Analysis
- max time kernel
150s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 18:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
28 signatures
150 seconds
General
- Target d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
- Size 10.3MB
- Sample260417-wp4ckaey3p
- SHA256 d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0
- MD5 ba1129638f42d801445d20c4ab2c9243
- SHA1 1efd924397785bafc8021cdebdf759d95d500316
- SHA512 8924080b4c76444079e2ef9ac0b3b7c666cdf3919ac355d447f29286aab41e4217eb03dd9dedea50f297c0ee7645892415bf83c3911a356d089a4d758b5fc67e
- SSDEEP 196608:rKXbeO7xDSiprAHRmAyWIPbuGuibcrli8F:g7Y8rYIzrn
- TLSH T1C5B6AE02719440E9D2A68175CD568A6BDB75BD250BF142DF328C6EDA3F322D17E3B322
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/4740-19-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/4740-20-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/6108-28-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/6108-27-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/4216-34-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/4216-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/4216-40-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/4216-41-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/4216-33-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit - Gh0st RAT payload 10 IoCs
resource yara_rule behavioral1/files/0x00070000000244d4-5.dat family_gh0strat behavioral1/memory/4740-19-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/4740-20-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/6108-28-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/6108-27-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/4216-34-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/4216-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/4216-40-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/4216-41-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/4216-33-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe - Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240667000.txt" R.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe - Executes dropped EXE 29 IoCs
pid Process 5028 R.exe 4740 N.exe 6108 TXPlatfor.exe 4216 TXPlatfor.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 2332 alg.exe 5984 geek64.exe 6076 DiagnosticsHub.StandardCollector.Service.exe 996 fxssvc.exe 6060 elevation_service.exe 5548 elevation_service.exe 1188 maintenanceservice.exe 3528 msdtc.exe 3728 Remote Data.exe 3896 OSE.EXE 3448 PerceptionSimulationService.exe 5112 perfhost.exe 3916 locator.exe 944 SensorDataService.exe 1276 snmptrap.exe 5924 spectrum.exe 6124 ssh-agent.exe 5668 TieringEngineService.exe 4120 AgentService.exe 368 vds.exe 5824 vssvc.exe 2384 wbengine.exe 976 WmiApSrv.exe 1244 SearchIndexer.exe - Loads dropped DLL 3 IoCs
pid Process 5028 R.exe 4700 svchost.exe 3728 Remote Data.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 37 IoCs
description ioc Process File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\system32\TieringEngineService.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\AppVClient.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\SearchIndexer.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\dllhost.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\msiexec.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\locator.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\msdtc.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\System32\snmptrap.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\AgentService.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\System32\vds.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\wbengine.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\vssvc.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\SysWOW64\ini.ini R.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\system32\fxssvc.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\e0a0194afd664f35.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\SensorDataService.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\SgrmBroker.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File created C:\Windows\SysWOW64\240667000.txt R.exe File created C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\SysWow64\perfhost.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\system32\spectrum.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe -
resource yara_rule behavioral1/memory/4740-17-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/4740-19-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/4740-20-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/6108-25-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/6108-28-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/6108-27-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/4216-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/4216-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/4216-40-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/4216-41-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/4216-33-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/4216-31-0x0000000010000000-0x00000000101B6000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\7-Zip\7zG.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84265\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84265\javaw.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Remote Data.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language R.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPlatfor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5180 cmd.exe 3252 PING.EXE - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c267120995cedc01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000802b170995cedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e77630995cedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000876ad40895cedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aacbd60895cedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008517230995cedc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097c8140995cedc01 SearchProtocolHost.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 3252 PING.EXE - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 5136 d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 5136 d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6076 DiagnosticsHub.StandardCollector.Service.exe 6076 DiagnosticsHub.StandardCollector.Service.exe 6076 DiagnosticsHub.StandardCollector.Service.exe 6076 DiagnosticsHub.StandardCollector.Service.exe 6076 DiagnosticsHub.StandardCollector.Service.exe 6076 DiagnosticsHub.StandardCollector.Service.exe 6076 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 3 IoCs
pid Process 4216 TXPlatfor.exe 672 Process not Found 672 Process not Found - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4740 N.exe Token: SeLoadDriverPrivilege 4216 TXPlatfor.exe Token: SeTakeOwnershipPrivilege 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe Token: SeAuditPrivilege 996 fxssvc.exe Token: SeRestorePrivilege 5668 TieringEngineService.exe Token: SeManageVolumePrivilege 5668 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4120 AgentService.exe Token: SeBackupPrivilege 5824 vssvc.exe Token: SeRestorePrivilege 5824 vssvc.exe Token: SeAuditPrivilege 5824 vssvc.exe Token: SeBackupPrivilege 2384 wbengine.exe Token: SeRestorePrivilege 2384 wbengine.exe Token: SeSecurityPrivilege 2384 wbengine.exe Token: 33 1244 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1244 SearchIndexer.exe Token: SeDebugPrivilege 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe Token: SeDebugPrivilege 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe Token: SeDebugPrivilege 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe Token: SeDebugPrivilege 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe Token: SeDebugPrivilege 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe Token: 33 4216 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 4216 TXPlatfor.exe Token: SeDebugPrivilege 6076 DiagnosticsHub.StandardCollector.Service.exe Token: 33 4216 TXPlatfor.exe Token: SeIncBasePriorityPrivilege 4216 TXPlatfor.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 5136 d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 5136 d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 5984 geek64.exe 5984 geek64.exe 5984 geek64.exe 5984 geek64.exe 5984 geek64.exe 5984 geek64.exe 5984 geek64.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 5136 wrote to memory of 5028 5136 d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 84 PID 5136 wrote to memory of 4740 5136 d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 87 PID 4740 wrote to memory of 5180 4740 N.exe 90 PID 6108 wrote to memory of 4216 6108 TXPlatfor.exe 89 PID 5136 wrote to memory of 6092 5136 d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 95 PID 6092 wrote to memory of 5984 6092 HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe 97 PID 5180 wrote to memory of 3252 5180 cmd.exe 104 PID 4700 wrote to memory of 3728 4700 svchost.exe 106 PID 1244 wrote to memory of 4736 1244 SearchIndexer.exe 125 PID 1244 wrote to memory of 4828 1244 SearchIndexer.exe 126 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe"C:\Users\Admin\AppData\Local\Temp\d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5028
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3252
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exeC:\Users\Admin\AppData\Local\Temp\HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\geek64.exeC:\Users\Admin\AppData\Local\Temp\geek64.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5984
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵PID:4688
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240667000.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3728
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4216
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "Remote Data"1⤵PID:5916
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:2332
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6076
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:5076
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:996
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:6060
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5548
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1188
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3528
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3896
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3448
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5112
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3916
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:944
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1276
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5924
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:6124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:2420
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5668
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:368
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5824
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:976
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4736
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:4828
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 be517204311b9e9c244ebd346ef1cdfcc354bb4ec58941f1c9b2979ffeb3efdd
- MD5 9ac4bc6ac3c374ff9c176e0deca650d4
- SHA1 09936c085b4652abeab5075cdcc230f8f82750ca
- SHA512 cf17bc7a6ab00a043df7d89f2176fbd9ffdd42eef86abf5f354b2035e698903cc5f1b6368bf0dcc7628ef5ed902d25961393a89cafa091a0113c5ddd7efca20e
- SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnZN/j2U4FH:K3q6HjByj2jF
- TLSH T192D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 e914938ef265228af55f74438c76241bb524710f1a1d636158ced78e6f694b81
- MD5 ebe4d7f855faaeff48bfe14ac86b441a
- SHA1 4790d2484ab8d003ce718ea678b703f64b5d9b29
- SHA512 dbf519d0a3e0c08d378dd5b43275591908d60f937a54cd8c477e843f3b57f328fa072890b3a851626bcffa8933b800ed176b231154c472d511940e81df29c9f0
- SSDEEP 12288:g1XLsswWkxy2lRq2czANJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2XYfDtczAZdCN/j2GLl3iFSE33b9
- TLSH T12D05F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 3c3deb4d635b604e6e73ed1f5c139204a57446526702e308e147877f807046ba
- MD5 bfeb89c8e8da3c58fe8a957f21081dd5
- SHA1 8ada134436eafeeef981b65416c9809379568817
- SHA512 00044c369a7d83d1bc13824212a1541e410b1c08cf0436075d552ca0d39f0ef7b7623e67a5889d77d9d5e177c5d86b9f05f7dc3db4921d5b2a51cbe76a238fec
- SSDEEP 24576:e0Le5ji0hmxirMedCN/j2GLl3iFSE33b9:ePji0AcQN/j2U4FH
- TLSH T1BA35AE26F6748335D073C0B9C5D2A69AE97130855B308ACB4286D77C3F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 b0e00c02629343353bfba98d3c5bd3f4fa91ddc2df5667b5e41576e0c6ffd1bf
- MD5 60cb169db2299eaf868629027ebe5fa6
- SHA1 a516913e95594add7b722b5129b43eeef1f9ae63
- SHA512 e7335cae29b57298a2f60b55d574231d2f4752ae5b7c73b8a60b4ceb39ee149119a894ff81e842a5ed4f5fec772911ca42a73954fb99ed8255daaa2770135aa8
- SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWE6q8wyu8dCN/j2GLl3iFSE33b9:P/ezSC6vUzPvxHjy8N/j2U4FH
- TLSH T1A6755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 59492a390badd5d0b190fe7d21e76b61a856a3f20a10dac931be926f2141d6e4
- MD5 f6ac49134de3b52c82a61a3b47b611fd
- SHA1 e68a13e4031f1bf8df8fa213ed9edf0ff85df465
- SHA512 2dcf7c2f7ada8b9ad9e4eac51bb42302fd057775a4c4ae5df056066101e7996ce81c73ea607abb3b3e5e88e048f61312b3ca3dc21027322e737b0ae81627d87e
- SSDEEP 24576:kVbqPb88hv/l+69dCN/j2GLl3iFSE33b9:kVO88hXl+9N/j2U4FH
- TLSH T131559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 12ef977e85b64bd822d6b7b17830566d73f70ae6ff470a8d94191895fc3200e2
- MD5 6664e87abb5cf79522c345aef5f2e432
- SHA1 3a4ff29d7ad7e9907d67d1c783a2b2b608c169bb
- SHA512 e49c8b1cb20114f8bb8122356771fd1eeec3388c3a92c48260f69baf7b7cc62b6dcef5304e036c9a757a27000410110ef984f1a5b70f9a61ae3b71be034b3934
- SSDEEP 12288:YR+JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHL:YRydCN/j2GLl3iFSE33b9
- TLSH T17DC42360DAA5B565F66F837903ADDE615200FEE8E525884786917BEF127CFE8C033063
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 0e956c2d19d00aaefd54b45ddf9a1538f482cc18a0bd12d862b845b1ae26a031
- MD5 3a3fdd8e8aecf7450013cf6e71f7db4f
- SHA1 fdc41e49b28e2aa6d6ac98e0ecab84c4fb3fd730
- SHA512 4631f532392f1578341176dd962bdd6545d0e432ffc1322efe45c0356c24047b2a2dc805466c6dc6096d97f495e7bfd483a61cae9f5b4002ee9ed13b91517d63
- SSDEEP 12288:+eBNUbTVO86UxJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+JIUFdCN/j2GLl3iFSE33b9
- TLSH T1A105CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 010c99f02122caf2d385ae258046b5bd9dd490015e441d1c2385fe9bd3ebe7f0
- MD5 ed959c2fbe357d003cd37274752c2993
- SHA1 6b79e2d78848d74dca04daec64f467b6a8898c75
- SHA512 2b0485c7e3aa1549e131a2a0fc7447383e18e5e0cd7b2d015a8cfff8fcea6db8a602bebc51f999695378370c8216210b15d357b53adb1b137be40a3e44baedf8
- SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THr:DQvGAdlCEL8c/yRNw5Cpj2jF
- TLSH T111267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 f3eb7381875c79f367bdd7051c0fb40a48a8f411d10b6cf949607dc693cb8871
- MD5 2804a780962bd43eed8e5e5894e471f7
- SHA1 42ead669a7667724533533371d66a0fa23c86116
- SHA512 e0d76c92a58ba4dfa3f387495ab1bd23b30331734e6e594961173bca055d02c49d8836a57bebcb9d5465fe002362d5775eced8141206f8d2749570926999713b
- SSDEEP 12288:xAwSfxL/2Dc34DLLmt0LDQewsAjbJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9g:SdewsAjDdCN/j2GLl3iFSE33b9
- TLSH T1B915E031FE74E036C2BF0DB61B35C716142CBA608B6119C3E3E85E9E59346D26376A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 4fc7b1f9c6a2f860c14674a7aaf974716f4319cd09ea9c4e5ca00015f7f8d52e
- MD5 e16019065e3a332e8a6fd8673c992eca
- SHA1 597814a39cf068e0840436cd281d023ce3344318
- SHA512 022693fafe3e3f5bf34676f90d7dbe11f419266f65ed57389732439edfceed65c7722cc3c54cf2fe477e1802d07a1f98ef6f8ac8bb2e3cff20623645aad99c51
- SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHE8F:RUEtQevvqc2W1cpV2EI32E
- TLSH T15C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 5ebfe623251ff8d4ec07754628dba2a66129b919c29fa2f7567203cb1b552a78
- MD5 a95262dcf35f5db197b7c5641b6ff1d9
- SHA1 8e8ab9c6ab797638fdd5bb505d4b6ab9c345674e
- SHA512 61a7320760c5d382b12182097f2e911e7f06caf263937c1caf6b3075ce978faf9fa7b6c4df40ad9dc4db85cdd535ac950267060ff03fdc52c351102ba2ae6eb4
- SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/zgN/j2U4FH:xoqtVjnmNj2jF
- TLSH T18FD58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 94d359d3fa5061cffa10a7e15a21a5aad02245b3f30ed809fc1449ecfb9f61ec
- MD5 cdaf3644b730eb4bf8a71fd41ae0fc4a
- SHA1 b8d1151cc1c7fcb2630997b8bfd10a1c8401c4a9
- SHA512 595ec0b92e87e3d730d0408b92383c36c5a83359b44031ce49e8c0904f005b285379bcff773481c1e1f568796b0d5216decde4e08d74443e002f1c6c3ef989f3
- SSDEEP 24576:tAhGLJIFoiwtA5l7S534dCN/j2GLl3iFSE33b9:tAMyFoiq5zN/j2U4FH
- TLSH T1F735AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 a666e98b4d40942271673b1a3bb9dcb96b99fc60ddc43d5dba1bfd0cb8e60151
- MD5 2a74ca5435fdd80d53fd048efd26aecd
- SHA1 8fb670f40f98aa006861a486a5e406aedffcaed1
- SHA512 74927ceb856f60b64fb735767a35ab6b66073239c88bad614f71b2395221458aa16e5e18e6c1dd76a0b7eab874c8802ebe7b8b750414533ab6600ac54aa611ad
- SSDEEP 12288:amw5HEjsChNVBFgl0WDm+CUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:zwuoOWPdCN/j2GLl3iFSE33b9
- TLSH T16805F14576E41CF9E96782398697C536F7B2BC512A21CB0F0360C79B6F37361AD2A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 03076721c4cdadb4fc338b72d37fd697cc0fccc97efaabab422f1783e201cddf
- MD5 8b959cea0f4af32d9f420961372e2009
- SHA1 117d35f31a78165a9985f31cbf8cd938d7b806f0
- SHA512 c548f3446fb50e3127a5d753aa5590e077e3aeaaf5ef6932939fee3524eed1252cd49732eee1e7f553a3a3fb8f305513aaeeefb09fb36f0b9c184401b8fa6588
- SSDEEP 12288:9BZ1IyrJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:bZuGdCN/j2GLl3iFSE33b9
- TLSH T14FE4125933E471F9E1A7827C8AE59A05D321B8A5A73243CF026047EA1F36FD59D36332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 04606a28fc86c602bd959c403eaea4b91fe4c73c2a2f43addf2624f8052d35ec
- MD5 2ab06999b3b8361165883bf4181ab8bd
- SHA1 cac264c84fe26a4e76e7701bb76a2723725d73ad
- SHA512 cbe6f058ba4833103df19471a0920b625baa68f193c8f877be30a29afdfbe6ce87dba292350cea1be81c448b4e32353853b52b41c4e2650269e305c3e5afc8db
- SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Un:yQRQyi36YOcPQLvw2gAf+PN3Oj2jF
- TLSH T19D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 b0fcaabf6256c37d797d004ed113d4ef23b6f69b1e21ddda28000bb8f2e3849c
- MD5 7719195f2fba5b9c50f99a3890dca4cf
- SHA1 aad17a26d52844d9af4803a96e14cb817b8ac9e0
- SHA512 7a8f9675680b2d4ce55caecefd4ae92dedb4a831a4ff2c9c3aad5600b1832c90ef37a3e5b65af75a5f6927565c4ddc47b3a967774dc36082e67339a6a0c8643b
- SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Un:XQRQyi36YOcPQLvw2gAf+PN3Oj2jF
- TLSH T187667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 e8897391abffe70ff1bc838ac7bd624ce427dff0e0810e58d3f1a9e1b420b31e
- MD5 6b4aff8de4b552a34e8540600f24399f
- SHA1 708438b45c74ec99d3703e973f1e26d9348c28ef
- SHA512 bdf79359779b1a68853541f3dfe94c6b7ca56cbea4b1f33a4ab1c5b6f6fa84f63af4f3da1878d2d53dcf0d33147c1f08b4db54483815435de83c41510dc1cfb2
- SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0WdCN/j2GLl3iFS+:068Qg55nhheWu7PNU3/QN/j2U4FH
- TLSH T101B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 6ee0582daed1089e0b59b55f8f034747fef3229e2fc6694d3c75158d04263e1b
- MD5 a9533ae2aa98a4df7d4453b5c1e932da
- SHA1 26374b21cb4c1b9b125979da52e88be80b4fbde5
- SHA512 1cd6d2cab4b3b49beadedc2504e1edf3e692f9aafaa6dcafb0a52055d9cd133ceed745d33b7e3f22746e93c643b77705747c00bc0a263e435bfb2c6f9ac3d2b6
- SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99R:ry5112gYy5azzVvL69nLKnhZbj2jF
- TLSH T1E4168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 cd1eaaa970028e823fd78a0db85f008cf46b8fbad9bb755a602f8e63ae6ed768
- MD5 c2928afc7ae696247f93acc6132dc2e1
- SHA1 218ed66fc95ef58c0dd7938386616b3d66347c07
- SHA512 976bc406bc4293220eef4d58c762332de826c27ad704fd0c12e02e9c0e6dfaa1381141e0b9a0ffa87fba3891311c37cf8b35d0becc902dfe0699f888b763e017
- SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl+N/j2U4FH:Tu6JmVxd2dmj2jF
- TLSH T107D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 9269a04d6134d7c23a2e3bee9573c1e59a4ab0ed23500cdccc8993338404950f
- MD5 7876a94836160d50ba99ebdff2863cf4
- SHA1 dc2466dea9233d61ee594c6a92dceb6b2e44099b
- SHA512 f6f915e41c7d20cade35a60a502805460b6db7e0403a426e3043ee1a2f7d747eadbdc50aac0ad871b06d82286dc10651fa0d2e966823a04ef80b67c764d9e58d
- SSDEEP 49152:s1hpsNoJpF1A6UU44CwH7R4xaN/j2U4FH:smifPbRNj2jF
- TLSH T1A0B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 7080fce5fc569854722dd8f39f9573952938fb200e097480cf6e3294d45d70ad
- MD5 de71cc1a82c22f24f6896e7ccaa2541f
- SHA1 5cc11520080c6716c63b82225b6542d4ded19528
- SHA512 504f9b25f8d0f7e94ba2bc7afe03ac8766820947fada38b8ad092e70d7003caddf8cdcf68b049f6c96289af54c52ef0538db813c2a0bf2c32f3aaace08ff9717
- SSDEEP 49152:dSuZQIY0Be2KRRVtOnks6NMHqJN/j2U4FH:z5dKTi61Hj2jF
- TLSH T1E8C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 eafbde42eabe9298fd927bc4268554a6cb236f66c3c9af49d75b0fcbbcd0b97d
- MD5 40fa5b25b5db3676589a619156658284
- SHA1 c37b892f2e4e186d1bce3262e0eded8ddc0044cb
- SHA512 2a3c2825d85b4f966eb106e78a47e9e86bf0d43ca42644dba75cb0b2c65a60d2a5f6e24ef0f2b8afdcc6ae0b1bc0b2d38ec92e45d8db5f22c81a6fb45267bdd4
- SSDEEP 24576:GcP4mcvIjkGOxhKP2l71nNKbrh/8KBudCN/j2GLl3iFSE33b9:BP4m4IpOO67W8KXN/j2U4FH
- TLSH T1A165BE2DABDC0096D0BB817886658A49FAB1742E1F3286CB1160937D3F77EE54E35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 4cbc49b8818819418befd537da79cabd6c53e42b6791f3650c837ad2a3d36916
- MD5 6b16aae84ad58af44b30ca45f039a5f5
- SHA1 bde90182dc39d36021dcd354698a857ad9c12cb6
- SHA512 3a9261b21a9e524cee40333e059bdcb277997899345b29302d7bc587a60d6b9f276dac39000e2f6baf4df6699fe506c80a6a2a4cb7d499c131908d7584f1ba98
- SSDEEP 12288:MNsf6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9GdCN/j2GLl3iFSE33b9
- TLSH T133E40119D2A412E8D06E9279C7558A41B3237CA493E1C3CB43C0F5BE1F7AAD49DFA613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
- Size 2.6MB
- SHA256 c99202c85a90c48be2ae5f36c2018a292e6b3782f0f58a308c6023e4924dced3
- MD5 a760f4dfd08373e93dec546d5f9f0df8
- SHA1 4968dd95af3b90cf3270349150a6a4229564db14
- SHA512 65817ff112881e562a9ceb06a4dfc06391bf0a2da75d73bb0314ee8626ed14093aa486762c3416633c1c73357ff2ec11de1cffbce3d63f997ed3a3b5edde7485
- SSDEEP 49152:eCwsbCANnKXferL7Vwe/Gg0P+Wh3Dhs9R3ipD:Zws2ANnKXOaeOgmh3Dhs9R3ipD
- TLSH T1A9C57D43B5954972C7C84971DE67DAB39F207EBE57F306367A48FEC83A352047A22224
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\HD_d3414ecefb94c759d223928eb377ee2929b7f34a18fc63159bfee94028e1d4b0.exe
- Size 7.7MB
- SHA256 204685e16518ed94499cb86c36a6f56086dbf140da0b93e169a4de5f8bc6064a
- MD5 f968ef5dc7befc57acbf4951e8574f07
- SHA1 ac76d093a60bc4cd612db776d2fc8ac4528a5c3b
- SHA512 05357bce26dc29925194595d3d9a1f9afd0b1b370997aa4d38dcc15ac7a13e37236660a3c2a695288bb252063f910099f38185f2c993ba59373840ace1ac5db9
- SSDEEP 98304:TCbAI4Z1aQ9munyWIPoIQd84vGyBl1IlbcrTLNij2jF:kAHRmAyWIPbuGuibcrli8F
- TLSH T185869D1272E840E8E1778179895A8A5FDEB5BC121B3152CF329C5B1E1F376D25E3B322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\N.exe
- Size 377KB
- SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
- MD5 4a36a48e58829c22381572b2040b6fe0
- SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
- SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
- SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YHL7:HclcceBKlKwAg0Mja/UafOVwbha
- TLSH T152841241FF520127C74AB0B5C9984E7F8E7A03888E650C3A7F795E4E1B603EE6923D59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\R.exe
- Size 941KB
- SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
- MD5 8dc3adf1c490211971c1e2325f1424d2
- SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
- SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
- SSDEEP 24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw
- TLSH T105257D43E6765C93C3CC4836CC7AD27273217A5CB3F79636B180AAD7B6B52603D2065A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\geek64.exe
- Size 3.9MB
- SHA256 015112af2494029eb1147a06874cec0849dca39da579793c5c09b000bd01cd08
- MD5 950d3aef9da61bbe942ae38a0c8f558f
- SHA1 45afc1822d48f973bfd9625a19d8b715e2b86b69
- SHA512 0d3044e0d458a7f7cedd993bba30b3e15471dae12d4e3eff1d3d6665bdb80d917994df388268579af10996fb2ba868a3a401718d019a7fdc3c4199ee68e32743
- SSDEEP 49152:JI+KyzNG+YyXYAj1K2ybW5KpP2u6+20orTNElYMuDfmyZjDpukVzCtB:yyBl1IlbcrTLNC
- TLSH T177167C4A72F801E8D1B7C17D89468A0BEAB2B806576097CF355C4B5A5F376E14E3F322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\240667000.txt
- Size 899KB
- SHA256 4d2073105b61dc78e3a3dc61af942f1de94a53c7a6ea94d6488a9c8391105764
- MD5 e2a04f13f44b9ef7086de9de977dd758
- SHA1 a539b7fc72284faff547e4816206b4852bc6a77b
- SHA512 b6461b0f6773844d202475eafd84135852351a6ae9d4c5927b47d8eb191ec7fbdb727317ad06463842919b1691a74602c0563e4dca79fa4fc214e0cdfdf6b011
- SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXq:7wqd87Vq
- TLSH T1F4152983F6B68CA3C7C90435DC7AD2B67B24761CE3F786327280E9D7B5B6251781421A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Remote Data.exe
- Size 60KB
- SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
- MD5 889b99c52a60dd49227c5e485a016679
- SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
- SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
- SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
- TLSH T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 f6360cbab4932172821181c053837a82ceb3a04587229decf721460383f015b5
- MD5 70b8bb0083661fe32605989da3442a1f
- SHA1 39d67dfb2f0fafb3267c45291758613ee9151035
- SHA512 54423507407ef886a333a4d0ecf05c2a709b08f2820ad67406530e2a5827ead0fee405c006e19969bd0eafc73d13520685b10d7f7b3aff503ef7bea8c74b0a0e
- SSDEEP 12288:DaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHI:DmdCN/j2GLl3iFSE33b9
- TLSH T174D42364D7E9B656F17B83780369DA356200FEF8EB258487C58157EB1278FE8D832123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 31046e9fe35b831515646b1c087f846d42b50f9d629313c2ebec7fe44a0c98c3
- MD5 6f48fd1197f47814ede5fdd1457e3928
- SHA1 76f319eabc5be5fbf36c5f4b3ead8195e91fc4b5
- SHA512 741b8b8c6981cb060f5f7f26b06a34d763626df2c450a096b9143209ebef5d782373318de5de544e24b8bc5d168fd10a3deae18b130e053eb0d0dc536bc337ee
- SSDEEP 49152:Ya0h2GEkuAe73q3pp46zwwQ7N/j2U4FH:Ya0hNYG4JwEj2jF
- TLSH T13A85AF1D67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37EE84D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 dc851c92102688883153dee60f0c91b50d54e0b757f57a24d2ec73bd94014e39
- MD5 4850f47324dd70cda8bcfb8a2d039158
- SHA1 246eb86be02772caf0985acff6481b30868d1c7d
- SHA512 f3564a2f54618e30a36ae6305ce01bf5fc28630b368c9dcd098ba88c311bdea3790d2852586239d9e361ae228d56f288a060c904a110d2ef0a36258ae6eb5dcc
- SSDEEP 12288:ChbHjfX3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ChbHjPXdCN/j2GLl3iFSE33b9
- TLSH T146E4027D66AC2199F176D27D86958A06D330FCA4572183DF43C182BE0F3BEE85C36A52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 fa66af3688c33eb45a06096e2651a992c306ea77ee39a4a9d4e42b8c82fe7765
- MD5 75cb8558cad27a1a3a7a6cb85414abd5
- SHA1 0789bc385f326f415b7c35e586c3ca18d2a06ebb
- SHA512 b5ad2c3de6b36ba835a52e23c7a0c1ab2b13c690d11944db34166ccb2c50645603b1aacda101181dcb5566d09688df654b8381e54778431e6633a9b62dfbb517
- SSDEEP 24576:03YgnJcRTk4yti+R5dBR/PdCN/j2GLl3iFSE33b9:0IgnaTk46pBR/cN/j2U4FH
- TLSH T13545B02DF3B910B9D8AAD236450147B5FB71782D1F209ACB0170C538AF1AEE85E35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 9fe1c898016f316acdcd6448cf2813e2d51937a62438e20942c3b1155cb312d0
- MD5 3395f4eb855748fd9ba467b7c4c01c5f
- SHA1 977719c63b0b261ff02b5e9a034dd7fdd6b7bf1b
- SHA512 e8db57b4bc2c9efc6adc6224ea910994c3f82b4292a96d038561eba609b7c1b5e42d2e7b4c3bc40460800f6986a4e5bf56c0740e83151e4b5cbe8b4e432b53d1
- SSDEEP 12288:BeJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:BSdCN/j2GLl3iFSE33b9
- TLSH T10FC42364E6A5B659E16BC3BD03A9DF216100FFE8E73645C7858166EB137CFED8032062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 36c84d8a4b4cd348dd92fef89191b507ce7c58435f7733870de54f1870ed59b0
- MD5 a547c708f722b0523a08dab1cb7cd5cc
- SHA1 f019598629d07ebaa5aeccfd5cf153bcb40d9cd8
- SHA512 aad140f849dc2c1aefb084db1e56d6765e477ad7d9e3540bc864c484f7f09684e1752699d76dc411fc96bd6fd64d9762b8c39b40e43ca46d1d9035e6138b7fd8
- SSDEEP 12288:AOb9A4LWOsvAYFTNJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:9pL3UTZdCN/j2GLl3iFSE33b9
- TLSH T13B25F154F7A410F9E96BC23CC5A68A16E271B89C1724D7CF03A84BA61F237E54E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 79ed21f50246de7a9c2ffb35e6b67f5c4ac563f84265e14029188de28b6e3a22
- MD5 e750dcefeeaff6f9f5de14fc38831e58
- SHA1 8aaa293264fdd07af2a9705b9aa763fee6474a8a
- SHA512 c842dd75bd2ecb57b5fb18af7fa9cc7c418bade46847e7f7b63726653018854f95128ad301928c9dd577fcef531639ee20bb6e67d4d923e8fead2455b356e59e
- SSDEEP 12288:spFtpORJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:mOldCN/j2GLl3iFSE33b9
- TLSH T170E4022936ED20E5E17A923C86968709D331B8A5572247CF42D081FE1F77FF89C36A61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 28ce354a74a80f30d2cc0ff73697b78d3dbb34cf10a21c9da8bf6b395832b529
- MD5 4b3908a242758ba54566f4e2cf7412e1
- SHA1 01a94b89182cabbfcd70e135a017ce4ed66b212b
- SHA512 e9953daf0c7e667571fa25a5a6ffa0f5b9b97ce4b2bda7476cde63cb7241b1d5fb3fe9249a9e894f2b13ef70d8f9145df4c0850d80944049675178fb2e24b0ad
- SSDEEP 24576:J7NM9YqZqmWMUkPjZM48Mv6bEhs2dCN/j2GLl3iFSE33b9:J7cBWMpPjN8DbEhkN/j2U4FH
- TLSH T18665AE2E6BEC81E5D477D13DC9E28605F2B1B4611B318ACB5162833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 81f729b7570b3ef78785d59bffce38e54d3b0fbb58fd1e6c2aeef908b8c71e2c
- MD5 c451fd58d0fb750e86d3abd6c2c6e9ad
- SHA1 3bc4de217ecdb7e0d87774fbb0942a2fd097c6d1
- SHA512 eb23a6a025327429b775c186b63bfbb638529960c4c848c7a71ffa5b5a69e9cf166aabb487f23e81d355d2cb95ca622bcc30548b43145456d8ba67ca914144ae
- SSDEEP 24576:MW6BApg2YuyuNDYTabvcdvNYf8km10dCN/j2GLl3iFSE33b9:MF2YuHNETovAvNYf8kmZN/j2U4FH
- TLSH T1A4858E2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 c494a9b8871a4e01c582158fa2812272d7b943d3df2aebf710d6ea69d2e923a9
- MD5 43a839e48a49dde7327b3fc1d437ae4f
- SHA1 10cc8284fa99722e829524461071829ffc54b044
- SHA512 a5209347158f94d122dc38032d88211bd7e6ac7b93b1c2e1818ac5a3403505b3d9d827734812c6849b40a934b90eaeeaa9b4fa9aaa83b6cfca329c7f1c093b12
- SSDEEP 24576:rAFs06+Omlf3NXEbTohdCN/j2GLl3iFSE33b9:kFs060lVXubN/j2U4FH
- TLSH T17665BF2F62EC00D5D07ED17D8A97C91AF2B1746307255ACB0260867E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 094cd52a980e0358f436636d09ee5688715dfe9d6ea3c0a07eee5082f13e88cf
- MD5 b574d1ccc7478896d189ef928b6a9299
- SHA1 f7381894d453d0423e509908ccf675b2de15ec36
- SHA512 3da1788eca32d01162d47338682d7be6360c33297b64165204db3e10905e87ad52fc3199648c2c019a0b070f4cd51cde42d201b7c38e3ae0287662f292c0559e
- SSDEEP 12288:qCJnJ5D3VkrDzxqJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:rJnJ5D3WXQdCN/j2GLl3iFSE33b9
- TLSH T1DA15D02CD2A810E8E4B7C2B4829A5B56FE71387D2F2269C718B4D5353F12FE09979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 8c66a4b2bee8463d354d55fb9aaf100512244ed78ec9b34d79923591771f2ee9
- MD5 5047a8c04e23d59383a66b224e59e1fb
- SHA1 21c61332e53a3785004e1d03bc76e6846a2052fa
- SHA512 f79c4c81ec8ce7d986143b1d03c40483753cc00af67a49288534e52f0ff6d0b944221b4f211631558cb9f123390d8cb506259a7a327564efcaadcbf60b7062b5
- SSDEEP 24576:AEPghm6/7IIXdwcXrif7qQncjlP65i3VuPdCN/j2GLl3iFSE33b9:/g06DIKdwc+eQnSt65aV9N/j2U4FH
- TLSH T171956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 1a320c15a3d5fe64bebd68ff7e98f46645890ea3bb7ac87a7a0e084299a3e474
- MD5 7b0adc05fe727fd4613ac2d3c16fde2a
- SHA1 caa0053b9d6e2639df7b8664d4b964abb855d503
- SHA512 530f0e83205d5830864f2841caef8923ae2732d991e5d8844029ac9bbb3b315ef7f59dc9c48104276b2482d37808b90069efed0cdb51079f5ccee0604370a521
- SSDEEP 12288:/EP3RnUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:EncdCN/j2GLl3iFSE33b9
- TLSH T139E4126D67AC70E9E12AC13D82A18605D331F4B4AB2217DF42D1C2BE4F77EE85D39A11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 aa096da2ca86bec873389d79dc3372acbc1df939afcc075e5950061db9dcf25c
- MD5 0c2ed939b11fda5abb57f697739faab0
- SHA1 582b40cf5fc85741c5782c527a3cb869154952e1
- SHA512 b41deb3d5a3e6d4c0cffd15b3d35a01ba27c16b026b3d2ab8053a7b4bf13c4d9324915073da07c1361ccfb08cf8ced0a15655826616258e0abcba09cac9a26c4
- SSDEEP 12288:fjkyHJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:fIyHdCN/j2GLl3iFSE33b9
- TLSH T1F4F41214A3E4A195E57A437C86B686619A30FC70EF2146CF41C0E77F6F7ABE49831B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 7a51dac97ffb9a677eab3e93276afff55c5226e0f837d7cdbe24b4e4e40c4acd
- MD5 0eb3deee488070a990441d1d79015eb1
- SHA1 c32c4ecc250f960bcc8421b31c6a0c509b6b19ad
- SHA512 1cf0078ac2a51b3fa0bf0cad62f7092fa0f113e834e002b9aba1ed2cf15fbfbccfbeea86baf581d1adf9b14a2383934e949b254debfc9b5b1111e3603e0b8cbb
- SSDEEP 12288:3yhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CVdCN/j2GLl3iFSE33b9
- TLSH T157D42368A6B5B669F52BC37C43689F215210FEF8EB2104CB41D0A6FB5779FE89033452
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 08ccc81a00ea5c323cbe5e790cc31f17a8a5b09f38950141d0dd8370e17ff20a
- MD5 c8378401e96d9b9ff493b486297eba88
- SHA1 94079a1642a2b7b3678afd461e22f645226a447c
- SHA512 4b1972447364a3f45cdaee20ded6a4f39a5f29ad939e796cd19d26bd01c3e9e0f8bf240c9f19aad3dff009ee90102612a1b3e5fbe54c1558c05fb247051b1c9a
- SSDEEP 24576:oQ9MxZKdcz9dw3+dCN/j2GLl3iFSE33b9:oVKZBN/j2U4FH
- TLSH T110558C2DABE9159AE177D27995A250C3A633B4301B31C6CF2448D03D4D7BEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 72512d2fcdf8462083109af139e0397cdb53e5c01d2dd8e1d205ab7490c895cb
- MD5 f568aa6b864f8158ad606306ebbf8d28
- SHA1 dba5685b186e05ac57a8a0ec7e694826be4b39e5
- SHA512 ce9733d7cd906f16ee57e9bad05a531154578cd09dbeffd09be32d8b5773bf17e220e8c7804f41737f3d509818d7369a31a8b1cd66aa3ce1e7c7bd9b3fd467b6
- SSDEEP 12288:myoKo2JRple9pbJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:myocDApDdCN/j2GLl3iFSE33b9
- TLSH T12EF4E01FBBA940A2E076823C89858745E773B0705B2253CB5691C37E4F27AECBD35B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 7cc460b069357d52df11cbd6a1a2c62ad59d00ecddd56f4a15a715fe72993db5
- MD5 930f2a047f81837694a2593e77cc3e48
- SHA1 a983134d121c10773eb0487c8afc9d386688eda8
- SHA512 016bd4fe1a8eb7201a656ebcf267b71b0a3ffcb98d8c9945d052b844cf860aee1c241cdcfb0a4da2699fb2cb180d587a857758b9b2ec98b4b3c4c2778baf55d1
- SSDEEP 49152:rWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKAN/j2U4FH:b0zuNIWj2jF
- TLSH T1AFA57B3DA2F800A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 e4e02547199b8370a500bc79cda53d931e8f3708ae733096d3809da4544ce6d4
- MD5 e0521ce6c90b646edf0dd8e7badab93c
- SHA1 846a37cc33de26461d3d14ccc5f1800474e784d6
- SHA512 9e2860f0637a362f1a5ac1cabb96e8555ca65c5b4a12ffb7f8ad2b2d911cbc16ff0c51873609a642a957cbe66ea33da2af145d18a0f98d591cffa1af161341e3
- SSDEEP 24576:+1QT7EcpfxR+N5AWAz3ooiYtjMqbcdCN/j2GLl3iFSE33b9:TTDxR+N5YzTfjM6N/j2U4FH
- TLSH T1D155B02EA7F815E9D17EC5798B23C512FA727861033193CB42A0C17E1E6B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 f27c551212f5e05ea30b14096b1a456924cf226ed316a94e2615dd76c94e13ec
- MD5 b5aee745a62e1d81155d0d0a351d8979
- SHA1 fb466fc9f774353b709462690706629f6d8016b2
- SHA512 7eba006d7110f9d26ed9c92668f530a78b0ed455bf0a499793085b1ca31f0957876aa323e94c13d2778f6680a55a6cda737a23f7a1c7686569c49321f30fcfc6
- SSDEEP 24576:pTMdOz0FFS+imSLYdCN/j2GLl3iFSE33b9:j0K+imSLDN/j2U4FH
- TLSH T14015F17EA3AD14E5E47BC27C8653C906E67274A5032166CB06D0C1BA3F5BFE4793AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 a3c7cc6c059dace520bc0d9b4dce35a88c594584c2f01619252704301a99b9e2
- MD5 14ff97fde055838ba8e6c8d5951c464f
- SHA1 29a24c2d40f512247cdd4a73d932299705339751
- SHA512 7d14250d9ab3e06c7def55ac008473c537160f638be2a8ca4907b4046e2913b49c60f57f8fde4c89529ebf153e857bfc93d1cf0cc30d7f2f3a031368450001b4
- SSDEEP 12288:Z4KNJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:dZdCN/j2GLl3iFSE33b9
- TLSH T1F4D4121C63E870E4F4768278877A86159220FCB4A72146EF15D0CAFF5B3ABE8D435B12
- MD5 SHA1 SHA512 SSDEEP TLSH