Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/07/2026, 19:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe
- Size 49.0MB
- Sample260722-xyydcabb89
- SHA256 4d113f2a30f907e8c27d9ff29b98b6d19f8fef7f4f9689b24972920b9fd49f3a
- MD5 bb73d39bd63ace2be3deaec18ed09044
- SHA1 9057a9d36abf01498a2eb1d5884025207913dc70
- SHA512 460f3a084342b32120db4d5b10b3f40cee7761ca54d749d40e0c62895256527ab33493d2b1612a12bc68ccfef0209ce33f4174ef6247422020a83c7548efafb9
- SSDEEP 786432:vHvdIIEn7cdkk56x3VIvMMOui6eDM3DJpIKM+/EDme8q56Pl3XNOmI+Cn8E9UDvV:vPdCnoKPVEOuTeWvEae6SmI+Cn1yvHR
- TLSH T161B733225781AC37E232AB3540FBDA7027F67C7E1E47449E36612928FE79780191BB4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 24 IoCs
pid Process 5076 alg.exe 3844 DiagnosticsHub.StandardCollector.Service.exe 684 fxssvc.exe 508 elevation_service.exe 4564 elevation_service.exe 1340 maintenanceservice.exe 4512 msdtc.exe 4916 OSE.EXE 4708 PerceptionSimulationService.exe 920 perfhost.exe 2460 locator.exe 3508 SensorDataService.exe 3900 snmptrap.exe 3756 spectrum.exe 704 ssh-agent.exe 3156 TieringEngineService.exe 2284 AgentService.exe 4024 vds.exe 1248 vssvc.exe 1056 wbengine.exe 648 WmiApSrv.exe 2060 SearchIndexer.exe 5116 setup.exe 4288 msiexec.exe - Loads dropped DLL 4 IoCs
pid Process 2760 MsiExec.exe 2760 MsiExec.exe 2760 MsiExec.exe 2760 MsiExec.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 23 2116 msiexec.exe 26 2116 msiexec.exe 69 2116 msiexec.exe 71 2116 msiexec.exe 73 2116 msiexec.exe 75 2116 msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in System32 directory 36 IoCs
description ioc Process File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\af48b39d7c8d181e.bin alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000967cf0c50e1add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009da035c60e1add01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2ee62c60e1add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0e15ac70e1add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad0138c60e1add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000beb691c70e1add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002170e8c60e1add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e2b20c60e1add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b67fcc50e1add01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3844 DiagnosticsHub.StandardCollector.Service.exe 3844 DiagnosticsHub.StandardCollector.Service.exe 3844 DiagnosticsHub.StandardCollector.Service.exe 3844 DiagnosticsHub.StandardCollector.Service.exe 3844 DiagnosticsHub.StandardCollector.Service.exe 3844 DiagnosticsHub.StandardCollector.Service.exe 3844 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe Token: SeAuditPrivilege 684 fxssvc.exe Token: SeRestorePrivilege 3156 TieringEngineService.exe Token: SeManageVolumePrivilege 3156 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2284 AgentService.exe Token: SeBackupPrivilege 1248 vssvc.exe Token: SeRestorePrivilege 1248 vssvc.exe Token: SeAuditPrivilege 1248 vssvc.exe Token: SeBackupPrivilege 1056 wbengine.exe Token: SeRestorePrivilege 1056 wbengine.exe Token: SeSecurityPrivilege 1056 wbengine.exe Token: 33 2060 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2060 SearchIndexer.exe Token: SeShutdownPrivilege 2116 msiexec.exe Token: SeIncreaseQuotaPrivilege 2116 msiexec.exe Token: SeDebugPrivilege 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe Token: SeDebugPrivilege 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe Token: SeSecurityPrivilege 4288 msiexec.exe Token: SeCreateTokenPrivilege 2116 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2116 msiexec.exe Token: SeLockMemoryPrivilege 2116 msiexec.exe Token: SeIncreaseQuotaPrivilege 2116 msiexec.exe Token: SeMachineAccountPrivilege 2116 msiexec.exe Token: SeTcbPrivilege 2116 msiexec.exe Token: SeSecurityPrivilege 2116 msiexec.exe Token: SeTakeOwnershipPrivilege 2116 msiexec.exe Token: SeLoadDriverPrivilege 2116 msiexec.exe Token: SeSystemProfilePrivilege 2116 msiexec.exe Token: SeSystemtimePrivilege 2116 msiexec.exe Token: SeProfSingleProcessPrivilege 2116 msiexec.exe Token: SeIncBasePriorityPrivilege 2116 msiexec.exe Token: SeCreatePagefilePrivilege 2116 msiexec.exe Token: SeCreatePermanentPrivilege 2116 msiexec.exe Token: SeBackupPrivilege 2116 msiexec.exe Token: SeRestorePrivilege 2116 msiexec.exe Token: SeShutdownPrivilege 2116 msiexec.exe Token: SeDebugPrivilege 2116 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2116 msiexec.exe 2116 msiexec.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 5116 setup.exe 5116 setup.exe 5116 setup.exe 5116 setup.exe 5116 setup.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2060 wrote to memory of 3136 2060 SearchIndexer.exe 113 PID 2060 wrote to memory of 4380 2060 SearchIndexer.exe 114 PID 3192 wrote to memory of 5116 3192 2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe 115 PID 5116 wrote to memory of 2116 5116 setup.exe 116 PID 4288 wrote to memory of 2760 4288 msiexec.exe 123 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_bb73d39bd63ace2be3deaec18ed09044_amadey_elex_smoke-loader_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\setup.exe"C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\setup.exe" /msi DISABLE_CACHE=12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\AcroRead.msi" DISABLE_CACHE=1 REBOOT="ReallySuppress" PATCH="C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\AdbeRdrUpd11006.msp"3⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2116
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5076
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3844
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2468
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:684
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:508
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4564
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1340
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4512
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4916
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4708
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:920
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2460
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3508
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3900
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3756
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:704
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4112
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4024
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1056
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:648
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3136
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:4380
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 12BB4F895C688BBF5F649595C05E9EC5 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2760
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRAMDATA\ADOBE\SETUP\{AC76BA86-7AD7-1033-7B44-AB0000000001}\Abcpy.ini
- Size 625B
- SHA256 af11d1c4c646236a41aacbbfdd3cbba81f95f92b9ecdb44f6d5932c73f14c7e1
- MD5 c9877af1489c4f233ed27df03c6237d1
- SHA1 eed385248ed9dfcbb1e3e276a5554f17566a9127
- SHA512 e76ad1a5ec59da124a7b9789e3b29a53c078927c8b94a6ed9957e226167c1002eb9aad41a13ed0391117232c60f28027ceb3c3248744c70e7ccbc6a7a77cad44
- TLSH T1D6F0C28A96871C6A205263CF92B66AC5A470F140C260343CE12FF065022DA1403B041D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 e541213b363546265d3efd8a4cb6c252a72146aaa3249723e7721384008c1c76
- MD5 dec0b8c86c18337b5bd3782635034ff2
- SHA1 52e27d7f4b2e0307096bf1c025ec946885012578
- SHA512 ea5a516bd9633ebc94e65372bf5d7a1b14050c6dc0e53de4904f55eb4de6731ed50e87eff975f7e62a986d294ea1e8e8f0e80784ee1fdf43d91b22337269e154
- SSDEEP 49152:ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxndDmg27RnWGj:w3q6sjBuD527BWG
- TLSH T1C8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 ab274fb48070385a85cf3f5c2be0866539e311f0ab7c9e56b366f888e4fd3f99
- MD5 4431ac926b77ec3520e4af5df4151ea2
- SHA1 5654885ca43d65fb681c467129a07f2854125def
- SHA512 7d4de72ce35209c26c580fbf76fff6f66f3e42d33d3a19cf03d36b9c9df92887a062f8087e59bf29c6641fff32500b412e7a39e5ccd31df70c6f2f378fa30f48
- SSDEEP 24576:1XYfDtczAmsqjnhMgeiCl7G0nehbGZpbD:gtcfDmg27RnWGj
- TLSH T17D650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 b3dd769ab9b2ae68c0257b7f6c096de94443db163bd2b39db350263632fc10b7
- MD5 b69413b7ced23101b569931e83b75155
- SHA1 db3462150a9c09b3afad10b0ec6e4b2224d372b4
- SHA512 1e2f25bbbd391d6939820f88effa8df90a8f2253b10931c4e441251f455c4a7a5b14cecbcc07a5a9f4672f6ed57ba0c123e215085885f4b13e3b0148526d1466
- SSDEEP 24576:U0Le5ji0hmxxrMxsqjnhMgeiCl7G0nehbGZpbD:UPji0Aj4Dmg27RnWGj
- TLSH T124859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 e187f2fe577523328df598ab6b4e41ced474eb2f9f3a94bfef0819b2592a3e90
- MD5 4b4765e95427b3f83d78e04e52ce86e8
- SHA1 6632de1ba4089f2ea5a392e1e3192e529889aac4
- SHA512 3e06f4df8f913d79d6d1ae2a0f80b778a5b0c3dc65b2647a82697c381e5535a1400404084f51971eda457baee6cc34b8d0593344f9f91b9ff4ab16cf11631761
- SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWn6q8wyubsqjnhMgeiCl7G0nehbGZpbD:f/ezSC6vUzPveHjy0Dmg27RnWGj
- TLSH T127755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 9d1389f34b361fc35267e737977bef0b1587e9053da63173e7804defc15bef1c
- MD5 5a1dbfee6f13b3472fae54678be2b8e6
- SHA1 2e71bceeab3b0cf23187dc54c37a6d2a3f202e0b
- SHA512 a02ce8e6793773437d0a6a16a79513e4064efd948f8067af5014df56dc5fadfc7107b15426d19366f5d2cb2d7b86e61d27a933a6056d04d792e7e946efad8c51
- SSDEEP 24576:2VbqPb88hv/l+YKsqjnhMgeiCl7G0nehbGZpbD:2VO88hXl+nDmg27RnWGj
- TLSH T115559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 d2967c6718c1c988b82b964233e8a332d575c75883e8dfc238fdd0da28ed67ee
- MD5 b6e406f0876910b1e02ab7168e8999d4
- SHA1 d685fbc55763bf104659497fd9d766b165a56984
- SHA512 90b0833c1377dabc511ab370503e9741776de549cee502a7a1593af341f8a5e059934b5a50395e35ed9f5ef1f090b77c5ac43c191085e8ce747e57407bffba0a
- SSDEEP 12288:oLlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oLlsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1A24523BF864C50CAEB7608B5C3E9F11DAC137E56982008536AA37DFEE5B5458CB39023
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 9fc494e054df6785bab0bf24e0c82427edfe78039eb37c5f48cdd6c6bea2f212
- MD5 cc69f23342a2fc98d17ce152c6056eb5
- SHA1 dc957d7869fab975fbe82ef6654cf0172a592ab5
- SHA512 284e1d55279f767df947a4318000eca4e9fa09d43944db4b7a4e267c5ce1aefaea7aee1261a55397e62ea4e5a0d03593dc4f0597ed9d65c6b3aa05001dcf3bbb
- SSDEEP 12288:deBNUbTVO86UCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:dJIUCsqjnhMgeiCl7G0nehbGZpbD
- TLSH T16D65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 d2981e4d496fee0d0a4d14243f9ffb2513ccebd9756bca19101bd7dada8715cb
- MD5 43ff96cf9993b159538fe2df3d350430
- SHA1 3f5f39da2001ea6c46e4fff41a9298608b852cbd
- SHA512 7827c42cc1bfa40a4e4f2537abbeff2eacd0a6207658b381bd5f5f7b52803dd9a34e66cea75e25ab45ebb9c9d146da2780284da0616e1d16ac42d25cde781bca
- SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THl:rQvGAdlCEL8c/DRNw5C/D527BWG
- TLSH T1BB266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 a768b533740e089e4ffe5a291505509c065fb14904a4352d2f99024d4fbb1772
- MD5 101be4920d0d5f27d506ca724c109e1b
- SHA1 30489e5207f6ddba115cb8819aa4f86fc4d490bc
- SHA512 bdb7d7131bf2ef5d39c16953b591fb71b42d63a5ee21edc58d472cf2498858a1a736190972bfe3acd5206ef1191d69eb27c4de98069132ad5309fe98edcd2505
- SSDEEP 12288:3AwSfxL/2Dc3RDLLmt0LDQewsAj8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:Q0ewsAj8sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D275E031FA74E036C37B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 395ec17f4b4fd1c1103e1d9cb2240a57c0f0da7522f33e6d28728c3c04ccd4eb
- MD5 bf57cd0a0cd01977052c6a80ca3a75a6
- SHA1 c43265b1489c0b29793661213f26b07881f95e89
- SHA512 020862ddb53750d103a156b19bd3e742ad3aaa8fe658b7921ce8615e02b0c1eabda64898f45b6e167d5bec827ca27bc7c9466c067590e4d7f15dc297fffc77ef
- SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHAVQBWG:tUEtQevvqc2W1cpV2tI32HB
- TLSH T113474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 df9dd1eb94d63ece6ee7a1847376dea123972ff846596b3547b13d57b0638000
- MD5 440342aa07ed38af4f3f11997db1d9f4
- SHA1 be8af7e9ebc45d6d4b983ed99ceecedb0981c535
- SHA512 c5c72f9456302fc6b1a1bbc60a34b652b1c41dd1aeddefcc8cd7bddce157e8212e7b0ff4ee533b495f69f7b7cf6facd0033db4c81b96468b0c46054b7b548fc6
- SSDEEP 49152:QCbRquA/m2yL5zTfFiV+XenmE3/zIDmg27RnWGj:5oquVjnmLD527BWG
- TLSH T14CD58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 bad74d56170ca41693afd2495b41608de2faae55b3dce12867162829cd2aa86a
- MD5 9dc1af60884c6ff55c326e015d29824f
- SHA1 5c06a91ca1ebecb26df6137b1407edf9b4c89497
- SHA512 87474073058b8f9b9ca2a01178ed3f75defa32a17b891ffadc763fcec7dc17e369dc85c58f61d9e65ccafd4077c512d053744d6d7fa9bedb926468397b15cda8
- SSDEEP 24576:eAhGL3IFoiwtA5l7S53XsqjnhMgeiCl7G0nehbGZpbD:eAMUFoiq57Dmg27RnWGj
- TLSH T1AD359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 2ed9dd3c7a72ca872878b499fa34729564bc6935e09761c1a3e623a78c4ae912
- MD5 4b8f1823be98912df89f87b678e519c3
- SHA1 c05728a083a318e1ef12d1139b08b28bcfe2fb9f
- SHA512 267bfed53e32cd7c794a08969774d303a6479d9b02f3da3912daa4351cabfd997edf4d940ba76219e858cf8545fc79c5059d6f1e3e452081b40fb85f49c555e0
- SSDEEP 12288:emw5HEjsChNVBFgl0WDm+C7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:3wu4OWosqjnhMgeiCl7G0nehbGZpbD
- TLSH T11E65F15A76A80CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 1d5c5f0ad404abb44612dec5348fec6d3ef41eb75c3fbadd75c3a8928bdd8527
- MD5 a5d3f35f58fd7dbc9d7475dac459a416
- SHA1 b2a1a455099bc268d199356b7d4728048d8b32f4
- SHA512 fa9de8d28b6867d88d0d61989a53d985616c0e19827b22fdd1ca99836d903d6d0312e1c87293e1221a254ce289bc3286b8f29f9908f8cf9e07afb5ca408c1d00
- SSDEEP 12288:8eZ1IysXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lZuJsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1555512AE239820FAE1A3417CC5E5D609E7337C62673003CF166659AA6F739D44E39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 03204431913a04cbe2b6f841437a4bbdb4f2b9d39405f86189042adf16bfc28e
- MD5 f28e4661fc2c902124ad7b5ab0c28107
- SHA1 5541dff195705b68749224e8b36266c335563ef3
- SHA512 a2feb9cabcc049494022e55585b17f9da75a03edb3704705fa5731600b3c37a3f3615c45d284e022c80ac985a3a8e57dee8acb89724ba6369ecb3c239c95719c
- SSDEEP 98304:sQRQyi36YOcPbLvw2gAf+PN3SD527BWG:zQyiKa/X+PNiVQBWG
- TLSH T171667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 75062fcfc4b130f8844b556da823ed7215b24202963825e1aa04911a2dc20128
- MD5 75683ebb90063694932e40c08478a73f
- SHA1 a0ac43293e19529953c390440b0903a10cfe5f72
- SHA512 0b507b2df9b86c6cacd9357c2a3be63fc7dce87888abda542a0e534c70d8990abb82d749560ba58e1b694e9997c1a69668c6b0f6e2cce529935426e7dfa7af6e
- SSDEEP 98304:RQRQyi36YOcPbLvw2gAf+PN3SD527BWG:IQyiKa/X+PNiVQBWG
- TLSH T1A1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 7b1946fc594a5248022dc6afab3bdf0d525815e7f0a4ad4909a590169ae0c737
- MD5 efe756a8cd5b1c2030e9a84fba53636e
- SHA1 a582d587980ac03eb327fc4ae47fe95bdb8ada80
- SHA512 b6a8e16065c183793b1722f5768a6955265282441fb56004a5eb0e8f20e118ee7258839cea7b04d7f472ad58b105d709ec155779358e79fb7aaedd203c3485df
- SSDEEP 24576:UwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0ZsqjnhMgeiCl7Ge:a68Qg55nhceWu7PNU3/4Dmg27RnWGj
- TLSH T106B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 8925b5f71758cc8e456de6e16cd0a7d7841c44b56e4c372d2c67a8bb84d35c17
- MD5 f13d513946447bb9eb80f053ae327ca9
- SHA1 ead2ef3e0845458b8773309d352316f6d27afa88
- SHA512 c29d1688c1306ac50b543373974e60a238fe1a26e30595b2f284fbad22d2b08555f64ee1824b940751373782fa427cca177fcc6707367135a7f77a5ed7395f8b
- SSDEEP 98304:By5112gYy5azzVvt69nLKnhZZD527BWG:cLIHEWhDVQBWG
- TLSH T134167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 b3ad881d252a05a5ec04d79a7858cff64b5c1b1ca1e6e90f91d5b7628370170c
- MD5 78991acf8438ad7999d0af9b0fbfe337
- SHA1 960bec8e66b7d3421b01cbb63f7308d4774646c6
- SHA512 afd8637e1a9c9c8f01860aa8e5644e98c3c610e2c26e276e351b7bdee88feaa6ec81a8e436ee8ad9fa6eafa71b0f7b31b09fc78837c558d382b94f2aa1a8848c
- SSDEEP 49152:NB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl6Dmg27RnWGj:Tu6Jmdxd2d6D527BWG
- TLSH T131D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 2ffee1a674f26808632b7930a5851ad0306b2e9112bc9d445c18ed830e58d58e
- MD5 0c5cb9fbd59cf85696a5318cef7d24e9
- SHA1 ad8c3407882b0721ca0e36e3c960d3e82e086fac
- SHA512 34b5fc3103873fbded7b90c0c75f9eaa968763eaca3b7b65de2c679e7c0a8a775be83978ea2390d7b2e4d0f685e5d70168813096c5593e5e55ff5a7a52901df1
- SSDEEP 49152:J1hpsNoJpF1A63U44CwH7R4xmDmg27RnWGj:JmifPWRLD527BWG
- TLSH T1B9B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 d4ebaa6b449664cc11a8016e1af1ae320f2b11abdaa14055f3b03723b4a0a83a
- MD5 940f307c1e19a22f29438d541ba45d87
- SHA1 4ebdcd5a738e54fa69a30045e8b2b4e0389aa048
- SHA512 b180a09908a32062a4cb58f0f91c363bd2a6f7997baa69e4d59081845c00507860a67bc31e8c6f985ea0ea596caeba8e3186b5163de707c212381bafa02f13b4
- SSDEEP 49152:5SuZQIY0Be2KcRVtOnks6NMHqNDmg27RnWGj:X5dKii61ND527BWG
- TLSH T14EC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 391263cef794719073747d38fca0feeadbea5f571c923362268e6483dab91fa5
- MD5 5a539be4c616ef85266fc08ffc24619e
- SHA1 dd6f570bb740686b3a585012759ed2812d77735e
- SHA512 e8f9616acdd500e3243b10c51515a0198725ed3b3ca9f694869f9897e10511d7c6f5f4565e0ceaf48d549c5f6125a273dc6dc618f9389b6aa70d79af184d587b
- SSDEEP 24576:dcP4mcvIjkGOxhKP2l71SNKbrh/8KBBsqjnhMgeiCl7G0nehbGZpbD:iP4m4IpOO67N8K/Dmg27RnWGj
- TLSH T10465BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 fbd6d5060dbcdeba28e698582c412ab17e1a29df6a3573c8fb6a49a839256de4
- MD5 060cd7cee85fc2130707e46af58c5217
- SHA1 eb4488691f08b34f1991c9ed4240060669390f22
- SHA512 7d17534937fa14e73d34f19bf42b079b4f5335fe6c27404c291d6bc7d9242f831dbeb6f7792197807f86e2fa7c2136d134f7e7192912926a18ac0d649b1ce031
- SSDEEP 12288:fbsfJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yJsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D655015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\AcroRead.msi
- Size 2.3MB
- SHA256 231604792f4767dd20f2d03c0ea6ac5cf4bcbbf1207565297eea7ba9cab2d05a
- MD5 76d9923b0fb82df1e2a9bf42d0185607
- SHA1 15f8ec8d55ac2e262b43c67199bc6cc26fde9225
- SHA512 1331b2134d4d1430b9fd31c479406e736a5eba9c7299233d5ddcc4f89a818d328ea7ffa463ee51382a95c7424304887d91ad3840df814f05c51f4682b7eb0dc1
- SSDEEP 24576:hRoDiO66hRaR55f/Xqs4wsz/QFpO5mX/DP49CM4HrgAFamGb:hRoDlhgp/R4J/d0coJHDFzGb
- TLSH T12DB54B42B580847FD203C73248B683A14566BC7D0B7E524B3E98721BAF76BC361A5F5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\AdbeRdrUpd11006.msp
- Size 18.9MB
- SHA256 e308f5a938b29c2d9a359d26712ad543b71ac6a0b57313b0174b3af577da2c5f
- MD5 4c585337e2432e1df6dc76e9953abe4a
- SHA1 61d8ce50296c70e3214530d7c1e09a6add3f0442
- SHA512 9265b200f7445798b535e69a2002cb66654ff8e5e9617680d09d05d66c419531f91d5052909b42c2e6202db3f0b486d9e6e5216d853034282b1605d32df18422
- SSDEEP 196608:YnVxNyuUoqLKwtwW4/u17lOLkIC6OHhKpk4XzSV3OfLheA/G57DwEmAelGz5:YnVOuURaW4/acpkC4ILh9gIflGz
- TLSH T1F917C08137E4A13AF2F32A70AEF685264A76BC71AC36C00FE2D5564E5972740E934737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\Setup.ini
- Size 207B
- SHA256 2420c82fa210b9d5c0625eb0bc77b1243a9ad8961af5c9fbf682bc64615a1fb9
- MD5 b8eedec9ba30c7ea5d4735f493fd527d
- SHA1 a86732af7c599862537deff66fe7330e3cfc3fe0
- SHA512 bb4db052caecca821bb8c9450ef3edf5d647b6aa871b92e6487234f414686c4fb772046b48380bb9400597c4720f36cdeb0fa4c9ad25409b391413abac9d4726
- TLSH T135D0220BD305A8ABB84423B5A4DA092832FAB1484483D144A08E930FA9640B283AC0CE
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\setup.exe
- Size 356KB
- SHA256 058ab7dfc46cb3fcc8f0bdd47ae965e15cef5cfa1a35313f8389cea4f84472f7
- MD5 02df64ebf3dbab6979e74e420076480f
- SHA1 3639c5562950fba08cca0e50b3912e7ccb268f29
- SHA512 62321ad8c8c1f0d5cd642a0a8b5aa660090d8bc30ce3472eeee91a73125c297642a6f3f5eae197c9d9c3312f36f4b1f41757ebdfd182a29a66e079657b0a68e4
- SSDEEP 6144:BlIo1bqQ7pjAkcc+kLQkxDGLMWHCq79Zh34UH/ath3E4:vxb8c+WxDGQWH179ZBXH/E
- TLSH T10274081277F58035F2F36B31AD7582714A7BBC61AD38C20E23902A2D5EB1A90DA75737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
- Size 5B
- SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
- MD5 5bfa51f3a417b98e7443eca90fc94703
- SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
- SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\20700\config.bin
- Size 3KB
- SHA256 75d089c909c20d7184b244e8e996b1226dd2070014f167055d85f499d18f49c4
- MD5 deecc47cd7a5e23eb05e95bb0286a96e
- SHA1 a2ea1b6025eacdaae17de3602b30f7b60021ba0c
- SHA512 76750dc76a21cdae13747ac5c53961f34ff4757469e8e51c60b84dad14ec49b95e878d27a6dc0169d391548323df0acd348a7997f87fd70ee070c3c533819e44
- TLSH T1F261D71537F91228F6B3BF54EFF4A0668B667ED19939C22E9191020F0DF0940C9A2773
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB3BB.tmp
- Size 52KB
- SHA256 459f503fb8b4fc4a600261430ac77bf70118d41fa19f7b2620d43ba6e9c8fa5e
- MD5 4a908ee9c6f2f4aad63382cccee731e4
- SHA1 e572580949f277987fe232757ce88c2ac35e0223
- SHA512 75ba5856df7ed1457b6192e3b12c5dbb9cd0c6860d787357b37d5e2aabdd1dddb1fd6195064cad1b166431a71dee233b76cb6304d8e868050d79c731ef6e567f
- SSDEEP 768:Y0J8+QCTqaxxKkUmFVSarTJym3OZESrcvFKxLHlx:OCTqYttXDJT+lce/
- TLSH T116338D017DD240B7C78A4A7121E69F2B5F3F7A501FE104839FB15D9A2D367E0923A24E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB4B6.tmp
- Size 73KB
- SHA256 0b99a15c787878ae606ff7ca2b15edc795995835bd213d7a118f50e975e2ed33
- MD5 c4d603c70e32fc67babfd98017dc4198
- SHA1 a6d550ac5bcc79c645761de063b751f2a7d944f9
- SHA512 6c4e9a0251d1dd66e7ea97a3099d5160e406f286c06e3116b061b732c61a4dcbccb8f8406ae676dce05f7fe001c30e2034529b8331e0c74fad9301a6ca412fd4
- SSDEEP 768:AS6y9B+SqqosBHXsSgzmRUdkdKQ7Hjy3C/0lEIEywhg91lIK4ZYQkznbEDrfeOpS:A490k7GSgzNAHRcwy44Si9ufFNToCLWD
- TLSH T139738D1175908473D1A7AA30A4AAD2316FBE7D116EF4404B7FA903B96F707D0AF3930A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIB4D6.tmp
- Size 227KB
- SHA256 8effe386da4e2c990cfd368a55683651e02b0e8a4a0d621bc0bcb23098c30ae9
- MD5 cfb0191d531b9e38b3c453bb19bc06db
- SHA1 4c670207ecc491fc35bf7746af3fe319cf8b5e43
- SHA512 33a21e8b75650b524cdf9d9b58d28f933e02cb2019fb648b2698e570f9db5f4569d6f1c5645393fb4b6b37fc6901681e8a20d9bff3b90c378843d0affc0f9585
- SSDEEP 6144:wiV1NMgvstHNLbgqDPNA3RQ/gJrCUlZy1O9BVKAFKgiTE54BMeNLIGZVOs:LfMgUtHNz
- TLSH T15B34098137E4613AF2F36775AEF685764A76BCB09836C00FE2954A0E5972B41E930733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 90db3e280b1d4857f7cfced9eb2f33f468805bee6cbef3e274dbc64aae53865f
- MD5 a60649a39bea79e7cf3f3f99ff7988dd
- SHA1 c1e8d099d5ca32525904acc5cc8db35385b90c74
- SHA512 88b2f646d310a77117536fe37d5bb62ac43b665508d30bc57b249c179b9ee802bbc75b6edc2d10552b8ab9dca5c060817685de74a632cd1e15bad00175f2bb33
- SSDEEP 12288:2pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2psqjnhMgeiCl7G0nehbGZpbD
- TLSH T1C445237FD34C518BE53659B082E9E12D781B3E669E204483BA4738FDF6B18948F38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 7d59b92c08f17e012ea2a5457e97691996e99d75f0842390ba0cb7b7bd38f9a0
- MD5 d81a62e271d004a7d5079e3455bc5732
- SHA1 10e67ca48d10bbbcb87040f132e8f49e1cb7240e
- SHA512 2a40733f16a857298605d73b7c901a5226f689131c5f34318ee4fc887fdecd8b97584e7bbf6e560ad732cad0bacebc32b1d381207c3870edb89827fd0f7c2aca
- SSDEEP 49152:Qa0h2GEkuAe73q3pp46zwwQjDmg27RnWGj:Qa0hNYG4JwAD527BWG
- TLSH T12285AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.3MB
- SHA256 4f89b669a1e87c2f46eb70042e30c65eb9a9867e03e75d31481318af70a36fd6
- MD5 e8d94f67256a540609815ff02cf98cff
- SHA1 767116d97e3c61892f3f1a09acd96abfbf82bc0c
- SHA512 b17547cd8bc8c78008955935bf0cf7999356ef87f9ee68f88bdd394e490c0a772f774377c7005fa788a66b74c717b627fad35709176425db31895016055e242e
- SSDEEP 12288:QhbHjfXAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QhbHjPAsqjnhMgeiCl7G0nehbGZpbD
- TLSH T15B55127E12AC20C9E572A1BD8295D10AD632BC26172053EF23D281BE5F37DE84D39F52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 98daa5f191c9589ca1123d93944aa5fa0915c210aac6c012db6d172228edede5
- MD5 bfcd3a1f9bcc9f33510169d21b388c2c
- SHA1 708e33772f9cbe4d447cb8de0e894821c6b3a862
- SHA512 cb5ca0fef87a4136e21f5af88ebdee10198c68bd5f524418e632ef21018b32f3bc61e0b88621bcf604d257b56f77eaa161da91d2fbf04f03977bf0acd20ae4bf
- SSDEEP 24576:P3YgnJcRTk4yti+R5dpR/osqjnhMgeiCl7G0nehbGZpbD:PIgnaTk46ppR/UDmg27RnWGj
- TLSH T16045B02EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.2MB
- SHA256 53f14935cbf0d131df9195253ddbca22ac56b1be07b59bf7e4a7736eb239a667
- MD5 f7e5a79060132ee2f408f9d4530e65f1
- SHA1 edfc11c8e0ba4efc8e324e78ca1a05e07a283d5b
- SHA512 30536ec85badc726f3d124ba1854c346342f320442f0e0dc74ef6708fe3f034ece509a6e710152ec692583ac2303c676def0e098fbeab480ed034548b7466028
- SSDEEP 12288:wFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wFsqjnhMgeiCl7G0nehbGZpbD
- TLSH T17B4523BE924C51CAD93649F5C2E5E11DA8073E56AB2004D379A77CFDE7B18E84B38423
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.5MB
- SHA256 1388fd361457ccb55ebbc53c791858b4740ed17353c9ba81ab03c7bc8233ea7b
- MD5 3a5b00163774b7d5b4593c236d8abfc3
- SHA1 83f30aec40ac9856b56015819d7a286e206dd818
- SHA512 566aa5213f9355398a5a2be8bfdf59fef3cb8909c0ee39c7fe7a550785edf279046c78d5839cf3cb9c9c2595658250b7c3a68188e8f8f2b6bf31e694530f5e12
- SSDEEP 12288:QObfA4LWOsvAYFTmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:NbL3UTmsqjnhMgeiCl7G0nehbGZpbD
- TLSH T19B750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.3MB
- SHA256 e51482f23032ebfa1440ba3c6a3e27f8c38acc9cf254bb113e412aa0d918dcbe
- MD5 1e4d8e572e195c911167f8d0d5f9f3a3
- SHA1 149e7920a344ed2592fdcabc22f5c6c84989173a
- SHA512 1a9a345f220ceca2d7ec66927bd6e5e86c90715fc97014798980f1e5e780c598a58b4c8629da794853ef92a1f8247ebb3e171e76fae155ce92074030498e3bcc
- SSDEEP 12288:qpFtIOiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hOisqjnhMgeiCl7G0nehbGZpbD
- TLSH T16055022E32EC10E9E536A17CC692D20DD6327C66072117DF06D184BE5FA3EF85D39A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 b4b8b5c05267f3befcfc46a3a0be547797f3b47db7a4d465cc6ce14eee85f987
- MD5 e6c8b0c7e03381349dfce3799cd9ebb9
- SHA1 726c3160d4f5e14d6221e64718f09cb78903069e
- SHA512 3d08e5eeb403dc7bfcf754bd5916266ba453a68004670a9d4646dbf70660ec05af96410af486f4edb74ea6afdf4cf89655dfe4642cbd1a1c82bb60f6c4aeead3
- SSDEEP 24576:z7NM9YmZqmWMUkPjZM48Mv6bEhs5sqjnhMgeiCl7G0nehbGZpbD:z7cBWMpPjN8DbEhcDmg27RnWGj
- TLSH T196659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 39f7f19b41faad7bf8ac362fb14c0545d096e4608eec333c088611530b204b7f
- MD5 109445284bc27af86d2059422a621998
- SHA1 22beda7ef9c420a920ad1a1e4c839553358cc38e
- SHA512 738df1c333de0910f57fe43f8eae0459e7846036a303dac42d1d3fd0994c3f8386cc90991271668a85c130ce8515ba6a674c85480c6bb2374b630f7414a2d10d
- SSDEEP 24576:uW6BApg2YuyuNDYTabvcRvNYf8km1jsqjnhMgeiCl7G0nehbGZpbD:uF2YuHNETovcvNYf8kmdDmg27RnWGj
- TLSH T1B1857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 2aec0ba222161bb7c15b0b84c448f9d843439906535a74a524044abdee784852
- MD5 d77787c04b8619e39377f1ec4cc1440b
- SHA1 1d225f64fef72533a16d10743b23c427940699f8
- SHA512 8454035c05afd7e388abd639accdc1935ab5aa4e8d613dd34c2aa5a5164706fba9ea856ef52740fed99855ca9e692a062e6d1c70185d326b35e0c57437e5218f
- SSDEEP 24576:CAFs06+OmlfkNXEbToesqjnhMgeiCl7G0nehbGZpbD:7Fs060lwXuDDmg27RnWGj
- TLSH T1F265AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.5MB
- SHA256 2dea5bcf2726c2bf63f0f7fa3dd7cee26c8a8f62298c6c5a44fa6f3b32c440b5
- MD5 445c13e00e50e52b4deb22a45d0f64f1
- SHA1 f786687532842cf49e2d1ba57ade2713369ea811
- SHA512 5097f6d2593999d2977e487e5068f8b5f35b521498bf457c78f47e1226c8ce7d1c39d3e08ef5904e1f3cefe26b37fd1daeec324b5d6896fd7c1765a33c2b8e1b
- SSDEEP 24576:oJnJ5D3WtfsqjnhMgeiCl7G0nehbGZpbD:oJnJ5DGtDDmg27RnWGj
- TLSH T1A775E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 fa6766d4019ae8abe0c276d46d374b09c58a60b1ba8c8eef26276f2820891378
- MD5 292f38a582a132547988680bb7fd6cbf
- SHA1 4e5b2a42b09a62207dd13364e164d52e420bada5
- SHA512 a6228494febcdc15f3dcfc8d521b3dc463f74a39c54840700133bfe81f3b894eae006a36302a3dbbb9d95254c77ab10c1f8d00e53b892a21af3f42092f75e8df
- SSDEEP 24576:EEPohm6/7IIXdwcXrif7qQncjlP65i3VuosqjnhMgeiCl7G0nehbGZpbD:Lo06DIKdwc+eQnSt65aVBDmg27RnWGj
- TLSH T1EA955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.3MB
- SHA256 96e8de167b4a2e51b631b047e43756d05062e6fcc998b4835fbf91b93b635fd1
- MD5 7c3239c51fcd7aa51e4ccf2dcc2df645
- SHA1 682fcf4f85e0df34c955c460c3d9300a71e6ecca
- SHA512 3e5f892cd6e7ee97c105361d429e029123793e8b94d107d388faf55f53e068759bb26cf4498d29e6fb85d7a151ca265fca2df572a827e9e155dc298f7add301a
- SSDEEP 12288:AEP3Rr7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:br7sqjnhMgeiCl7G0nehbGZpbD
- TLSH T12355126E679C60DAD536907D8291C209D733F4716B2127EF26A2C57E8F739E80E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.3MB
- SHA256 3f81699a712bdfb150ec1d31f09437e1d6b72e0d22877dfdec2b80476efada1f
- MD5 a5040faca04e4a13f21466f3638620b5
- SHA1 74e867093978b021f740b9db5f7a62d29228b7bd
- SHA512 4a88ece882b0d7b955e7a4d04a9050a918337ee3fa184d04d1f34db497f9f905042a23d7c94c24503a95402cdac1f1aa5c954f5a92ce9b9cbb0cf002c62b0783
- SSDEEP 12288:5jkywXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5IywsqjnhMgeiCl7G0nehbGZpbD
- TLSH T13D551219639C60C9EA760578C6B3D1589C36BC319F2046DF6191FA3EAF72BD48E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 1.2MB
- SHA256 a63b243600f26473ff48d7cdde50e924bddabc08a5d0fefc348bd703aa90c820
- MD5 1f499044bdc35919c96c5c3837d54f52
- SHA1 563d0f21fb901342c1b3ea81ab6a04bab8fdcee3
- SHA512 8daa4737ac43b72ebffb2487877c419ca861abbd0385d3f414781c78150648de69872c11f8444bcd424ae0dff267b8ca130b773827f3f295fad5259244563578
- SSDEEP 12288:a47mXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pmsqjnhMgeiCl7G0nehbGZpbD
- TLSH T13655126E63EC30D9E4729574C2B6D1099432BC36272015FF35E1D9BE9F729D48A38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.2MB
- SHA256 7428021c3eb4923d051caeda4123849b0f782e42cc459c9d51b40fc3e43a202a
- MD5 08a58e62c717bd932951cd0e51c787c5
- SHA1 679c7a598381fddeea5126819187ed1bef36e981
- SHA512 d9e3f79a2b57a3f31ed71add4d4ce4665501909b354e9a62ffb88f28057dcf63cbdaefe3deceb1e1e144c7cc5f91ec0075a6d4e6082e8aa474bf0dc67d97bb0a
- SSDEEP 12288:8FSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KSsqjnhMgeiCl7G0nehbGZpbD
- TLSH T17245237E525C60CEE93245B8C3E5E61D98133D76AB2014E739E3B8BDEBB24D44739812
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 0ee33c9b7a13783ff1e86185eb1504853e538c5a5790cd0cb92350968d2ad9c2
- MD5 c835ba7596664fc2420af9f92118bd59
- SHA1 f6f1bf4cf93d0c7481e13c755f56b72790164908
- SHA512 518fe8121c1c8a864ce1108a4799bacea87b9581dce4ef324a1e8478163b61d5db6a5dad846742b9ac9e3a1b700fba0a7684682a95c46c784474c37abc3fb1fc
- SSDEEP 24576:oQ9MxZKdcz97w3RsqjnhMgeiCl7G0nehbGZpbD:oVKXlDmg27RnWGj
- TLSH T17A557C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.4MB
- SHA256 f842a6b1e551bad9c1783981ad47a460eac44313cd218f58128387daa11fcf2d
- MD5 68f9a96b82b1cef1d62255a81a11ec24
- SHA1 3b6e41998111114b69ffeb9771e93f7ce4ca3fa6
- SHA512 789b32de74c3cf97823e57805115765c01ec122fdb771a0b4b069238b61c37ad0e790f616de620cad9fff86b28ce11e4abe19e95305d7d82edf5842f7a2292cd
- SSDEEP 12288:5yoKo2HRple9p8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:5yocxAp8sqjnhMgeiCl7G0nehbGZpbD
- TLSH T17F65E01FB76D40E2E176813C8985C249E673B4315B2257CB6692C73D8F639E8BD38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 af68f50925f6950d1357a5529813d229bd6b7183b9b5860eb731fadcfb883e77
- MD5 51c1eee4239f6a04c6cc1377e2df1cd4
- SHA1 66310d84062e400ac9de7bbf1dd5ceba8169fec7
- SHA512 68743b56b2ea5ce5d65806e532bc2e6fb21d4eaa87490d1abfc4a2855b8562011d9ab6be3c0b6ef3294b5fe27f30f61cf7e433d072b6c03a107f68822560218b
- SSDEEP 49152:4WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKoDmg27RnWGj:a0zuNIED527BWG
- TLSH T122A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 8be75e5cb92d486b04f8ac8c46449c1239531635c42c1c514884079385d152f2
- MD5 d3c92b9a89d9c7299d34eb8854261ecb
- SHA1 14fdeb7600996d8b14cc7f91e6fb764436f5ce9f
- SHA512 ec47747963c8cfb8a8d17407a81975716b7a01c66d39ec002bd401d5db73d5c8b3037150df213a5b658613add11a7a62de4c0991fcc6ffcc10f21f56b985dcd3
- SSDEEP 24576:b1QT7EcpfxR+N5AWAz3ooiYujMqb7sqjnhMgeiCl7G0nehbGZpbD:mTDxR+N5YzT4jMGDmg27RnWGj
- TLSH T1CA55B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.5MB
- SHA256 1dd1dd8abce79e0f13a2bfcb78cf6cfcf54378807814067459887f368c0ed846
- MD5 8f2487a18f541dd2675881c809de188a
- SHA1 b2226b543ceca9c9540343eda88062dc0a261db9
- SHA512 a5d616a663a82ec30556dd0ea7f70692f82c6487cc607c77a7d74ce21da9420abb82109e82f1a6943e1c872ba43ae8e81ca8fb3a00d5e591e21c78e0e7ed2472
- SSDEEP 24576:XTMdOz0FFS+bmSL3sqjnhMgeiCl7G0nehbGZpbD:l0K+bmSLLDmg27RnWGj
- TLSH T1F275E17EA36D14E5E47BC17CC653D90AE9733862032166DB0690C0B97FA7EE46A3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH