20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef

Analysis

max time kernel
149s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
Size 1.7MB
Sample260508-l2ejvsax2m
SHA256 20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef
MD5 6448deff2451de1fd9a165168341b9d1
SHA1 959273f14caf898b22b5f1419b3a78ea3c21ceba
SHA512 ee4c3bde47c1c15383610e7fe52c641eb218632cc0dce9d4a8389f5c559953dab5c24837c105b85fb0c768380af38454815d8dfa72375cb9f104d8685398abc3
SSDEEP 24576:zov+7H9YcrN3lY5bTwzbEb/JtpNkea9Sb1E2ZamlZkBMB28kn:NjScrh8TwzbEvKIb1EE6BMB9
TLSH
T1A285C0227A84A032E36603324DA9B169D7FFB9A10F32739717993B0E6F784D05E35647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4828	alg.exe
5364	DiagnosticsHub.StandardCollector.Service.exe
1816	fxssvc.exe
2028	elevation_service.exe
5196	elevation_service.exe
2160	maintenanceservice.exe
5188	msdtc.exe
5340	OSE.EXE
2516	PerceptionSimulationService.exe
2336	perfhost.exe
2292	locator.exe
5728	SensorDataService.exe
2524	snmptrap.exe
4624	spectrum.exe
3940	ssh-agent.exe
4732	TieringEngineService.exe
956	AgentService.exe
5400	vds.exe
4128	vssvc.exe
3704	wbengine.exe
4748	WmiApSrv.exe
2780	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\174b6baf8b62accd.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\locator.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\dllhost.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\System32\vds.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\AgentService.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\vssvc.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\wbengine.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\msiexec.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\java.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066744fb4d1dedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3106cb4d1dedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026dd7bb5d1dedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000630264add1dedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a39e18b4d1dedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000560907b5d1dedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
Token: SeAuditPrivilege	1816	fxssvc.exe
Token: SeRestorePrivilege	4732	TieringEngineService.exe
Token: SeManageVolumePrivilege	4732	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	956	AgentService.exe
Token: SeBackupPrivilege	4128	vssvc.exe
Token: SeRestorePrivilege	4128	vssvc.exe
Token: SeAuditPrivilege	4128	vssvc.exe
Token: SeBackupPrivilege	3704	wbengine.exe
Token: SeRestorePrivilege	3704	wbengine.exe
Token: SeSecurityPrivilege	3704	wbengine.exe
Token: 33	2780	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2780	SearchIndexer.exe
Token: SeDebugPrivilege	4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
Token: SeDebugPrivilege	4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
Token: SeDebugPrivilege	4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
Token: SeDebugPrivilege	4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
Token: SeDebugPrivilege	4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
Token: SeDebugPrivilege	4828	alg.exe
Token: SeDebugPrivilege	4828	alg.exe
Token: SeDebugPrivilege	4828	alg.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
4456	20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 5428	2780	SearchIndexer.exe	104
PID 2780 wrote to memory of 1192	2780	SearchIndexer.exe	105
PID 2780 wrote to memory of 5244	2780	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe
"C:\Users\Admin\AppData\Local\Temp\20e41090f5d3e51a3bcf06281ada00a8245791d4e9f3887c3bf2f27223b657ef.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4456

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:6032

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5196

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2160

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5188

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5340

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2516

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2336

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2292

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5728

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2524

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4624

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3940

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:6048

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4748

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5428
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1636 1624 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1192
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1856 1852 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dbd10ae51e700849097de17b5cee9dfecb6cabb22d64bcaf0d0cf76a7193e211
MD5 c48380e8e34f59fe5847e10fdf50ca2f
SHA1 fbe1bc6c5545a07a7ab83ca435ab905fb29cbc9a
SHA512 34f930bb3c2253e4ac87dbfd396ea9e784779d31970a80eb0fff2245073375b9d13d04138388c4160271ff225e0e951ba201a3741054fe4525b858f9e9dfe85a
SSDEEP 49152:sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnAIb1EE6BMB9:W3q6HjBdIb1hR9
TLSH
T19ED59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 f0f470a850dbb3315fc5515b644323e8f59f7d48beda1b46e81427769f29d411
MD5 90b680f1516ebb8f7fd8f7c643cea643
SHA1 9e9d12be9040aa245fb5737d903477d3bf37c207
SHA512 bf125c1bb5daa4f856068a0edb95c3d142e07211465ac63a3f6911c0a5118a4e195ca29c165758a298ec3f0d1e614e7bd61beb34791f8508f0d81fa4a7354222
SSDEEP 12288:x1XLsswWkxy2lRq2czA+6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:/XYfDtczAJ9Sb1E2ZamlZkBMB28kn
TLSH
T15805F12973D409F9ED67827DCCB28512EB73B8554760EB9B03A489260F332D45E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a616df3909559870e29232d0db8055a32134322000e5bb451e2fb211cf5c8267
MD5 27959e4078cc603665167e27133ae619
SHA1 61a2839aaaf88239f992a218034fc6f87bd33b9f
SHA512 d40c764989abe204c619f41d24371824b99573b7f23d516e905119e862453644aad618348764bca620df075fc46cb4e1d939c63250d715f454c7769b14a1d61e
SSDEEP 24576:60Le5ji0hmxirM49Sb1E2ZamlZkBMB28kn:6Pji0AcHIb1EE6BMB9
TLSH
T13535AE16F6748335D073C0B9C5D2A69AEE7130865B308ACB4286C77C7F676E68A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e50d0bf7e8785f7a2bb39aa0699204463d2656d90c03a38d4348abb4c4a0625d
MD5 f447f83a3f1e13b1e21c243c2b90b375
SHA1 e39b3169a65c8205c32d1ff23c69159442b3c5a2
SHA512 d804363e19e61f9b4efc64a3143dea7a9c7ea19c52305e1f796723fdc15416138892e3da74db2f9f1b5076d4948083f142efc95bcbb6728a8f6e7b28b331520e
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWE6q8wyuK9Sb1E2ZamlZkBMB28kn:V/ezSC6vUzPvxHjyDIb1EE6BMB9
TLSH
T1DE756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4302e05076dbaae16d3d68519df72e5118e1d748487fd29a3d5d92ae2236bf1c
MD5 fe06f6405df04f2a5feb55fe973405b0
SHA1 209ea086343a59276d4cc607bdbd4410e47b8709
SHA512 1d900f2133d229b28f1d2bd588d2d4a46f716f900178c820b42c234ed3b06dcb95338d0282180c8fcf8897b1dc1660d271915fd13025d9893f2d09094b55be94
SSDEEP 24576:GVbqPb88hv/l+6t9Sb1E2ZamlZkBMB28kn:GVO88hXl+0Ib1EE6BMB9
TLSH
T12B559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2F676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 6872787b560a481f2976e395122521428033646d0b80eec8b8a8e93bc4110e3a
MD5 339280605b0893be7c49a4f84beb7492
SHA1 06bb13ce9f4c293fda13ad4d3d69ba319af5cb20
SHA512 a6788f05e3ec3e6ca31a2f981d7304a3aad8d877a7e35be1221727758e8bd9a95a594d9a88e962b8199e61307723ca784198b65bef6cbb8f444dedabcc8af11c
SSDEEP 12288:dRB6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:dR89Sb1E2ZamlZkBMB28kn
TLSH
T1D8C4239B138CA95ACB4A5177F8FAA4B26FB18F249C114B5F9740EE074F350A28C374A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 18cd734d59d3b7ede17f8cdf8a34c5364d10ae9c00cbf80551c36683a8989413
MD5 7b164205db3b80ba8fa6f21f3432b470
SHA1 dc5f20ad3ffe1bc281177c2979db8aaf4e4fc973
SHA512 59f226a0c8431f8144ceb4f327c4077ce6675048b5e2bf4e9a92a1b400776acca33db165ff74a452913fae1e0f905672fea5aed85442b003b69b265df8befad4
SSDEEP 12288:teBNUbTVO86Ua6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:tJIUl9Sb1E2ZamlZkBMB28kn
TLSH
T14205CF7BAE28FCD2C27A8DB95A91C640D77278304F6293CBD164C20EDE235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 274cf26ddd5697459125bb49896d51bf4e61776f6c6e54c9565f4fb8e9ceec6c
MD5 5fac33997dadf9d0a1fcf12be27e7305
SHA1 324036828fdfdc8ef8512e9412b406d55102cf36
SHA512 4456238457422eb80f2262f8f911780f698ac671a75feea7cfdfcfed9815f36b2f331ab3047b208a00c024e5583460c211e67f7541fd93742b625b8edf335a88
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THW:HQvGAdlCEL8c/yRNw5CaIb1hR9
TLSH
T1EF266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 594ebc68da666278bed5726f8cc989f9a49bc4c0a253dab1a5083200a61cc157
MD5 ee953308451c4b89e20dd60f0431ab4f
SHA1 c1ffb2381e878f1b01b2e0437c5790ce6d091f41
SHA512 4222a22a8c10e13eaee5a068cba591e846a52db4bd4a392f90cc2bb66579a15e0cf5338af91961f6f7dd5c43f66fd69368ec243aac6c19fb19c7254bb58eef8b
SSDEEP 12288:4AwSfxL/2Dc34DLLmt0LDQewsAj86WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+D+:ddewsAjX9Sb1E2ZamlZkBMB28kn
TLSH
T17E15E031FA74E436C77F0DB61B76C716187DAA204F511AC3E3A88E8E5A301D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 942c06f7b7566c57c69e15a19fcac8705f73aae15624f4fd8877b501dda7986e
MD5 d92ff10dd4ebc51e22cb498415802129
SHA1 7ee2e68a67a096cab2186bf29813f593fb008548
SHA512 1575e69d13155b9314a783262b50ec3e755ac33abbd29d1f112e11cf90c6c8786bd6b4abb256022f006050141acc6b16a770a568ec071c3eb99ee0d96b0067bd
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHf+1hR:ZUEtQevvqc2W1cpV2EI32f+
TLSH
T11A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 57f647ce922132497c7942862545db056eba6f8c9cfb3e575cf1f49ea32cdca6
MD5 6ac8d62a0cbde4bab391899b155f59cd
SHA1 6efe29ba101db8959194cd45624bab8b0647c261
SHA512 040c184480d544a4de2cca99578e8735757a915d8013c97ac5fd9e214695f8cee597efd4b2b1140223b9ecd193da5b69efaeef6b4cfca9ea9965cd9cf513d8ac
SSDEEP 49152:CCbRquA/m2yL5zifFiV+XenmE3/z3Ib1EE6BMB9:HoqHVjnmWIb1hR9
TLSH
T115D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fe9741620db145f2dc965b9d34c8749e04231f2f69f7bc9893eb1bd5a9ee866c
MD5 4a8a0a219bdb66fd8f6c1e45b5f240f2
SHA1 0bec784d763945f3f2c936cafa450c67e4c6f303
SHA512 50478acb115f320bda0003ec13737f9098c620d021a707f6e56634e2153d232ed97654b57e65cfa67eb53742b713aad2826c39cfd754e1eeb5cd8005a7cc6da8
SSDEEP 24576:9AhGLJIFoiwtA5l7S5329Sb1E2ZamlZkBMB28kn:9AMyFoiq5mIb1EE6BMB9
TLSH
T15135AD81E7F955D4F5B3AAB8ADB69171EA76BCA95E31C20F2150C10F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 a7ef0befa3cb6b743453c591bbd99103f7d357eef14b158b8f8b9a8c3c24d65a
MD5 c939c4b41672fb5eb0a7f9077c2cfe57
SHA1 4a2950da0d58ed1163918e272351941c321d4191
SHA512 ff333d3219a7a483e954c8b78b7ed5502f1271a5aee0140d5ac3108fbeb03e04c7b4eaf41d4fe3524fd08b2eed6facf73fd382720cf152c0c4fed8945ab13f87
SSDEEP 12288:bmw5HEjsChNVBFgl0WDm+C36WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:6wuoOWj9Sb1E2ZamlZkBMB28kn
TLSH
T1B205F14A33A81CF9E9678139C5A7C536F7F2BC112A21CB1F1760C65B5F332616D2AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 4c5a59aa6a46edc00455161b9fbe544a058a48dfcd5d0c84d072a5fa2ba10a95
MD5 ed3537340e31f8d7ace68fbedb1c055d
SHA1 3df93f1b84b5ae6975e3b89920036d9b32de9c04
SHA512 a3b52f375b22fcb80809464bcd737969fbfbd684ddae0e08e26fa0eb8a12f7c8a32b692bafc624d19d5db8f632d3875b7d13287371965fb994a919850533f951
SSDEEP 12288:eBZ1Iys6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:YZuQ9Sb1E2ZamlZkBMB28kn
TLSH
T1DBE4129A33D870BAD297423ED8F59551EBB2B866673243CF16108A5B1F335D20D3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bdc7d705d17fe2344afdcfcf539f643664ec37f12065a089595472f8f2bf184c
MD5 11621c31accfd43902f29accd9dd4e69
SHA1 934e2b6d173d58f41ac04b2baad0cf77431311a4
SHA512 7a9e4d6ed95712e315e542ee4e3027e65359c999115da3b81c9b4e5c97bc5c6a5aec8e2a082d3014fb923d70180616fd4deb2f6098a43a6d628545f499d7ccd3
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ua:pQRQyi36YOcPQLvw2gAf+PN3BIb1hR9
TLSH
T132667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3c4d018adc76e7df12ebd9aa2662954b4718c60a73ba3dadf7bd271e9a9a2271
MD5 f5ce3ad34e4cbd0ecd5ee9a8ea4a135d
SHA1 fa9cf218c97e495fba1c80fd5fdd6159115894b3
SHA512 2ecdc073e5c10363bdf41a0639c4d0deb64fc92d179e6831ede2e636495f13f9f6acc08b9f2761e3a330639396a735e960ce1e960c4eeb0d85aa52472b0acd57
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ua:OQRQyi36YOcPQLvw2gAf+PN3BIb1hR9
TLSH
T140667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 79c4223cc8e5468d72859bff5cabd84263e72d9127fdab22f0a603e090db302e
MD5 b55aacc3465e3343a21d95ff613131a4
SHA1 e55243c6929a256f3f3d7079f95e33457439847e
SHA512 9347a57e54408f7f74a6f737794cfb1260379fae37f40b72ab9869eed7d7f7af1fea18a0cc39b77d13110bc82fee60dc484b5aafdd047cfeb2dd42468931d037
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0A9Sb1E2ZamlZkBZ:f68Qg55nhheWu7PNU3/HIb1EE6BMB9
TLSH
T196B54933B2F600A9C44DE1769F4A873196D27C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1e04bdb29cab6fd6453dd1693ee451d0cad10958408daa12d50c71966cb60a69
MD5 eba6cc8f588d08127d2370a5dec2dae3
SHA1 b3fcd823014dea35aadd2123aba15b4465fe39b2
SHA512 ac7923cb49de68cb5fa36d5c4f4a782bc7c93b817d14e59c42bd861c3eb820d7a92e2078cce5eece74b8dd6d6dfb4338200f0af1e33bb8791ab5d7a6b2538a7b
SSDEEP 49152:V3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk990:Uy5112gYy5azzVvL69nLKnhZ8Ib1hR9
TLSH
T188167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1dcb9a5034005241ea6c1b5cdf6c768091a5ab13c82cc8562608f5320cbb0ef9
MD5 eb16eace13615cc96860e4778eaf5d4b
SHA1 8c516eab4055f73e28072439f1e9b4b8b91db35b
SHA512 d0168e802de927b32c51983bba36a88b64c174a6a2e812999ca9ec15e714a1cbf83a9b25d3169fd0b81e421b2043afab8e81601dc13ebbfb377220402f9860e5
SSDEEP 49152:iB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5Ib1EE6BMB9:Qu6JmVxd2d5Ib1hR9
TLSH
T163D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d83a2e0c97dd73a3462f3a4ba309f87034d47f1be01c7b5165e9606d566e4fc5
MD5 3e7c525a1eed4a73fb0e1428982f17df
SHA1 993aae8b53b1e6760b63dffb06e641597ed13ac8
SHA512 36c7bde1624c04cb22d98261c4931b7852aa393f25cfe7094a3846fd2ffa562faede4e4026f2745f70fe14f7ee75bf9d8ec264d8cb6a9d177697f438d97bcf30
SSDEEP 49152:z1hpsNoJpF1A6UU44CwH7R4xFIb1EE6BMB9:zmifPbRWIb1hR9
TLSH
T18FB5BE13F2D801E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BAE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d2e989083b57bee20afe57de00a493004a113c4c879e36ab24144fa4f3b5268b
MD5 5ea8f0209a5e4e2c59b93a719cddfde4
SHA1 a3dfab5a2ca0909e2b65d05bcfd217b3d1e343d8
SHA512 605bfb660aa48d1b2d495343d58f2d9bd03fad4f24ab4626f19b4583c86b494706d70d5bb0b1bdf295816aa0377b287b464d0885421cac22a311ab49aab441db
SSDEEP 49152:KSuZQIY0Be2KRRVtOnks6NMHqQIb1EE6BMB9:U5dKTi61QIb1hR9
TLSH
T1A8C5BE03F2E941E8E0BED6748B769232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 81b00c73e2c8796958a037b628e697a5791843d938887d0abb0a1fc2d068000f
MD5 e7b8f2d3e75f7b9b2838728d4073e4e6
SHA1 3522c1c0a72e026f9555012ac98dfdadc4b9ae72
SHA512 4ba7ad96753359b5c6540287ef2c0c3eeb4d2534f75da7c957f4925a54fc87e387ae830a7fcc781fc246f9fdc9ce9d9fe11e2fc3dc0dc78ad30200afc465ba2e
SSDEEP 49152:MhtSn8EApI0figngiDn0AP5wJIb1EE6BMB9:tX2iyphCIb1hR9
TLSH
T1A895BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 b94772eb86639d9a20767bd81c560c45e4cbe5354b7b41139a5df94ec8b669ad
MD5 092030191c0ba4dea7e634d6568c7226
SHA1 bb925bb4fe632bcfa7716fc619a54e3946d93bdc
SHA512 319932ce690ef518a440e5705d9770132d27f87962fef7026cb3f28c83affecc61820daa7759ab9ef151f26f4999635a3713c59e55c9c936bf030dc3a865369d
SSDEEP 12288:vp6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:v09Sb1E2ZamlZkBMB28kn
TLSH
T15CC4239F228CEA5BC70551B7E8F690A1AFA59F58AD12479FA744DD034F720A20C374F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 740bfa2933434fc610935af1b82c85f4b788945df1d4c350cb3ddee04d281030
MD5 121913c05daf0727cd3a4c69a00c1b38
SHA1 56f305fdf2e5e8a18958435fd1fb7e906fe35111
SHA512 c069cf6adb87b499db5a27b355a4549a9ff815308316bca06dbc556efc7e45acc1b20cdbdee4dd8d6095c45565f19d07d53bda4282164562618ea9b15cf85f74
SSDEEP 12288:Jw6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:Jr9Sb1E2ZamlZkBMB28kn
TLSH
T1EAC4239F228CAA5BC7095177E8F690E1AF759F29AD12479FA744DD034F710A20C274F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 f8523ae74b3af0c3690d94b2db356e4e69a91d939dd559ac228486d0e8bbc33a
MD5 c1caad1bb91de950e5f56eb13d9ff636
SHA1 a59daa40bf7ed30b5ec3f78423748667bf3978a1
SHA512 7e890906093cf5686c5a6998004be14d519e51c132d580c40a203016d534ea2f0019052c4cc06c5a6b9f98efea4b5dd06eb55ad2dbb93c6314db3e77472845ad
SSDEEP 12288:DC6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:Dd9Sb1E2ZamlZkBMB28kn
TLSH
T16CC4239F228CAA5BC7095177E8F690E1AFB58F59AC12479FA744DD034F720A20D274F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 85929cb6ab7acb84b42ce623baa19a9b3aa35af1359cef0b599f15e580149ad1
MD5 e809e2d9defd1e04bf2e1665bdfae5b4
SHA1 c3e64cc95b287c1da55235e26dd1027f464933f7
SHA512 3830c73ba82c00c10cfbdb3452a102c21ce18bf4c347a53a0a6a8e685590b4a9f38e8b17a512a17b66d9098ffd030e80b070dc9ea8434216fc369369700b745b
SSDEEP 12288:uVD6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:X9Sb1E2ZamlZkBMB28kn
TLSH
T133D4235B239C95DBCA16D17AD8F6D0A1EBB1BE64EA3247DF97008D070F721A11C368B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 0b02458816d494130e5fa21dbe5bfcc7af512629524ed8c98a6b3b1ffa5565cf
MD5 0936d5a34b831f0ce9b4c3600df4fc94
SHA1 e84499be35104e571976986188572b79e6318df9
SHA512 e857205fae3a41c6f7bc1a3d6e267674b19606c3994ce5312cfe35b864926ce8604d99f65dd9ee6b1a4224e6e9f377e33f3027ab9170a1cc1790421f1b01d46a
SSDEEP 12288:gb6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:g+9Sb1E2ZamlZkBMB28kn
TLSH
T171C4239F228CAA5BC7095177E8F690F1AF658F69AC12479FA744D9034F720A20D374F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 fb3b24163e782b4d1afda81d91f2cc28e7538f2b78642cd4b2e3e663c2dd2701
MD5 3450566662279cf87ce520bb97b8286e
SHA1 5370a8fbce28e92cb114d74d4d6ea969bd975284
SHA512 7cf75e0320fd919c51f6aa57c4d7b8fa1f4bb52ee30bfc0289453a000df785d73711ce57921c0191ca944c3130ecd7f850c5bd871901e24e555881fd0d3de65d
SSDEEP 12288:nk6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:nv9Sb1E2ZamlZkBMB28kn
TLSH
T164C4239F228CAA5BC7099177E8F694E1AF759F29AC12479FA744DD034F710A20C274F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 3e43832b2069ff32c59ccfaa9f19d9fbaf5e98a7cb3769ac229e1174f170cfff
MD5 31ad086571d7c50280bd3deff713b7a4
SHA1 b4c3ccf50f26bad4e8c24573af002284036aa72f
SHA512 63da599f668ee6cbea9c4911a069a6a47a325401f41a90ca135c3f36082c4a5a69246a5bbd3c4bf874d882f92d018d6bf8b52dc254c7b376fafb607cb1ee1444
SSDEEP 12288:qo6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:qT9Sb1E2ZamlZkBMB28kn
TLSH
T1DCC4239F228CAA5BC70941B7E8F694B1AF759F69AC12479FA744DD034B710A20C274F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 cf4769bdceb4137790f1ebe4691f7c817e8294ef6e1f54e544809c6c212b802b
MD5 f5705df7cdfe5720b67a4115c0bdf7d4
SHA1 ca8e383736d82a88559ac7eff98e7f0f7241f052
SHA512 449167734ab1add6b264626ca6534727c4d8700d0e5c91404efc337680c22b35d536f1031ac3e373617ce9c7cd6b80281af22b24cd09741170d33be16382c163
SSDEEP 12288:6iZwb6zzFEoS2cPvyQ6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:dZMSzFVSOL9Sb1E2ZamlZkBMB28kn
TLSH
T16F050199739418F9DD67813ECC658916D6B2BC294B60CB5F03A436275F333A10C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 40c3e98fc4dc7e0b6e49e9af75591175b86ea0ef080fa4df61bf899e40c81f1b
MD5 ba9ab879f1445c4e9a7fbfe562d0ce12
SHA1 a0ec3d451974866968a7216d43a0e5f01e7d63eb
SHA512 41a1493f367444e9211d82244abde42b310ea5264414767eb5fe598c5bd3b21dca277c8ddc4e570779cca747582b90f4de0d1161bd206dd5ac9837aa60a565b1
SSDEEP 12288:nV6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:ng9Sb1E2ZamlZkBMB28kn
TLSH
T1D1C4239F228CA95BC7054177E8F694E1AF658F69AC12479FAB48DD034F720A20C274F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 586819746adcd5b2674de901221eb8905064f4c2e91f024e4e51af67423e138c
MD5 9309fedcfe727bb48d4d57a1cc83d4f0
SHA1 8713fa0070ef06d07f188a6d91db846825fa4339
SHA512 fce7328ddaf76dbd620b1bc748d7b90c56cc8960752e07261186819317ed0ed13c2d2c8cb941423424c5b0ae4be9038fc17747ee6acfe72b675374b0ba406f0b
SSDEEP 12288:Cx6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:CM9Sb1E2ZamlZkBMB28kn
TLSH
T1F7C4239F228CAA5BC7054177E8F694A1AF659F69AC12479FAB48DD034F710A20C274F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 026c67fe0b2eb977a702cef596e118897a15313106e0d3874482b27e46c60103
MD5 7dc2c17c1869d4f55c7ad527c80a5b86
SHA1 57ea15ee53063ddd06d88ee0cd2a5232eaa4ff0c
SHA512 03a79880946bf6396ab1991f0b3108979a8cdd10b12f86bb280bd663eac16ccf649b91512d30c00323ae64d63767dcf76688c171725ed011608bc552ce10529e
SSDEEP 12288:oyPz5L8s6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:pzyn9Sb1E2ZamlZkBMB28kn
TLSH
T109F4024B33A430F9D1268239C8B25952F772B8354B218BAF57A44A771F332A15D3BB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 cbd76b2a061bb6e02b0d0370cf797951b2f13ecb06f95a791cdbaa25268af47a
MD5 d7b2074834d10cf460289eb1d053d85a
SHA1 be1537cf70d5256351eaaf447aa61b6807f0dc9c
SHA512 75aa091f44b8f035eaeb78ee3b92ca3c660dfad59efd12c02ab03feb9ffcba2660e4596b1589c54975c76a297bcc08c425a1200014ac0bcc2fe8117c7db69e31
SSDEEP 12288:NV6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:Ng9Sb1E2ZamlZkBMB28kn
TLSH
T1E7C4239F228CA95BC7054177E8F694F1AF659F69AC12479FA748DD034F710A20C274F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 e1b84e8ebe144f88dd0e96d3c088945d6dfea98ba479aa9a8f2e8be21b73b026
MD5 1756374556eee84fac9de6f9f5cdabb0
SHA1 f9c167841b490e2416acc90ecd5f89b4fe9ddea1
SHA512 dfd4cae3dfdb5028c32fdcad2354f838ecd5d57a206e07dc98e86e911bbe6ca62782f087eaa0612088690b5bac4224d7796ee96aca34f7725753aba372416b7b
SSDEEP 12288:rV6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:rg9Sb1E2ZamlZkBMB28kn
TLSH
T1D1C4239F228CA95BC7054177E8F694F1AF659F69AC12479FA748DD034F720A20C274F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 e9190825cbdae59cbf6b64be18cbbc8d85ffd2b65930362421c9e898696d5c9c
MD5 21258a9dabdcce6843a72bd1a3643e86
SHA1 aa82e9dd17057d7a79ed3baad240fe25b1771410
SHA512 42d97c625cef1aa1eddf60acec957106d99720a6cc0a8a63365e04d46beebd6588a24c68d3919b4b80893960955f31c158f245656eaa5b83718ba8b64ae58b09
SSDEEP 24576:7CUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAx9Sb1E2ZamlZkBMB28kn:7CUxPTY+8Wg2lIL8lrIUJLWw+Ib1EE6y
TLSH
T19265BE1EA3DC089AD0BB813589518A16FB72782E1B32D6CF1160C73D6F27AE55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 38591b8d5f9cd95516717927a6014c2c40dafb7692a57c7b8874fa19d83ed790
MD5 2312c4aa67b45ce17bc3c2e391771c6e
SHA1 09ae82a024996481092270ae0257aac4380ffd06
SHA512 312c7d4b04bedd226fdcac70a71788337ace71ce96c3a08b8c82fcd665755cae1ac36ad38a1fc18cf6d81a4abe5ca2d5f37a50764691498e4ef4d7a3d86c7b4e
SSDEEP 12288:ANsfl6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:hQ9Sb1E2ZamlZkBMB28kn
TLSH
T185E4015AD28852E9C16E617ACBA68641F7337D2487E1C3CB53C0F93E0F361905DEAA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d84b90dfd1a3ef7fc8d2407eb87a084d493b62106efbb5e1082cee8da248f821
MD5 f77bf88fcae6d4fd19f63f07f48ce10e
SHA1 aed851068bab247f783d369e313429620b34c83f
SHA512 e125ecc262541c4212db2643e9bc2f34022ea1a8d97468d8be5a2ceac04c017867fa5f364ac14124c567660461c38755c4cf0e8622842b0a7ec7a2f092a79e62
SSDEEP 12288:hi6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:h99Sb1E2ZamlZkBMB28kn
TLSH
T178D4235B238CED1BC6295276E8FAD0716B69EF289F1187DFE604DA474B310D24C334A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a60624717e168ffdb46ac204cf0c0279adbf355972143a566140861e43c615d2
MD5 bf2d68ef988eeb5606e2b028429167b6
SHA1 7c56fc075fe778fb7e33a2925c318de04cc9b75f
SHA512 f297fd5c1be3682834782198c07d95f5f7f9f31e105bb39c8994da12f0fcfeed5229cb097c99b235b0b6dd901e95e08042d4c2d3ebccb3e89eaf2a7c0fcd88b2
SSDEEP 24576:r8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC39Sb1E2ZamlZkBMB28kn:oRZwQCyiHiQEaiPnMYIb1EE6BMB9
TLSH
T11585AF1E62DC46A5E0BAD278CDA74407E6B27816573197CF0290C27E1F27DF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 14b6b4936acc57f1732f0639dec707b6c3ddb00ca3e31928c4a7cd06ce272527
MD5 d92576dcbe0aa6aa08175f5adc59abe8
SHA1 170b050d38ff65e9be0a308acb839477c2a6dc1c
SHA512 128eefdd38b6a4aaccbe62df4d7ee4f7afc06e7f6d83d19b0c076bbf45b2145a8319ce9bb0fa4500fa583caa2a811f2a1fc71174fb1e0159daf7739eeb9bd18c
SSDEEP 12288:TbxA1U7KS6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:TbxA1UGN9Sb1E2ZamlZkBMB28kn
TLSH
T1AAE4126F229C28E5E676913ED8E68106D731BD29672197EF2180C23B0F379E15C36E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 af234fbbe63a4be9566989ecd9581bc082c0465d91d49db0c3176ec42297f7bb
MD5 8d79879c4807a4186ea8572d6a6bf1b7
SHA1 b5f7cc08197945c1b4226c538b0bf6cbba76d32f
SHA512 c8d82259d86497b4f5d4ea45c4f9288e7ae5c8bf431bf7b8656512a16362a8dfeea636789311c5fce8363352c3f19010d61cd223545e9b0338c40347121c8572
SSDEEP 24576:gjsmP0yHaqrVqHra44KDzMsrnm9Sb1E2ZamlZkBMB28kn:gjRP0yHfVqzlAsrnmIb1EE6BMB9
TLSH
T1C045BF2EF2B910B9D4AAD136454107B5BB71B82D1F209BCB0170C635AF0AEE49E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 8c29d4505ed05cdecac5ec2e1f80ae366bd39c7bd13e9f6dc6c95072fbd43814
MD5 3264775e8bdeb9948bd656fca143afa0
SHA1 142c8ba0a99a29693fe27e5b7f04fed26845716e
SHA512 02d08eacc5c4737e4aebe0d7198f60c854fc35867d871ad5b37c03ff7fb5f2c27847ef5e7fe7a52e1466d6cd573f4b4e8639cd6a383f44cc4c6eecaffed641ff
SSDEEP 12288:bE6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:bP9Sb1E2ZamlZkBMB28kn
TLSH
T173D4239F228CE95BCA09557BE8FAD4B16B609F249F224BDBA644D9034F750E30C374E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 d76602659b0316269dbb2d1d1b130c09523f1c7da979040d387e648572568add
MD5 54eb2d9cdbf98a832338beeb5b8d642f
SHA1 44f0157b1d3999dbb34549c22a0c287c87922924
SHA512 8208b799f370c3617a4e17104cb43ff90f9ee7cb62e1aff7450eb6c09a5c6cbb46b523a315e1154f38a81c4b59d46cc8bf316eff58e006451e901f3017c6bc3a
SSDEEP 12288:IOb9A4LWO+vAYFT+6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:lpLBUTJ9Sb1E2ZamlZkBMB28kn
TLSH
T14F25F159F79400F9D96BD13DC8B68512E772B85D0760E7DF03A88A561F232E24E3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 001ff5fd02931dcc5ad641f94c090a6cca5875b0060c60c6c83f9536b4ce96d8
MD5 623028c2e5d266c0f2475b6a91e9e776
SHA1 7a8e60306297d923b115551748e6d332678f4bd0
SHA512 138d1e27953a4b2a7bb3778546d72b28bfb416bf8110cec2fc3485c507f5076858c0b071ecc30487a5fd7c5b283445241a53fd601330c5cc83a7e7196d58e630
SSDEEP 12288:a70VmvIYNvUyBp56WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:rrYNHS9Sb1E2ZamlZkBMB28kn
TLSH
T13F05F12F62AC1CE5D53BA17EC9D38119F272B866171193CF05A0C27A0F27AE97C3A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c2f561d4ff4ed8d331885fbf41ba5b434ccd144e7471d4d0b26e8f1f750cb440
MD5 4ec6fe12a29ea9ba866d6a15f689e673
SHA1 d4cb1d62da3122bfc45a55f0adaf459b87265ab4
SHA512 965729029d34726f30ae38072ac47d6560530f36990cae5baf99d091f24b512bb6e5959f6620b2990c09993092dc3b06ad9edf352fb5c6e6dc349016ce75370b
SSDEEP 24576:8nXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK5:8nXoJJYH84VVS6AmEcJas+cHBjSSKHPQ
TLSH
T1E165BFAEA2BC04E9D5BBD17DC5C24506F5B178651331CACF026082BA7F27AF15E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d2b0b352db0ccc3605e192fc8f37d9e7107523402e655e985e6bb515be096dec
MD5 e85de5737258fd47c0b3d2771d0f888f
SHA1 3b46481b3d42b46f3c09a007ea6cf1534491a19d
SHA512 675a0f4661e5faf093e25a173a4615965c743636a416b5b0690e490c37cdb5f058df288394f61c6c7b12becc5cad898a30bc3bbabd5a2c0de93b5d3089397f1a
SSDEEP 24576:Tv7Xbxd9Tuycf8M/TYlSuxrr2PCc9Sb1E2ZamlZkBMB28kn:TDLL9TuJ0M/TYj2PvIb1EE6BMB9
TLSH
T12A858C5EA2EC42D8E47BD6BD85B79146FAB2B855173081CF0290856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 adc723122883d5b9608f481310c5a26f68f235029f54576f5e07d8ed26227ccb
MD5 20e74fcc9360d8dfc64d2073fcd4a9e6
SHA1 f011cdfe38801991c390311a70134d933010f18d
SHA512 fe2081862fe5161b6148494e39d505419289e9885705a68158f605032fd736047ddf88d1a9ead0cc866cb50fa5ad22a380ab6a2f2b643f49ad22f3b034e45fa4
SSDEEP 24576:megJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wJ9Sb1E2ZamlZkBMB28kn:mngOJOmPOHhJIb1EE6BMB9
TLSH
T1FF55CF3FA7BC15D5D03EC17DCA968816F6B1782613255ACF0560827E5F1BEE42E3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 8ee6d039cc52136a6b93a8e12fa46fa27acb3f40f61171a3e5ad00c17d4d9343
MD5 68b1d338e2481cbf938b08adebdb2ed8
SHA1 df14c9fceb49cf7d24bf47a9ccc9196d2aa610d0
SHA512 7403d52d75dc97f9b11a33bd3a0722c5d085214aacdcf69076bec6d064455dfeaa052fbcbd28b8217274ef431f5293b761824bbd34f3275dcdfb7b751a5a688d
SSDEEP 24576:ALJnJiTk3R3waE4JrOv9Sb1E2ZamlZkBMB28kn:ALJnJK8R304lWIb1EE6BMB9
TLSH
T10E15D03DD2A810E8D477C2B4816A5656FF31347C2F226ACB59B4D5313F12EE0AA39F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 581a63ccc37776c72bbfd3da83116fc6a1ce6094786619f8ad0298e9b86eb878
MD5 3731f7fd8581ca2b851853e15cf90ac2
SHA1 2df5809be18f1092eab37c7a9cf0731726fd26dc
SHA512 2196ddbf077112f2ac46abdbd0d717e99c1650010e3d002a301fdf4e49ab2aa9bc06ff8ee8016fea851b1d75e3a3a741786f77faa3ffbd3f0a86f72ce0d8f240
SSDEEP 49152:f9mqCzDScAZmlvTcFg8Ph6TIb1EE6BMB9:DyIb1hR9
TLSH
T1AA955D05F7EB5298E8B3C9F1C96294159B327C409B34F7EF4A80CA6A1E32BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 afdb04000de49dbd3142e85cdb178e6ad7c68d5baaa86519e730bb16a80fbb7a
MD5 2274ed7a5cc6a3c1d429efb4ebbe54d0
SHA1 ad18242b950a58f11345b7c4bcabf287787fb97f
SHA512 f2a121a597b1e9b7436430b22eb00b38fc588dc6833712bec40ba599573643bbefa3d819cee39984e38bb2626b0e567b007ab320f787f39200af54fa50ebcd9f
SSDEEP 12288:JlYJeXm5nkEUuEu6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:JlYJeXm5jUuEZ9Sb1E2ZamlZkBMB28kn
TLSH
T156E4129E329C70E9D22A807AD8F28550E771F574671257EF52E0C53B8F239E21E3AD90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 96e94bd2470684187d0e5bc084306c9802672486e5dfcb2aa8fe75ac82e04584
MD5 b23bade7ed24384c8185038c8eb538f1
SHA1 ef587de2e5460b9d02540b82bc9b6b6735480472
SHA512 8d98e9f04ef3aecc850f60d428ccb1612f408643cf983623c0a53fb94426324ae99d6249446d3d8f9f78346c75efd6ecbbee39a13e0d12af598edd410a0d0f81
SSDEEP 12288:wmu6kyT6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:w7tyG9Sb1E2ZamlZkBMB28kn
TLSH
T16BF4220A23C8A5A9DA794639EDB381A09F35BD309F2147EF51D0EA2F1F322D15C31B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 ab6374f74bfa96af0ae4a452492ce9fb11cc8c8d6aa6cffc9e546f14ec1484e9
MD5 d77ee0698012890f2e433cee1fe11541
SHA1 04b09e80fc86c8770110f481d14176b4eedc0475
SHA512 90fdab5d842c4bb62412135b5cd3dfb26e092003440d8a5a6ce0e938edc3770250de93c9d6281b1dc485123330249cf7298818594afc6afcd549e0cd111c6003
SSDEEP 12288:TP+6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:rJ9Sb1E2ZamlZkBMB28kn
TLSH
T196D4239F228CB55ACA055176E8B694A16B75BF349F125BFF6680D9238F720E20C33C94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 715452597dc617e932fadf107ed222dbe05709c1411113e03eb576f4435bf5c8
MD5 2ac92c817416938e2060b76c74e6777c
SHA1 540863cdd9f92051b70c6245ff49beca99c32d01
SHA512 420bc1021a793ccf18928c2b405ea9f62c724f799863d332a56f8e847c1b5f141692adae26776ad9471aa0ade244f584aad7b70d459810381b6bfbd65bc9a210
SSDEEP 24576:TC+TyQIu93VAumZr7jmw9Sb1E2ZamlZkBMB28kn:T/TfIq+YwIb1EE6BMB9
TLSH
T189559D1DA7E91DCAE276C575C8A34493EA33B871137186CF2044C07D4A9EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 09c508c2a073788e42ef9a2a29f5f7a5ca0af818d7fa98e61108d0bbbc46b5da
MD5 5d3800f7b7258af25bc893a1d8434afe
SHA1 b316d60e1e87eae06d7bc0dab7c0757cfb2de4c2
SHA512 47da0b5b56f512b224d3aa536a3367ac6850b4a833d1926b61c69a507e0f49383b9183b3c21944d9daa8c55ce2844b18afa0b7cd7d2a4b7c3d1b109de73ab018
SSDEEP 12288:LcyrWOstaa3kcsq6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:6LQikZV9Sb1E2ZamlZkBMB28kn
TLSH
T1B0F4F00FB3AE10A6D167813CC8968152FBB3B434571267DF4290CB7A4FA71E67D38A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 bd9becdd2272209a60cf4354e175fb33e33164fed6cb2d96296361ac97140585
MD5 f4abf7cd6cfc5987fb76e03032c21f70
SHA1 616a9288f8521247a67efb859586392d3a66a5f2
SHA512 2ad4e2ff73a86d3a3d8bcf507d4a4e2aad6f47e64921a9ac44923899593ebdac2d6d895e74496a70d4997bc0c0600dcc6da97f57850857b957d52a647b138cd1
SSDEEP 49152:rpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPGIb1EE6BMf:ApC7b4+80GTk7Ib1hR9
TLSH
T171A57C3DE2B8106DD9AAC376C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 271c8dbd7dbc10abd7b6fcb65d72d43ac01693ec4191f300951e925acc0bdfd9
MD5 a02355314e59a1e90c447d304ac7568d
SHA1 3ac497608f49c7fac0906c110f334cdbe54abaa1
SHA512 a8c5f520a551d8690ce9137c46cc51ae8b39889bd9d58de1c9e064d07cb8b68bddebc0a6dd8d8ca8d6f7a454f51fbd40496a885dcfd8456247a34c8e2b024d7e
SSDEEP 24576:9SAwJPE1IDAo+4Kt+l44135UQe9Sb1E2ZamlZkBMB28kn:9qPCIo4Kol4/QeIb1EE6BMB9
TLSH
T16555B02AA7F956E5E17AC7B4D663C511FB727822133163CF9290813E0F169E85E3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 d86c050673c14fd08b866258f18bd1ae38972b36093e3a522f08e412099e3d51
MD5 f9199b1bbfa4dfa451762e6cbc52a053
SHA1 4ad0f69579f41829c358c95124eb3abcf85395fa
SHA512 d48e69ce21bb7ee78a6475d08b5648301feba19198118b6e4f297f067ddae6e009b05a1dba492bc78ef68c784c6b7c6e6e072ffe70cc787dd7b0fef65c392533
SSDEEP 12288:ASsyLCFBoPLCRyf6NQ4tr6WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:4yLXPLcM94tu9Sb1E2ZamlZkBMB28kn
TLSH
T1F925E13EE76C08E5D47AC27CD6A38506F67238AD033166CB15A0957A1F67EF06D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 4b6ccdc45fcd78856be76bc57cee7871d03a072e099f166640e6adb20a7bd6ed
MD5 502e3ab086e7abb98471736fca362b11
SHA1 de06115970c2ecebea9d2fb8bf6a82fa8f5d4db5
SHA512 fd0ba8a59ae81333e42c32a46be84dfcb6affa5f2c968b008054e4c58984aea048c357404934100dfd792b2647fcd9a3c2bcaba1b1ddc67149c4f709334af8ce
SSDEEP 12288:M9lyvj3IkxjbBz66WEuZUSEEVn5VdEkX0M4xmlZk04MqO2/k+Dn+:MWv8qjpF9Sb1E2ZamlZkBMB28kn
TLSH
T164F4125F22D86899E1398234E8B6816196B1BE3617219BFF71C4D97B4F315D18C3FE20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-220-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/956-215-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/956-209-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/956-221-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/956-223-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1192-488-0x0000020C85B10000-0x0000020C85B20000-memory.dmp

Download

memory/1192-492-0x0000020C85B10000-0x0000020C85B20000-memory.dmp

Download

memory/1192-487-0x0000020C85B10000-0x0000020C85B20000-memory.dmp

Download

memory/1192-493-0x0000020C85B10000-0x0000020C85B20000-memory.dmp

Download

memory/1192-486-0x0000020C85B10000-0x0000020C85B20000-memory.dmp

Download

memory/1192-490-0x0000020C85B10000-0x0000020C85B20000-memory.dmp

Download

memory/1192-489-0x0000020C85B10000-0x0000020C85B20000-memory.dmp

Download

memory/1192-491-0x0000020C85B10000-0x0000020C85B20000-memory.dmp

Download

memory/1816-44-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1816-94-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1816-102-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1816-47-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1816-100-0x0000000001610000-0x00000000016FA000-memory.dmp

Download

memory/2028-56-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/2028-181-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2028-50-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/2028-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2160-77-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2160-71-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2160-84-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2160-86-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2160-81-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2292-138-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2292-267-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2292-148-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2292-144-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2336-129-0x0000000000820000-0x0000000000887000-memory.dmp

Download

memory/2336-476-0x00000000013A0000-0x0000000001404000-memory.dmp

Download

memory/2336-146-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2336-134-0x0000000000820000-0x0000000000887000-memory.dmp

Download

memory/2516-116-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2516-115-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2516-247-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2516-122-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2524-324-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2524-171-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/2524-168-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2524-162-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2780-283-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2780-274-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2780-485-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2780-280-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2780-305-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/2780-289-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/2780-322-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3704-478-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3704-256-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3704-250-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3704-259-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3940-188-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3940-187-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3940-194-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3940-457-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4128-244-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4128-238-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4128-248-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4128-475-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4456-473-0x0000000002C30000-0x0000000002C94000-memory.dmp

Download

memory/4456-1-0x0000000002540000-0x00000000025A7000-memory.dmp

Download

memory/4456-0-0x0000000000400000-0x00000000005B4000-memory.dmp

Download

memory/4456-8-0x0000000002540000-0x00000000025A7000-memory.dmp

Download

memory/4456-80-0x0000000000400000-0x00000000005B4000-memory.dmp

Download

memory/4624-401-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4624-173-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4624-179-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4624-483-0x00000000017C0000-0x00000000018AA000-memory.dmp

Download

memory/4624-182-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4732-472-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/4732-198-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4732-207-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/4732-204-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4748-268-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/4748-261-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4748-484-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/4748-269-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4828-19-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4828-114-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4828-20-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4828-12-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4828-18-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5188-218-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/5188-87-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/5188-88-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5188-97-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5196-186-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5196-66-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5196-60-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5196-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5340-109-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5340-112-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5340-103-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/5340-219-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5364-35-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5364-36-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5364-26-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5400-232-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5400-226-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5400-234-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5400-474-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5728-151-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5728-482-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5728-477-0x00000000011C0000-0x00000000012AA000-memory.dmp

Download

memory/5728-481-0x00000000011C0000-0x00000000012AA000-memory.dmp

Download

memory/5728-282-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5728-157-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5728-479-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5728-150-0x0000000140000000-0x00000001401C1000-memory.dmp

Download