Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/05/2026, 10:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
Resource
win11-20260130-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
- Size 1.7MB
- Sample260508-l2ejvsax2m
- SHA256 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef
- MD5 6448deff2451de1fd9a165168341b9d1
- SHA1 959273f14caf898b22b5f1419b3a78ea3c21ceba
- SHA512 ee4c3bde47c1c15383610e7fe52c641eb218632cc0dce9d4a8389f5c559953dab5c24837c105b85fb0c768380af38454815d8dfa72375cb9f104d8685398abc3
- SSDEEP 24576:zov+7H9YcrN3lY5bTwzbEb/JtpNkea9Sb1E2ZamlZkBMB28kn:NjScrh8TwzbEvKIb1EE6BMB9
- TLSH T1A285C0227A84A032E36603324DA9B169D7FFB9A10F32739717993B0E6F784D05E35647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 1764 alg.exe 4596 DiagnosticsHub.StandardCollector.Service.exe 4588 fxssvc.exe 4152 elevation_service.exe 2212 elevation_service.exe 2196 maintenanceservice.exe 3344 msdtc.exe 436 OSE.EXE 4648 PerceptionSimulationService.exe 2528 perfhost.exe 1752 locator.exe 5008 SensorDataService.exe 3460 snmptrap.exe 3476 spectrum.exe 3728 ssh-agent.exe 4336 TieringEngineService.exe 440 AgentService.exe 1492 vds.exe 4240 vssvc.exe 3388 wbengine.exe 3848 WmiApSrv.exe 3368 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\locator.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\msiexec.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\System32\SensorDataService.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\93a5e280e7d1e4d4.bin alg.exe File opened for modification C:\Windows\System32\snmptrap.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\System32\msdtc.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\spectrum.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\AgentService.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\System32\vds.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\vssvc.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\wbengine.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_81171\java.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\7-Zip\7z.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a60841add1dedc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040c31eaed1dedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008dbad8aed1dedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099c53aacd1dedc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006183daacd1dedc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd0bc5acd1dedc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003dbb13add1dedc01 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe Token: SeAuditPrivilege 4588 fxssvc.exe Token: SeRestorePrivilege 4336 TieringEngineService.exe Token: SeManageVolumePrivilege 4336 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 440 AgentService.exe Token: SeBackupPrivilege 4240 vssvc.exe Token: SeRestorePrivilege 4240 vssvc.exe Token: SeAuditPrivilege 4240 vssvc.exe Token: SeBackupPrivilege 3388 wbengine.exe Token: SeRestorePrivilege 3388 wbengine.exe Token: SeSecurityPrivilege 3388 wbengine.exe Token: 33 3368 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 3368 SearchIndexer.exe Token: SeDebugPrivilege 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe Token: SeDebugPrivilege 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe Token: SeDebugPrivilege 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe Token: SeDebugPrivilege 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe Token: SeDebugPrivilege 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe Token: SeDebugPrivilege 1764 alg.exe Token: SeDebugPrivilege 1764 alg.exe Token: SeDebugPrivilege 1764 alg.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe 1688 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3368 wrote to memory of 3040 3368 SearchIndexer.exe 110 PID 3368 wrote to memory of 4868 3368 SearchIndexer.exe 112 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe"C:\Users\Admin\AppData\Local\Temp\20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1688
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:4596
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:640
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4588
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4152
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2212
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2196
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3344
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:436
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4648
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2528
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1752
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5008
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3460
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3476
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3728
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:2240
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:440
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1492
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4240
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3388
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3848
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3040
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:4868
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 b299692e9049dfd6709959184819863e15faa42835000111942a9957124e0125
- MD5 82eaf5c8fbc0f0ff0f4440a7c281b916
- SHA1 d7ec539994b4e998789a292d45aaff42373b136a
- SHA512 45d90d4ab5bb7a710310589d27f928f8774335f77aba6d5e6b89b4b9387c7ce89b1d9637f652c7303652b1831f6bdb7d111073ae13feacae04c08b93242f1ff8
- SSDEEP 49152:Bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn7xIb1EE6BMB9:H3q6HjBEIb1hR9
- TLSH T168D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 fd2eb7996c48555b4b8650641b1b93279ae7b48cd009051402d3069c63ab4ad6
- MD5 7f0a301bf0afb4890290a6b97b2fcbf7
- SHA1 dd620f5c1765c3c0be8241efb492b2ab0171478b
- SHA512 469aec4a479c37ba15cb1863398fc4632884fcbfd989b20ba17a602d64388f934983edc4b6c03ad588496388b68ee290ace15ea0999b91fc05ae9940e0a63521
- SSDEEP 12288:d1XLsswWkxy2lRq2czAe26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:TXYfDtczAex9Sb1E2ZamlZkBMB28kn
- TLSH T1FE05F12973D408F9ED67827DCCB28512EB73B8554760EB9B03A499260F332D45E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 aaa86713ffa6705846d172c5f439212d04dfc7d6a0e3b461efe2f6966d2e8b1b
- MD5 de796396e53a18d130b564da2b2cfb6b
- SHA1 60c0b4fb84c3088148eb714faa2b2e83f3b817d9
- SHA512 0b527167dbc21d161ff1a9712ee42ee01ca3fe0d28c86a46fc1c6be77e835d445415393c004494cd4e95e6df72f26e9bbf9e32b5fc8cd002e70112b196b821ca
- SSDEEP 24576:Q0Le5ji0hmxirMDx9Sb1E2ZamlZkBMB28kn:QPji0AcUxIb1EE6BMB9
- TLSH T11435AE16F6748335D073C0B9C5D2A69AEE7130865B308ACB4286C77C7F676E68A36731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 54cac84c8cbc61ec9845ca1abc23315e5f76890603d53108d8f70145a45012ae
- MD5 54fa4e9419c27c2ea44991e7c98cb826
- SHA1 bf9b7c040e7cd53fb221f13c1060d0195cb0c3a0
- SHA512 30fc0f8c94efb60a40a14832f176c55fe7b0139838d940316d3ad5f34b97c156a131e340ed8800b14b87b4dfa138471b2246efa50bae8c58609038b385003859
- SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWE6q8wyudx9Sb1E2ZamlZkBMB28kn:7/ezSC6vUzPvxHjywxIb1EE6BMB9
- TLSH T191756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 1fdaac8d14a535540e04304e52c2e2828f3f0ade66e3546b77e61cb26c3827a4
- MD5 2ee768c6e6b0c4322920932c891c9853
- SHA1 455fb093cf16e30ef34d2f601aa144a31ec1d1e8
- SHA512 c3b4837164b7dff88530b9d8953e369f9f94b266c765b270951041d9ac0f89f6cc086b0841d1a5193709dad1676dd5d4757f38d9ed3defcfa247ef2dc903ada7
- SSDEEP 24576:6VbqPb88hv/l+6yx9Sb1E2ZamlZkBMB28kn:6VO88hXl+/xIb1EE6BMB9
- TLSH T1B1559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2F676E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 9edc89f2eb9a39c4946107548857cc0d27409b2592528b2d724d719a403819e2
- MD5 41d36f1e9915dd4a1528786e77519789
- SHA1 a4f99caed90d7d09c7e960e55d44a8ef9b36ab7b
- SHA512 710d8265c4246f6f2d7103c26756291ad5cb9daa9b6cc56c0e021b45c4d358ca47f4160fb2dce58cdb9af36e27d82d14e828c48aada9d361e1e250a24464f1a5
- SSDEEP 12288:XRX26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:XRXx9Sb1E2ZamlZkBMB28kn
- TLSH T1FEC4239B138CA95ACB0A5177F8FAA4B26FB1CF249C114F5B9740EE074F350A28C374A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 9013b9fe4257337754f1dce1ba2628e21b418c7fb10f2495217bc0c9fa72af27
- MD5 80ddad989b4503a376d5e86e05457321
- SHA1 dc39e27049c9bc45d50ad679ed31bd4112910984
- SHA512 51686c6435004142dd1d994a4c6c029dc491aa23f006b3c423deaf2c0393ca4e20b81652eb486136d8ef1d68e99cd0436670d2820fb8fa68e22ac8cd235ca3a8
- SSDEEP 12288:UeBNUbTVO86Ua26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:UJIUax9Sb1E2ZamlZkBMB28kn
- TLSH T16505CF7BAE28FCD2C27A8DB95A91C640D77278304F6293CBD164C20EDE235E15D7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 8acc9e662dca023b64d2ac913d6e2058c548f69e83af5c4f5fe8b285dab6411c
- MD5 49f25bbfd4aa50d0f86d9a67842ac93b
- SHA1 c83a45b32a7c2202764aea2a8e046eb9051f0edb
- SHA512 01eeb19a88c92f9a9d71f6f921510000fb1d70a42b3f9b261ddd34dc819dfc1b75cfc3563f51b9b4db3a337ce0432b078f393bb372a19f83d2b615507953f091
- SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THV:DQvGAdlCEL8c/yRNw5CfIb1hR9
- TLSH T1EC266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 65c0715cf7c5169641839aef70f7da68375543a7773631d5a77b52f1ab60c888
- MD5 9f4dad0dd1d87e6251636753d7844464
- SHA1 a6038079de8730c9c273ab1f9f411bb1d53024d0
- SHA512 467c6f6a96eb481fe2ed32a7e1ecc2fedde32b53ebe3177010afd22fd3a3b9bfa958683282dad776bbf78ca661477c56a2b49732727f5b6e201bc3a298ba2b18
- SSDEEP 12288:lAwSfxL/2Dc34DLLmt0LDQewsAjE26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+a:GdewsAjEx9Sb1E2ZamlZkBMB28kn
- TLSH T13515E031FA74E436C77F0DB61B76C716187DAA204F511AC3E3A88E8E4A301D22776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 d41e068c3665528530c5fc0b068fd59c5af1eed92cd0ce97f9449cd575839804
- MD5 9482534c190125ac2a6c6677383546ee
- SHA1 781b49b86403f458ae75c407a53a814b48d98dfb
- SHA512 ef57a8b4137944f8c4a63f01112c67d79a1043ba6f237d6c8106bfa0e5d6489f2e1113525892ebd35b01ce0639cb87e7813cbea86d4f706792d1fed031059949
- SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHO+1hR:QUEtQevvqc2W1cpV2EI32O+
- TLSH T198474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 600ef748a66234fd921eb2da29acbbca848c8220c804f5582a7419a6157d2fef
- MD5 ef1ac21299413731059055dfbb9abd82
- SHA1 c413df1565b135031064c63618a6f46870143fd9
- SHA512 204950522a1955a01898b03c97f89a5e7e9d35c81e5862151b89717f6639e1a4f70e34c4b46cfaff9158bd17edf9e631af2cc2773e5c625257bb4b9803590efd
- SSDEEP 49152:+CbRquA/m2yL5zifFiV+XenmE3/zkxIb1EE6BMB9:zoqHVjnmzIb1hR9
- TLSH T1D7D58E0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 07a7b4e3f24e04a77ac1df184f4a931b52ecbf08c2e083388dc2dde00a7e9e2b
- MD5 fd0884fc294d7c1f8aec30f8f5928fc0
- SHA1 815c2a35a45955bb3dc356d33e1b806f7d491566
- SHA512 b4b360f00d3ddeb79b50dc628e8efa57acde5b9da4798c56eeaad8921df9071412be067d55b2f1e0312d86eb8a7690769cd1048e89196524f18f46951443eb6a
- SSDEEP 24576:pAhGLJIFoiwtA5l7S53px9Sb1E2ZamlZkBMB28kn:pAMyFoiq55xIb1EE6BMB9
- TLSH T1D735AD81E7F955D4F5B3AAB8ADB69171EA76BCA95E31C20F2150C10F0E33A509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 fc8d022fa29b8422fca559af2d686c501bab7d6d55584f9b395d0047fa214fa5
- MD5 6d3b88f0969c344aedeb0977af1bd96d
- SHA1 fda415e091414cfda7681003bde0e5d484fc32e0
- SHA512 21bf05958f08d52d81fc65247647cc0a5cf5372c1b805abe20f531fb57b645f24665326ce897440d088a9e90338a947fb71423995bc8d5e473920e85219dab37
- SSDEEP 12288:Dmw5HEjsChNVBFgl0WDm+C926WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:CwuoOWQx9Sb1E2ZamlZkBMB28kn
- TLSH T12305F14A33A81CF9E9678139C5A7C536F7F2BC112A21CB1F1760C65B5F332616D2AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 d740013be9e89901644d418bea909efdf2ee3de10e9ebfaec1357f0932ff0008
- MD5 f3299baf098d1ce5df4fce1aaf5f5db6
- SHA1 67d08dcf4d24c3bda1dd86bd27bf986ea1995bfb
- SHA512 6d0b7f4ceb8092e10005f01d29b6a732cf0d76808bdc2730778de18d1f85f9ffa76895a7c7c003f36a7aa6f0166a08a582997819915fe16820fdaa1a926013e3
- SSDEEP 12288:0BZ1Iy026WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:SZurx9Sb1E2ZamlZkBMB28kn
- TLSH T1D8E4129B33D870BAD297423AD8F59551EBB2B866673243CF16108A5B1F335D20D3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 8bbaa767e71e7d3cae82ffcd633302ab5096f32d45d30763613de91a529f753d
- MD5 9bed5dab79438858d19dcd7e62dd4db8
- SHA1 84bdd6bf14703253d55cc1c3f2c84ef121a968a1
- SHA512 233528d869841cfc5634904704c9a7dfac5e20b94dbe849ddf6228f97a1c1f2c79ac619fa8cb8853d75e35f8f1b0b516dce0561bf4a52142499ce3fe146ef9de
- SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:EQRQyi36YOcPQLvw2gAf+PN3AIb1hR9
- TLSH T13F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 96c38651045d0a6e052ad2eb37b318079198746afb63b0c9f864dbd9ef247777
- MD5 e35402cde45b92d63858618de1871289
- SHA1 9df17949d01e9cda47de82f31dbb33a62ded1678
- SHA512 22d423bbe99d32ea0cb050fc1dbb607675f46c71f5af1ce0b13ad9598dff949f9f66ac36131b32888b0d422e57ddf1f25e604d0bee290edc6ae9022406da5e05
- SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:8QRQyi36YOcPQLvw2gAf+PN3AIb1hR9
- TLSH T103667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 d8dc720830b2fb48b51a83fc758fcd83e0312cec54ccc7a95d5ad67a7ebe4d1b
- MD5 b597e41b8a3ef49264a3912910a9a592
- SHA1 2b63877e99b4a62eb4ff084483c63a85adf90da3
- SHA512 2f7d598ee6980af56f99734dae273eb1f29052c9a8238516e6ada038cc2e74f84f52bb23ae70349fda1a86eda67321fdd37ddccea65316eeed2b4c72422a87dc
- SSDEEP 24576:4wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL07x9Sb1E2ZamlZkD:e68Qg55nhheWu7PNU3/UxIb1EE6BMB9
- TLSH T186B54933B2F600A9C44DE1769F4A873196D27C758FE1E3DB851172061BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 e5d2d8c791aa6c34dd391dcd802beb4f2f29f43606232a8d1267d85ecffb29af
- MD5 5a2e51bf8124def53d39f9aac4bda313
- SHA1 5a806f805693aa21f8bd0594a58e8e2708b0bad4
- SHA512 6655784ea317ee7c2ace453c988eebbc21bb6d190d2419b59e72f2264d8a6d85ab2f189256f7f4bea60833eecc6e179882f38f0f86a04c2d47ef6121c1a7ddce
- SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99T:Ry5112gYy5azzVvL69nLKnhZhIb1hR9
- TLSH T175167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 9c1dc1b8f599627d3213d408b65904b7f93f0ab605a131f2cf27256130280436
- MD5 4c409184b6c13919481e1c27936e72b4
- SHA1 d04e1b1f52f3db2036cc66c9582fd43ce3650fcf
- SHA512 e0a988c98c554d3de602d8b3fc4ff8d94f87279e7a50e34553236094cfcaf7e8c28213d34a229adca17ffaa0539b4324731aa4f23f1ae86e6624ac30c1111b44
- SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gluxIb1EE6BMB9:pu6JmVxd2doIb1hR9
- TLSH T161D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 e627d18190385daada3b26e2f9faf707ef2d73598c47012eee496b31182c023a
- MD5 8dc5b4458603fcb39dd67c34396093f3
- SHA1 349b9e06672b851f8fc486f429f31a10a18ff863
- SHA512 e03a0e7623e1fc1a55a41bce7da491e79833506904214a24aa390907a6ab7837099e0ed92fcad6950ce2bb4ba6777b92946a507567ba7837a41102266a3f4eb0
- SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4x6xIb1EE6BMB9:nmifPbRzIb1hR9
- TLSH T193B5BE13F2D801E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BAE45F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 d9f2d33334030df4f8c3f4d976edd4b1c5e26111eaccfe9151927fa81660de62
- MD5 35c5efea03d3f3b6b54fdd89aae1435b
- SHA1 86611880e244baa623d6144eeff60033b9bf22c0
- SHA512 9c7335929605f590e02ebe7c289e02db07986345768ba980ba8732719bad5de17ab8d5a27aea1daf7e6316773e0c6b6b22a5a79ad7ca2f8499a11e897fc57e3a
- SSDEEP 49152:4SuZQIY0Be2KRRVtOnks6NMHqrxIb1EE6BMB9:i5dKTi61dIb1hR9
- TLSH T17DC5BE03F2E941E8E0BED6748B769232EA72BC464B34A6DF064072551E77EE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 b9d07ef41a43da54cc25a54ac134b851f1d512452c8ae3d106397aef0ee31995
- MD5 13dc31af6c920c3ae58ab4f34286b9bd
- SHA1 052e15190619ea6e811b10b242c1d90af118ac2f
- SHA512 1a90dc3125845f711e8808eaf860687081de79b26dfb529c346c5ce129c004dc65d0410d4a46130da689377807486cd036394c855dd5118c0f78dc8b315a9835
- SSDEEP 49152:QhtSn8EApI0figngiDn0AP5wexIb1EE6BMB9:BX2iyphXIb1hR9
- TLSH T12195BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 cdae11a7f509cc273728ff6c34434f75cb3eee9d8d61070803412f22af8311af
- MD5 f0ba05d3052b45a6dfe201e10854c4aa
- SHA1 ab79634123251d7fdc1d1db8ff12b17e45083363
- SHA512 d561d706750113bc057c6d482086f0e396a022976d407b59302a60a5049be9f79e7ebe4e3e10192bf019e2e6c13fa161b3b4e20a8113391b4abc7e947fb15a61
- SSDEEP 12288:m/26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:m/x9Sb1E2ZamlZkBMB28kn
- TLSH T152C4239F228CEA5BC7054177E8FA90A1AFA59F58AD12479FA744DD034F720A20C374E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 375c0c0237bce0d373f417630db4bf7dd9db7040157f96696f6113672a9c548b
- MD5 2495b706817d33e66029473a5f6ddb50
- SHA1 cfc5677b512ec50b50bffc3b53451aa59bc75188
- SHA512 34cc84a97367b3afbba17c984323b31db22bbb7b18ac549ab0ad4eb90dc2f983d975db5f8714ce1a64ee48d7369ec668bbaf251b7b2c415bf3c72b4a13556362
- SSDEEP 12288:XI26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:XIx9Sb1E2ZamlZkBMB28kn
- TLSH T1BBC4239F228CAA5BC7055177E8FA94E1AF659F29AC12479FA744DD034F720A20C374F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 4ce4f6fb4393e315b54030beb369794bbb4e78ab76965f1fecccf9e0bfaf6184
- MD5 073ce9bd448de88400d19f3cb7b81b55
- SHA1 5d5aebf78cc8d72c2f61ddd195291febdbdd652c
- SHA512 51fa7d9b1ddc2385e7cda78cd5640d109bad99cba53a2266d8ab64c9dce20613d96623c85cca1aeb61c70e1269c8712adf305c56d45f4815f4a3e0876ae94642
- SSDEEP 12288:UC26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:UCx9Sb1E2ZamlZkBMB28kn
- TLSH T1B2C4239F228CAA5BC7055177E8FA91E1AFB58F59AC12479FA744DD034F720A20C374E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 4c14825b2163cd4f46a5b3055ac6a7858f076350a1fd0760b78dc9e611ead7ff
- MD5 8a926941d9deef61b67a0037d5610d1e
- SHA1 529cecab91cc68018d06fa197f1136cd73d19cdd
- SHA512 a89d026fb19885781a4c7e60c4cc16964397d094cb3baa504060bb85b24bcdc7126075de4dad349eb4a492221bcb20d062aa09cb6909817531faee86bfad4387
- SSDEEP 12288:AVJ26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:Kx9Sb1E2ZamlZkBMB28kn
- TLSH T1FCD4235B239C95DBCA16D17AECF690A1EBB1FE64EA3247DF97008D070F711A11C368A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 61cb7078221c6a553ebd3832eff8a85c65c13cea86bb6b8eabea4868997fc5c9
- MD5 77ad5d5a3ee12c4c9e6962c7f64315b8
- SHA1 75338314939101694b191ad8272ef4f98c383bbb
- SHA512 3f722169e7e989c4bf890c33ea5d5e1bb36195179370ab30da56fee1fa6d7b025a3d01b7baa456e18be21617de7740d7d6f1e7ecae198795c0d414039fc65e3b
- SSDEEP 12288:wB26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:wBx9Sb1E2ZamlZkBMB28kn
- TLSH T18FC4239F228CAA5BC7094177E8FA91E1AF658F59AC12479FA744DD034F720A20D374F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 f2c02ad3f195e7198d04ca109e148b8db8a4efec3a45b144200529e23e2708cc
- MD5 3feab5c4ac9f087b53b32d0185abf65b
- SHA1 a41dee3ef303f8c1c0a4e0bc5bf430a73baebcdd
- SHA512 9f9f8d37465aa208ec2f7e90403ff119a3329a156ac9c7b7ab6f5e66a8c65ddd4de2c7b3d3c6fd3064532ff23b58043b454917eebe484b1a2fb334fae8596398
- SSDEEP 12288:Hs26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:Hsx9Sb1E2ZamlZkBMB28kn
- TLSH T1E2C4239F228CAA5BC7095177E8FA90E1AF659F69AC12479FA744DD034F710A20C274F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 945284be708292601227caa260a73a09da437e0a740b32f4ea55f581b61e266d
- MD5 4ac42944046ab06c65fefadf5e03dd39
- SHA1 ae7fcd1374968df4268b207291acd9a35478ca93
- SHA512 cd16827f05a15662c979a84d41615aa7b31b6f052c6328b969937a6d7a2185de7c4059e8312c7f4b02ad4b504db58dab3b30ef70d2675840872614a2bcb905fb
- SSDEEP 12288:Ng26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:Ngx9Sb1E2ZamlZkBMB28kn
- TLSH T1DDC4239F228CAA5BC7094177E8FA94F1AF659F69AC12479FA744DD034F710A20C274F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 0767bf7b45e7050fefcf306afe98cd030a7dc7fd9f52adc7575bb5966ed2dc1d
- MD5 e0ca18c0c97f26368ff739afc1d2602d
- SHA1 18d298d0b0257d02f9a56d2d2a4ec5456d2e7137
- SHA512 2f03842951d200eb865136bff5cf2785cf26359d48a56969cd95aa32fbddee67e1feeab82e5868da9990e88b84273fcb08154891f5d9bd31370198a9a425ac84
- SSDEEP 12288:5iZwb6zzFEoS2cPvyo26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:8ZMSzFVSOox9Sb1E2ZamlZkBMB28kn
- TLSH T155050199739418F9DD67813ECC658916D6B2BC190B60CB5F03A436275F333A11C3EBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 cd0c90d44f68bf54047c04af44a4cadb480496d9d2f6f48f341f4e3f898c68dc
- MD5 f9c55fc5af2564002fe91a8462fdf97a
- SHA1 c51483fab96daaa8ca5fac1d057a2b376e763c4a
- SHA512 b7969de6b151a5acd5c141c2cc592c7a8c64c5a7d58da1d4e71943f126dd95d2dbfd1a97f974d49bbaf8e8877bfb1ffb8423743141c2cdc12108189cbbd38741
- SSDEEP 12288:vb26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:vbx9Sb1E2ZamlZkBMB28kn
- TLSH T13DC4239F228CA95BC7054177E8FA95E1AF658F59AC12479FA748DD034F720A20C374F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 4db82f9733060cfb1cbfb8c8991a05d5c929ccc9c01df16bfd2820c329f18aae
- MD5 f1025d2a7926402117e33db50f015055
- SHA1 320bf463fa01816dc30b38a966e26cabad120ad2
- SHA512 ed9c8e6f35264d766dcc1b8d4d097adbaa778284eb8c5cc2fe3632aaf91122d19be6a7e52ea7180439696e748edc7c43114097bbe4c993c5e7f01dcdbf7e4786
- SSDEEP 12288:5H26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:5Hx9Sb1E2ZamlZkBMB28kn
- TLSH T1EDC4239F228CAA5BC7054177E8F694E1AF759F69AC12479FAB44DD034F710A20C274F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 b77500b0ab05261cad074264e71e9a7a4075c50c763bda100d3eb493b6a01ba3
- MD5 fe9071df4d3324e0b1f082ce7283332d
- SHA1 357b7af604cacf15ec5e9f3aa9a00f23bc05ffb4
- SHA512 0e7539e62d3428bb60e5c84ffb4cf62a02394f3d00d3f15eea340dcec69ab40fda882db5f032b851440bf119619c334a3e1e50232f65218b32ef88fd417577a5
- SSDEEP 12288:NyPz5L8026WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:kzy0x9Sb1E2ZamlZkBMB28kn
- TLSH T159F4025B33A430F9D1268239C8B25A52F772B8354B218BAF57644A771F332A15D3BB70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 6da1890e2e8b8fa15360c472a8e5822773584d24648241cb9e8365f729edeae7
- MD5 7c45337e612e1740ac327cf32e3faa6d
- SHA1 8f955ddb07e83794c5fe732f5c4bd2b43850511b
- SHA512 4d918e228a743049a9d7aab200d9d98ff8c482e604571a91a7990106abe26be228c3ef3fda08616da5a16c0004f5c771df281b8653229f3058354853f01e02a2
- SSDEEP 12288:Rb26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:Rbx9Sb1E2ZamlZkBMB28kn
- TLSH T18CC4239F228CA95BC7094177E8FA95E1AF658F59AC124B9FA744DD034F720A20C374F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 b8d2ee5d7c2604b069793e1b0f63348dc15c62085fe5c59bf5651971e151d208
- MD5 08bbdf49cd5aba7896fd1a9a23b2d006
- SHA1 aa57543f86ee6e068b557df49831b945fd5d70a0
- SHA512 f5530e553ba7479683085037c74ec089dca9f313ae1d478fc19bc0b384fe8c19e3bd10cc038dd6ac9c2f3b07f092886548d632ef26341395cdcd236bb6d6d858
- SSDEEP 12288:mb26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:mbx9Sb1E2ZamlZkBMB28kn
- TLSH T1E7C4239F228CAA5BC7054177E8FA95E1AF648F69AC12479FA744DD034F720A20C374F8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 1e12840f43f5189a049b4090a78e320dd685b3b88e66e0157e0ad29a4604c64f
- MD5 c7c6929b3072c2b336ff65ab33912c19
- SHA1 246c9736dc5e62a90b914d01b4fdb77715434c12
- SHA512 f97ac97e9793d2b23b2df96bb30515450ced36c38547c0f891e16c1952e7a06bab92b9dd2fd0d20a819ff7c2da1565182d567f51bb62e78eeea517051460c711
- SSDEEP 12288:eyPz5L8026WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:Dzy0x9Sb1E2ZamlZkBMB28kn
- TLSH T1D9F4025B33A430F9D1268239C8B25A52F772B8354B218BAF57644A771F332A15D3BB70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 dde6da37b4618fd6480ce4b8cf8f1c789ee0d5890aecdcb3ad73388760ed87ae
- MD5 7880a236d938a66062b046b5c0da04a1
- SHA1 a792dc1bdb4a3899fd8508d79d9dd7177d2fecb7
- SHA512 096dfe09dcc72b59d904a474080cd22039217f606a4c02354fcc4918f0d175538b122ec92ede4d2d4f71bb8cf7c8ea91920999f65664bf200bb5fcd176589063
- SSDEEP 24576:rcP4mcvIjkGOxhKP2l71SNKbrh/8KBTx9Sb1E2ZamlZkBMB28kn:AP4m4IpOO67N8KNxIb1EE6BMB9
- TLSH T12F65AE2DABDC0096D0BA917885658A4AFAB1742A1F3286CF1160933D7F77EE14F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 c0d93970e072be001ee36ba538f11d4a077a61a32c6f2e18ae86ddcaa443021e
- MD5 feb67ac71ba6bb59e34edb15d031e5b8
- SHA1 fbb734dc0f9d652472f1713b8eb8ed10521c06f0
- SHA512 7cec8b1710060b109a7ebf1417cb11845a3de64738013d0c42549b89211b1895d7bd8fd5d35668edb397e7cbf4810c7dee63ad694db9a0e96437a3101cde31a8
- SSDEEP 12288:bNsfr26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:Yrx9Sb1E2ZamlZkBMB28kn
- TLSH T1F1E4015AD28852E9C16E617ACBA68641F7337D2487E1C3CB53C0F93E0F361905DEAA53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 6e06567fb723263cec9b116b08dccd06facd6caab27d574a4d14f76fbb5e319a
- MD5 91e311e2017870dde3c750208cabe2b0
- SHA1 85089e04dce3df93d656d9d3078a584d2c342c34
- SHA512 078dd8401b9824f15ea58a49efcaf161859f5e1acea781b0b68b90ccd66de67c20c495e8ca32a779112ad18339daa5c06509cf0a648a595e0c929cd34b0f2533
- SSDEEP 12288:zL26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:zLx9Sb1E2ZamlZkBMB28kn
- TLSH T123D4235F238CE91BC6295676F8FAD0717B3AAF389E11879FA604D9074F310A24C37469
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 2ea6d8b7ac4a49e4129be4a3c88d4ce08028a79ed69354485d72b25be2d50fd7
- MD5 f8aca0ad1ac3084cc62d6e5d0066d65e
- SHA1 e10432e7eddbe89620bd2574e08c268a55753a2b
- SHA512 4b1c119b76c5467db021865346fedb70df5d18ab648550262c2259b6740cd506da8d97ddb0ec743c1d09892db07e8b064a2bc1c02a98e159e65b904956faa839
- SSDEEP 49152:9a0h2GEkuAe73q3pp46zwwQBxIb1EE6BMB9:9a0hNYG4JwOIb1hR9
- TLSH T1C0859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853E3F37DE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 349ba680b0522aa9e6d091aa113a3c46c28aae22f2d59b38f543a442d4fe5108
- MD5 517531dc2e92818fdec379b42a848743
- SHA1 bb04cf49051cbe0c474573c0db05c4e3b252dc22
- SHA512 4494b414381bf8433b9c6055585d3ba0eb112171b7e5f36879256d626716f6c36b8646002c72f2237a677fb66f70eb8f39fb700b3d272863d5d90aaae735c0c7
- SSDEEP 12288:FhbHjfXY26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:FhbHjPYx9Sb1E2ZamlZkBMB28kn
- TLSH T130E4127F22AC2099E675E17ED8A68546D771BD251B1293EF2380C23B4F379E10C36E91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 bf4af949ddcd88797568d86da654317e8dda936f385e3a8955a555c8c56c064e
- MD5 ce2b859e220fffaf91c010b127605ee8
- SHA1 1bd5ad2aec2d8ccf466527b402881b70e47f6d78
- SHA512 243c8f653d65611a25a652bd8c82a70784ae42fa3552c01a76cf5bf62aa7f2f04e6e1ee76fac4d05a2e58df7d83adbbac8438440ef3a2fab333c16332fea8a22
- SSDEEP 24576:I3YgnJcRTk4yti+R5dpR/Qx9Sb1E2ZamlZkBMB28kn:IIgnaTk46ppR/QxIb1EE6BMB9
- TLSH T14745BF2EF2B910B9C8AAD136850147B5FB71782D1F209BCB0170C539AF1AEE85E35F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 7cce5252a549d1197a530461c439fbf5101e77f6181d115b3b02cd649cdbfd85
- MD5 ace999651762e813228d258b64a30b8d
- SHA1 6a4c311647e02ee52ed035e66082370fea4a6102
- SHA512 dc711bdebc335215459b2f14a53d7212d9823675c8ed27ca358fb21305aab4f6082f631938d3fbb06528f306f8bf0126758c9001f4489f5cbb04ef2588594556
- SSDEEP 12288:3326WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:33x9Sb1E2ZamlZkBMB28kn
- TLSH T1DBC4239F228CE95BC70951BBE8FAD5B16B609F249F224BDBA644DD074F710E20C374A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 d7555301b837cba364f2939f6c21a2bcb95479667b11d68cc47ece1a22b5ebbc
- MD5 7f8bc94fb5663564d6e18973cc09321e
- SHA1 fe7aaeaee22179141b557d44a18c7eedc8c2b664
- SHA512 52410a0e1b7e1091eaef40f51c18c3cff9763fc46e9dc8d1b76b195eea0af73100fcf233ca5c7f236cdba3ed4a57f72ace520932a7c2f31597316684dc0f261c
- SSDEEP 12288:nOb9A4LWOsvAYFTe26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:IpL3UTex9Sb1E2ZamlZkBMB28kn
- TLSH T15525F159F79400F9D96BD13DC8B68516E772B85D0760E7DF03A88A561F232E24E3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 984135924a8cdcc4c4a61a106dc2eadf2086ebe921da842438a8e3577cce6e60
- MD5 043d135bf2a4772edd80a36a155e0a1b
- SHA1 eb3b8aa3100fa7b47b752f12e31fdf8b9a732030
- SHA512 c8d28614c06d4d0df53666fcf7b5774a26e670f153a50c8127986a6d09b6a03c7825dcc791edbde3e4bf4bfd686d32746d5ced5b6128aa222b304cccab9ff502
- SSDEEP 12288:npFtpO626WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:LO6x9Sb1E2ZamlZkBMB28kn
- TLSH T119E4122E33DC20E9D539A13DD9A38259D771B8650B2257EF0290C56F0F73AF45C3AAA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 1b5cbb188bd8e9b782a35e8a9bf1dcb42084f5d33af864b0929033cacdd6b5dc
- MD5 f1a81be625de5635b41c420a8f80759e
- SHA1 dbef64b41d8b0c914af15aa0b3a76d79627eadc0
- SHA512 dbf394ed88f1b0af7a5e59cdb2c36630fc4e2c94f8d12be70449a12fc365776731b15cba71d29ee6c14eee6cef9a3c759f25e2e1613533fb2aaee8f18cd9170d
- SSDEEP 24576:O7NM9YmZqmWMUkPjZM48Mv6bEhsbx9Sb1E2ZamlZkBMB28kn:O7cBWMpPjN8DbEh4xIb1EE6BMB9
- TLSH T155659E2E6BEC81E5D576D13DC9E28205F6B2B4611B318ACF1152833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 f8f519203f86641818842595c282109b1ff09a5326e956990e995c8ae3255c82
- MD5 26cd6d4f8faab0bf2ea20f6c2d6c90e8
- SHA1 4d563687112e8cb16761a5a9d2bf643bedb6d73e
- SHA512 07bba8aaee1ec7f18dcd67f01b9866b32066928d215f247050499d0ba29388a0edc59c1907b42519d80b6d6a4d3afd3880cfce244e69a3d1542b82d60acb088b
- SSDEEP 24576:XW6BApg2YuyuNDYTabvcRvNYf8km11x9Sb1E2ZamlZkBMB28kn:XF2YuHNETovcvNYf8km7xIb1EE6BMB9
- TLSH T194857E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 d0aef71a98875b682994d203dc8493d6c14ba0b650b45c3de198f8a8a6ac3cde
- MD5 f4a0ff8d835f903783a4cc41a7f11574
- SHA1 8943f8fedf9064c131d9fac70295ebbeae6e1410
- SHA512 daeb55cb10c7ef38cef021636d3860e128e4559907cb3b47abac3500f74fe0da2d9c0ca77f03be2591f39080c252c8d7711e14f856c9911cd3493087c5a26024
- SSDEEP 24576:cAFs06+Omlf3NXEbTomx9Sb1E2ZamlZkBMB28kn:xFs060lVXuhxIb1EE6BMB9
- TLSH T17865AE2F62AC00D5D07ED17E8997C91AF7B1746707255ACB0260863E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 884f312e88f5596442876ee0468f4f3d54ce564754ae9a2912ade96e3d0e6ec4
- MD5 9e0a5879798fa558f458eb08220ce6ca
- SHA1 e888d827b1aa25e9315bd4cb3c6d2e4592fe24cf
- SHA512 b636e32c579faed7469f9d3251a890d5f2fc1b53acdb5d47f4233d5c75e1d4b67cff2aba80b7a35d507d4745e6e88b290c80556d2f21b5e7d9b792f5fa3cf84a
- SSDEEP 12288:hCJnJ5D3Vkrlzx726WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:4JnJ5D3Wthx9Sb1E2ZamlZkBMB28kn
- TLSH T13D15D02DD2A810E8D4B7C274819A5796FF72383D2F226ACB2874D5353F12EE09979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 e3a5b59227e7934827c66d1003204ca8971c9e3c5dba14d9073e9e6e827c2ca5
- MD5 f163285c262a5a2c477a126f1c26c8db
- SHA1 4fcf7a23b991e017e14c7a56aa9afe967d63f997
- SHA512 c545ae68573d9c638e6ceddefa0266b8d38cea7a62f8b9b7cf8939e69c0f5aeff40c41849ecb42ecbde85896cbb84db895cdd2cf048418d5698f89076e366ee8
- SSDEEP 49152:6o06DIKdwc+eQnSt65aV/xIb1EE6BMB9:7HIb1hR9
- TLSH T113956C16B7EA5294E8B3CAB1C97291169B327C509B34F7DF0AC0C92E1E33AD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 e8099a6d23bd4f6509380debd9e5a7d1dbdbb8c2d7eaa10c7ae703c8622b5ed0
- MD5 25d8ee48bcc92d67288d5c66b0fc3af5
- SHA1 847aef1815704f1483ad3c2c0267456d3c7b9f19
- SHA512 09933afac7f7274fd63714c6674c9dff7fe679d53c618c8e1715506443ee026e2bd9fce2a5c2b83c087276a59c95b5685b293c6d758df3fc5da71f21073fc8a8
- SSDEEP 12288:GEP3Rr926WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:Fr9x9Sb1E2ZamlZkBMB28kn
- TLSH T12FE4126E279CB0EAC12A913ED4E18145D7B2F4746B1227EF5690C23F4F335E11D3AA50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 1af58f7152967eaa2ee2e8966a1abbbf19f9ac00d876d43623147bcf552d58d9
- MD5 f042031e71e8a7d7960b94dad30ddccf
- SHA1 50558d803de28931471ef52860ecea7068632a80
- SHA512 6d2a3a8ed64910c0671107359c32317882db4f770ccb676c385835f2c548732d02959d674113f9eb108aa2c944c35817fa0da70e9afbf5a0eccd14926c6d54da
- SSDEEP 12288:DjkyI26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:DIyIx9Sb1E2ZamlZkBMB28kn
- TLSH T1DCF4124A238CA499DA694239E8B381A09F71FD309F2147DF5180EA3F5F336E15C36B65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 35bd237e33f802ef72de463600f50106852b1941113fa048204a64e55b8f61d1
- MD5 24c934c39fc9241c4d1102b2b3e57c16
- SHA1 2b19b0b1a3e41baa32150172dbfde8634233f759
- SHA512 947304a03efb3fad4a2bed9f6811e309585dead85d55e3b2ca88d07ad5e878c4d720c45d020b8faa5d58c9f6137a0f112784c1f8075d8fd359bb7d8a1e633753
- SSDEEP 12288:bFq26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:Zqx9Sb1E2ZamlZkBMB28kn
- TLSH T1C7D4235F228CB95ECA05417AE8BA95A16B71BF346F121BEF5584D9238F720E20C37894
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 ee340b54ee876b236b1d9bcafbdc2cbc9daf77ad63d20a54d1ecbc40c637dd5c
- MD5 a437088961a179f2cad3ec519a635a07
- SHA1 17f05a31ee00c2723f0d27d1eee8ebd4aff406a2
- SHA512 a9d60bf9344aacb29165579674768fb08b68a0886a56019ae19b4d9b65d1abad80e9d60fdcc2cc1e939314ec7f51c3da428eebd076da666a6fa662bd8088dcb7
- SSDEEP 24576:tQ9MxZKdcz97w3jx9Sb1E2ZamlZkBMB28kn:tVKXjxIb1EE6BMB9
- TLSH T1E5557C2DABE9059AE177D27594B250C3A673B4301B31D6CF2448D03D4E7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 f93efb26a919eb11ac2d33327dfa1c5cc3af59d5ce0f2d3d349f1781a568f0d2
- MD5 2578ac62033579da1ad92c18d7b4ceff
- SHA1 9fafbf609d54cf6ec1a4a344e0edb2af1ebe7b0a
- SHA512 449138af0679a8e1bf0b45725a8e8dac5a55eeb7a2c7d50dbaf7bf65898e7a270753ea8c91955e8d154f71dc887881d74a9886752114e68dd8d49014f596852e
- SSDEEP 12288:4yoKo2HRple9pE26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:4yocxApEx9Sb1E2ZamlZkBMB28kn
- TLSH T1DDF4F01F77AD40A2E166813CC8958345EBB3B0305B6257CB6681C73E8F339E9BD39A51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 d2c00f29126ecf281afdacd1a6a9786a9dc12ba986b761bac88c559234d66fff
- MD5 45db84ea42b12e66dee169146d56b8e6
- SHA1 51069c96ae29fc826992c878d5aebdf24a7d7462
- SHA512 45784874312f4188a1a11d09dd27126681b4bd198857647e3471f42865372123e2d27a3a52239b559e9a143f2655d692dd3d5285487a9a637bb5ba8b81b49ea4
- SSDEEP 49152:5WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKExIb1EE6BMB9:h0zuNI6Ib1hR9
- TLSH T1A1A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 627cf674dca4c7091162ab595d775c11cdf3c7ebb096b69f666757be341d100b
- MD5 c7922b6c2c054b6dc399c386233d4a80
- SHA1 3f6f6ee5ee2b6dcd4daf98aa50d4607d7cd93eb0
- SHA512 c601843398d202d53f4cde27256dda4278d97c109ba21495dd6a704813865d2f6e2cfe7c29c2b791a001742b19363b2443300be705a8de2377bf5631c2c445eb
- SSDEEP 24576:u1QT7EcpfxR+N5AWAz3ooiYtjMqb9x9Sb1E2ZamlZkBMB28kn:jTDxR+N5YzTfjMaxIb1EE6BMB9
- TLSH T19755B02EA7F855E9D1BE85799A23C512FB727821033193CB42A0C17E0F6B5D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 9bceaf09141f77430b17f71f5198989261356e201f448c9765af036839f310cf
- MD5 e08bbe60135d6fd6e7912e240c789c98
- SHA1 bbf61122dae120759bc8c92e1278969c10be4ec4
- SHA512 b23326062e4137e2e3df4c5ed247ec4dbce64457f0d2c84b48ee453aaeaaa1cee39d6fb6cd798cdc2101000235f55aeee6331a03ebbdfa0334b0dba23d5efcf9
- SSDEEP 24576:jTMdOz0FFS+imSLJx9Sb1E2ZamlZkBMB28kn:B0K+imSLJxIb1EE6BMB9
- TLSH T1F915F17E63AD14E5E53BC27DDA53C906FA723461032266DB0690C17A2F67EE43D3AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 c7595988e93e03fadc7d749f6853244c2249b1d7a7730a449ac66ed5c964bb5b
- MD5 728b90e8d2b2ed759c53a3444cc0fdb7
- SHA1 30a0bcc1ad875eaba3cbc6b23d22beb7fbbc8b7e
- SHA512 8479cdd6dc5b548f44747e2728443c782f52d51fbf05abed0b16f68c99d8e7b36028fb456ea4ba31af6f121913d9dfbe6b76c6becc4a475d2778ccbe4f998f38
- SSDEEP 12288:L47e26WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:+ex9Sb1E2ZamlZkBMB28kn
- TLSH T123D4125E23DC7499E522923AD9B681619B70BD3527215BFF25D0C93B4F330E18C3AA62
- MD5 SHA1 SHA512 SSDEEP TLSH