPjN8DbEhf/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 00d84a3b9ecfad63c996b955507244b7ebb23a8dd2c314f9bdfa6bad9bc99022
MD5 53646b39d43aca65b87b80d557abc36b
SHA1 378c3860eb200e1bcc4f444b2591316b7147b785
SHA512 90e30405a30ea9a4483f1f2d3a0d959ab724f1a98693ae94ef7d9aee582e7ca12a47618c8cbf6e61bf51802e11bd01db950621d6e54ea42c8010a801ccf32ab1
SSDEEP 24576:pW6BApg2YuyuNDYTabvcRvNYf8km1Ct/sBlDqgZQd6XKtiMJYiPU:pF2YuHNETovcvNYf8km2/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 45e1347201138c8ea15ac2f23e908fc042bbd9ca723f44590efaffd507637cd7
MD5 b5cbed37a53d08e0be833745441bac59
SHA1 602befd88cc86cbbd311bf8ec5dcb130e4be2f1b
SHA512 0a38d607ad939fb7f732226480a26ba455eb6c5fbf122bd0059be2f43d9554de07a423eb093adee227f73773259da0054da0e94d435414f5d4c22fedb778995d
SSDEEP 24576:gAFs06+OmlfQNXEbTo/t/sBlDqgZQd6XKtiMJYiPU:1Fs060lcXu8/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 f2de11ff7386a01290007d95f0c465527c1d163f7d327ca1a81234b3c95146fd
MD5 200c4822cfc5758b28e55b47286e44dc
SHA1 cbf41a313940468357db2dc473f3774f4cfbd977
SHA512 7118f96ddee56da488bb08319c37234d28d79493f29f0878174c44f8b3f4aab3eeccdda30c6141b7f3b3eb1a03d5b10f053ceced16f6422eb7930112c48c3b96
SSDEEP 24576:hJnJ5D3WtWt/sBlDqgZQd6XKtiMJYiPU:hJnJ5DGt8/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 75314f53dd0d3588ae62569fdc50f637fa11ea0ec945fe335da616c827dcfa22
MD5 00ee7a5ffc6ee36cec5d344df845bf9a
SHA1 8fdfc9f023e0ab912978164658a046a63a832080
SHA512 58cd80ab21b90f58f2300a5fea78f181ba6ca696c51a8db6b6a99766ba9250284dd337466b1ba8cc77849a3c42965e0b962d62110f6812b21abb4bf317d2b4a8
SSDEEP 49152:Vo06DIKdwc+eQnSt65aVS/snji6attJM:CYEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 e2278e354a22a23a5f8af794ed47074acfdd1fa4a94df0d70c95c334cd8792b8
MD5 c4756945abc246b9d069bb8625651bc6
SHA1 bb3e33cc1861f87a3b7443cabb51379c4645900b
SHA512 33781493907c9925ed646eba29ab45c0cfcc7c10e2e6f13eee2ab660d3fd025a49d2a13960ba92f2a68ea4e1655cec78cc98ce302ee33ca81435c9407cd18f43
SSDEEP 12288:TEP3RrLGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Yrat/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 59d5949273e350d1f7e41a65006464ea36d528babd5a334f969b9a47634031d1
MD5 f1dfb1d848753a79ea47a94107b19485
SHA1 5f914fda51cb394d9b9781116f5cb7924d750ab5
SHA512 5bf5247206145ce9b684eeb7b151760bda01abfbafa690c66c3d5c8741f0ccafddd03c04f10c90eea57fbb390a966870997e57900f2df44bdc5477a27fa789a2
SSDEEP 12288:Jjky6Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:JIydt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 469b2c59ba908dfe48d97f32e642812d8346066bc46f722316efeff1cbed79e9
MD5 a4c25853905e1667f1415528c1cad820
SHA1 bf4f86bac788e5e2ad434fed2675ece33248be7d
SHA512 61ed31682f8405d7f17abc3e292d0dbc87f7555ae12e13721ff603fd81c7f39ca1404aa3fa120924a49bbd0dba7606b7f8fd96213be22d80549985bd76cd50e1
SSDEEP 12288:jF0Gt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:xbt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 3c678cb5f286c6f6565a40f3c391fb8a893c3f31905f2e1be47ca7bbe1f4f041
MD5 05aa91e4d2e22869280a8a951f9f2c84
SHA1 0622bc2e82b121d4a549504728a086afcef22979
SHA512 3e849b5d4d6ea3a7c7b59114b05be71c2fb46cffce59b41404f1163be5adecdd6c36b27f4abae53429a384f6a5eb7237040ea20abb2b745144b37f2c48ff6db4
SSDEEP 24576:pQ9MxZKdcz97w3Et/sBlDqgZQd6XKtiMJYiPU:pVKX+/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 821378e1138fd029d6d74f37fdd6b71266a221fd6c8ad6142b77dd38cf36a416
MD5 9c5037b70a1cfcfed7c0fbe46847a477
SHA1 e1d5caf6158f24c049588cf9903c7e8e066dfc94
SHA512 3a7613a19e7c5ef7a511197053b0957be4731556616f0b7e533a9deecf12ec3e61298370028561c5a5818605b06a0dcb99331a22d05aaf32cc3d0f4e310df00e
SSDEEP 12288:kyoKo2HRple9peGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:kyocxApRt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e583f4e9d3179461e8e5c57e23a24c451e023a32d7cb1fac04bbbd06fe7929c1
MD5 5d631d4f91506fcd89aef1f0e85fdaf0
SHA1 748b5d4df584747f1ae3662968ed05c9690f7a28
SHA512 f28eda3e0e8b3a44893eabd73278787c3898a17340a03291220369446b1c80fac265b6093c03019e718d1ebfef6b92e9c2ace7ae181dfcf9f4e245810b36efb5
SSDEEP 49152:WWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKj/snji6attJM:g0zuNInEnW6at
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 57a63410b5d64e8079ed4f3381ac9948115115352035fba30e76bf3ccc0cad6a
MD5 ece8975f763a1e8dcfa7ed839aa85c06
SHA1 60defbd619d4dc44004bd85a59da1a3311f1bf48
SHA512 20a356e14dc258013c211ba3705b0ea083fea08c939ec0b27fe53759026fc21b4f99b0b2f6f7aced17b8881a8a27fa431e30442945a861a6ad7bf26b247eb6f4
SSDEEP 24576:s1QT7EcpfxR+N5AWAz3ooiYsjMqbat/sBlDqgZQd6XKtiMJYiPU:xTDxR+N5YzTujMB/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 c574bb36cc43ff0550a913974cdd3695ae2dd5ffb921adf04e7f5987a684906b
MD5 c83b017036e1151c7e0104c5356bd6cb
SHA1 ed5bff654dd7fc2abde089e790721572472c0948
SHA512 4886db06a19f9db001e2d98216df1f17310b1aca20c32a98b5f93cb42b3182739b1b0b0c59dc013c02ee20abb4ec94de7fb40b9428f4ae5e56b07bc068d84375
SSDEEP 24576:RTMdOz0FFS+hmSLut/sBlDqgZQd6XKtiMJYiPU:b0K+hmSLk/snji6attJM
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 c241a16f4e8d8475b6c291ce492638284d14b1da7afdce001ef591a51d42172b
MD5 749d468e1f9d230f95bd506bd1499f1e
SHA1 869e38e2bfb6f0230fd47f12c1cb97e13fd1c4e8
SHA512 737498eff84fa619bc18544f845e6b4c6faa08978f955835beb121768ba6ecc8d4619ade62a3bb5aa39f63f1630f2ddd0ec0d43539a31fcf076240691ec0dc08
SSDEEP 12288:847AGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:rnt/sBlDqgZQd6XKtiMJYiPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/232-232-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/232-511-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1068-475-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1068-197-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1516-247-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1516-125-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1644-452-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1644-173-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1648-55-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/1648-49-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1648-56-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1648-172-0x0000000140000000-0x0000000140234000-memory.dmp

Download

memory/2132-35-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/2132-27-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2132-33-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2256-45-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2256-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2256-40-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2256-111-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2432-107-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2432-231-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2580-273-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2580-566-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2756-123-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2756-235-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2772-560-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2772-236-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2796-0-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2796-69-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/2796-9-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/2796-6-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/2896-217-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2896-220-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2924-565-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2924-260-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3644-248-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3644-561-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3900-208-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3900-85-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3900-87-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4292-259-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4292-146-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4348-72-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4348-78-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4348-84-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4348-81-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4348-97-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4420-471-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4420-194-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4496-149-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4496-272-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4496-564-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4720-60-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4720-66-0x00000000001A0000-0x0000000000200000-memory.dmp

Download

memory/4720-70-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4720-185-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/4868-402-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4868-161-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4920-122-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4920-21-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4920-24-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4920-13-0x00000000006E0000-0x0000000000740000-memory.dmp

Download