42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Size 8.3MB
Sample260804-a35lwsac44
SHA256 42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84
MD5 56005270408300dc74d52b69f7c2e6cc
SHA1 f4089edde57e3439c2d80fe538c04f58126e332f
SHA512 c9cbbba5949a4eb8f5057d29d96cf0d37aaadacfb49f0064e3fa2b5cb3294eba6972f303d0b638bd8570a23a0bdc428f3848e35275efc5037f3a7856c22b2af3
SSDEEP 196608:mI9CAKtGb/sHpSoazmClL5XfOQwvp10dPDkTZ:l91KtGQJSpzrXffOp1mP4T
TLSH
T158969E76B6A800E9C167C23D9696C547F3B3B8501B36A7DB0661472E5F339E05E3E232
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3936	alg.exe
4652	DiagnosticsHub.StandardCollector.Service.exe
2276	fxssvc.exe
3336	elevation_service.exe
4740	elevation_service.exe
4388	maintenanceservice.exe
4996	msdtc.exe
4032	OSE.EXE
3096	PerceptionSimulationService.exe
3584	perfhost.exe
2992	locator.exe
4788	SensorDataService.exe
4892	snmptrap.exe
1596	spectrum.exe
2108	ssh-agent.exe
3992	TieringEngineService.exe
2180	AgentService.exe
2660	vds.exe
3456	vssvc.exe
1424	wbengine.exe
3256	WmiApSrv.exe
2400	SearchIndexer.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Privacy Eraser = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe\" /Startup"	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Desktop	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Desktop	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Avira\AntiVirus	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Speedup	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Avast Software\Avast	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Avast Software\Avast	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Key opened	\REGISTRY\MACHINE\Software\Avast Software\Avast	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\Z:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\T:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\X:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\Y:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\J:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\N:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\S:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\H:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\I:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\L:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\P:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\R:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\U:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\V:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\W:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\E:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\G:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\K:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\M:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\O:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Drops file in System32 directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\locator.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\System32\vds.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\System32\alg.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7d1b9f612d44b5a9.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\spectrum.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\wbengine.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\AgentService.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\msiexec.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\vssvc.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\javaw.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103203\javaws.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068d51bacaa23dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002a983facaa23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8ffc8b5aa23dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e9923b6aa23dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c7dcab6aa23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009deb4db4aa23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c44c99adaa23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Token: SeDebugPrivilege	3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Token: SeAuditPrivilege	2276	fxssvc.exe
Token: SeRestorePrivilege	3992	TieringEngineService.exe
Token: SeManageVolumePrivilege	3992	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2180	AgentService.exe
Token: SeBackupPrivilege	3456	vssvc.exe
Token: SeRestorePrivilege	3456	vssvc.exe
Token: SeAuditPrivilege	3456	vssvc.exe
Token: SeBackupPrivilege	1424	wbengine.exe
Token: SeRestorePrivilege	1424	wbengine.exe
Token: SeSecurityPrivilege	1424	wbengine.exe
Token: 33	2400	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2400	SearchIndexer.exe
Token: SeDebugPrivilege	3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Token: SeDebugPrivilege	3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Token: SeDebugPrivilege	3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Token: SeDebugPrivilege	3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Token: SeDebugPrivilege	3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
3048	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1492	2400	SearchIndexer.exe	123
PID 2400 wrote to memory of 628	2400	SearchIndexer.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
"C:\Users\Admin\AppData\Local\Temp\42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe"
1⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3048

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3936

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4652

C:\Users\Admin\AppData\Local\Temp\42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
"C:\Users\Admin\AppData\Local\Temp\42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe" /Startup
1⤵
PID:4552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4692

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4740

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4388

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4996

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4032

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3096

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3584

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2992

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4788

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2064

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2108

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3992

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2660

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3256

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1492
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 904
  2⤵
  - Modifies data under HKEY_USERS
  PID:628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7a1a4deecbca6ec40e4d14bab7e7d48b7f3615f8fa007120e1d8d40f9a386848
MD5 370f59c98149c2eff7210c4affb033ad
SHA1 0f8a9db66ae9682667542106ded0e8d8397fb594
SHA512 67cda6fc1e853c2955a19a88d31413deb04650176dd31f0118f16eeff0cc3e0bc054bc3e3db2a3c2722be56f9796cd5139b408a4a92b8a792403d31ed6f3b9a6
SSDEEP 49152:/b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnQsENNASrrza/QLV1:93q6gjBd9Z
TLSH
T1B9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 8638e49c7a431814295170398363d930343b2912569e144c4d3c2ba72ef13ea8
MD5 a06d43e7c8ca1d373709c4ffa96fcfd0
SHA1 f3062aeedd1143a779fefbd0fde51e2af69a150f
SHA512 5120ce093ddc1d7854f0dc08049b8c91183f295c6782b0ca3d74dcee660e224d83106a4927cced2565f55cb5716efee090c4269c98a853e2b00c17094a3483a4
SSDEEP 24576:IXY1DAczAlKsENNASSSr+GSR1g6/QuUVma:dAcLsENNASrrza/QLV1
TLSH
T10805012873E509F9ED6B817CC9A2C506E63378954760F79B03A485661F337C81E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 42ab7a250ce9705a46fbdd1c827e2a7546b8e1a25d3de502474a9260bbd8964f
MD5 0c10965c80d3a397153dde57ad02df58
SHA1 27233a8c46c83b0070680fc1fc7354a75b670b7f
SHA512 4d4ec9a77735e6532ddb8b2d9245f98200edb6d96c679c09e26cd8b4fa706afd195a831db71143aa27cf62b3ed066f24987c3f63cce103888ce1bd0635d21941
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CeKMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSRO5:uwuuOWpKsENNASSSr+GSR1g6/QuUVma
TLSH
T17705F14677F50CE9E6AB8238C197D13AF7B278522A21D71F0760C29B6F373516D29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 987cfbf96d07a605da6886578e657d7a8751f6ddfe4ce6011c2735812ab19c98
MD5 a99474460077d2beed74dca022eb8b58
SHA1 2a73043011176ba11d42329cbc7e8a3be9fa2768
SHA512 b6a14a528ea4f78f799534f633cb188864bec525e4b1d377b3169077b4d7645c5b7b37d2a0d4b0604db9f95c0ae4d3f94ec2c68056d60e591389da8bf6b329bf
SSDEEP 49152:8x+taZ3usBWOBr4tEGp0bqx0z+n217aau1glFsENNASrrza/QLV1:yu6JmTxd2dF9Z
TLSH
T142D59D13F1DA01D8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 1a47c9dd82b18ae0139b980ad57a05992e6b2b1b155d179453051f1d8a209c5e
MD5 75e95db38e69ac2956a3a35e502be986
SHA1 4607e4667a82148e99b3b4e7f2c3dd2c4f290b10
SHA512 541d901ddea6a493a78e2dcccc3564a6ef7e401e12b34c88455a8d112c15c5ebc6da1a4b3c69b5a07aceb34ad4b1478780145652f7d09f55d2cc8e7aefd1b54a
SSDEEP 12288:73KMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTYk2:73KsENNASSSr+GSR1g6/QuUVma
TLSH
T1B8D42325A7FE4B43F27F92B0D1B5E01D103E34FAFE417299560182D72CB1ECA1DA456A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.8MB
SHA256 f25841fd792d07d2ee9ee071b12ad069084f1b8e3dc14462df3107f6e1aaf5b2
MD5 0b05ed91f2e21745923d8ea01d6bc5d2
SHA1 6f44c0cf38d5a8c29ef0925b525bcc6fc570b4d8
SHA512 b2b1538de13b6879c95deeee1c2231c09d6ecbd3f1883b261dbd5db607915eea3e792dcc9d7aa574c4dd5534fb4514c63d52bd750043e7a775b6a8a6ac82e7ef
SSDEEP 49152:Za0h2GEkuAe73q3ppt6zwwQEsENNASrrza/QLV1:Za0hNYGtJwF9Z
TLSH
T16585AF1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1151813D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 681KB
SHA256 c5002c9896ecc887f822cf019688d9ee91d4d116790df7f2785fa203d7669f88
MD5 5a21ab9c23831cfc4bd4365a27d469c5
SHA1 cb524782677ede5f10c982e942b54b4e5d088508
SHA512 85d8060a80073ac63253f29b938b4211eda74c2e14a9209ed75ef8b3c1667321b5fe77445845fe77d0be68e19121f1f74ed35ab4ddfb5b56f53310d29b079b82
SSDEEP 12288:6hbHjfXEKMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTYk2:6hbHjPEKsENNASSSr+GSR1g6/QuUVma
TLSH
T168E4023D22FD11C5F276E1BCC1A5910AC33178662B11A3EF129282BA1F37ED91D75B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e0f28e733b15f7a3890febca3a69bc8e2b464a8ff26bec9f1422e8c8a3ed70c9
MD5 176e6b252890153d55407974a85c7d08
SHA1 97af293e8bd4dae38e195223fdcc48cf97c1b682
SHA512 8fd1fb0b502e08bef865a3cf3ca917886365f5060cc1ef7bbc438967a984ef115630733bdab56911e53155ed5adfd2ba2534cc78165ba33010bc70d993825d51
SSDEEP 24576:GIKg3JcRTk4yti+R5dUR/zKsENNASSSr+GSR1g6/QuUVma:GVg3aTk46pUR/GsENNASrrza/QLV1
TLSH
T10445BF2DF2F910B9D4AAD236850147B5BB71782D1F209ACB0170C538AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 600KB
SHA256 4a31a07c86189a480a84ad1eb11521b1fdfc72a8cc89c50ad49030d70f5b5e59
MD5 dff1c2eb4c31a4d3eab19608457d2b40
SHA1 b74174416207893406301d9a35da76b1b695418b
SHA512 470c2e3d135ffbd5be6c5cdc9194f23a66ccb1b83d00e6c42284901a1deb04fcafab42f581555ee0bd4f18c7dc466bbdf18066be5d8a3bbc81f780625e948234
SSDEEP 12288:FxKMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTYk2:FxKsENNASSSr+GSR1g6/QuUVma
TLSH
T169D4232462FB4B82E37F82F4D1A9F04E103914F6BD563394051692D72DF6ECF1AD41AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 963KB
SHA256 f3dc2ef611e188f3f7f5e73f9329ae5215778711b1f5b796f62f4aedb538db83
MD5 83d08e94e04e0987f4bc6fede884a5fd
SHA1 f4149f0a66da6d5977ab018dc9fdfa515ec98fdb
SHA512 b6f16711c889a1ec66cbbc400da1004e1ec2f4aca859f32400b63601eeb8d395dce6595f7b1ac895f42757485fc8d9b4745ee72b1faed4443264667f107ec53d
SSDEEP 12288:UQOzA4LWOsvAYFT7KMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTa:WHL3UT7KsENNASSSr+GSR1g6/QuUVma
TLSH
T185250114F7E500F9E57B813CC5A2951AD27274AD1760E3DF03688AA61F637E64E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 693KB
SHA256 3d8b27fbd1f3db1ab61a1faf2de01b5fbd95f46e98660111091f47c8c1f3edba
MD5 25804c10e3aa4949f9ca0cfdeb06fe11
SHA1 2d4621f301758b750950c7eb164256a019efe8f5
SHA512 eee9d4029f9534ea97f9a90a423ca298c61bcc0dbbb32ed1c9293cfecd3fe8b8fbcc54c7c486ec0fc754b3883468963e9d3a1a24c939f1d3f336a96b9b5ebfe2
SSDEEP 12288:3pFtzOLKMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTYk2:9OLKsENNASSSr+GSR1g6/QuUVma
TLSH
T1E3E4022933FD01D5E17BA17CC692920DD37178A65B1263EF029081BE1FA3FE85C79A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 eb358a2c1a64c5af4062e632afebabf5ee6d4b0c648182404dc71a5b8e1106f4
MD5 e087385b948187a004892da2061f35fc
SHA1 8d957727528e802f2a9ea2b99e9ff0f4a06ac3b3
SHA512 c5c3e13b6d5fcfcfe5deb67734f33e871ae4d7286a02cc7e4ca661a71c51de0c0360e645b74a26a5f0f90f44dcd6be565564b29559b71b90d502281848b9bf0c
SSDEEP 24576:U7NM9YeZqmWMUkPjZM48Mv6bEhsSKsENNASSSr+GSR1g6/QuUVma:U7cBWMpPjN8DbEhOsENNASrrza/QLV1
TLSH
T12A659E2E6BEC81D5D577D13DC9A28206F6B2B4611B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 cb41321c428b6a8e8b371c4613bb53d3af63f716a53cc8e8acf6aecc7270f4a6
MD5 ef123d0bfe1549f784dc5a70ed8801f0
SHA1 5fe5d5ff6b5523dcdf957f0bd83e9cfe1ef323c7
SHA512 78781d186790055d25c8e0a325c68b17a38c44ff2ee399de8ae5551025e5d5012a44b3fce612729a32b23dd6634953ec3fd15ee44029fd32079dbc4508965a15
SSDEEP 49152:hF2YuHNETovIvNYf8km0sENNASrrza/QLV1:k6ZCf8kh9Z
TLSH
T18C857E2927ED80A4E0BBD27D85B6D146FAB2B8551B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 705c600df3aa725275a40dd41e47d1670503635cc61eac4743afda6af7ad2d24
MD5 9026e5d4be0b623ce23e869605aac198
SHA1 9731f357744a83573eda6262042064e7a3be44ed
SHA512 71c793d93f5dc51f27c362e3adc34b403bf35e741a902a0fb2c5a658246de20d589cd2a873070034fa8a96dc3e6e745eb63a6a1e1a1ca64ba6909016c43398e5
SSDEEP 24576:NAFs06+OmlfzNXEbTo6KsENNASSSr+GSR1g6/QuUVma:CFs060lBXuWsENNASrrza/QLV1
TLSH
T1D565AF2F62EC00D5D07ED17D8997C91AF6B1746307256ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 907KB
SHA256 f99a2394172a14c933eec0049c3a2bec95eb93bef614ba3264899d4671ab8c42
MD5 f1fb23f4679538cd828295b2f093e50c
SHA1 6badb9f6abe7640543042dc924b858ca00481aa9
SHA512 e624f352134d1661cba036cfa13cb445d5b4edec29758450d2390ac018933943f0642c3557f933e2221fabccc500f8481310931fbb27b6cd7e44ca1a40e7869e
SSDEEP 24576:iJnJ5D3W2FKsENNASSSr+GSR1g6/QuUVma:iJnJ5DG2QsENNASrrza/QLV1
TLSH
T11915D02DD2E810E4E0B7C2B4819A6756BE72347D2F226AC71874D5353F12FE09A79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5b50055880e3e6d2d276738a15d28201d6cd755a50c381df30a8e45204dafe7d
MD5 ca19f2791916577664eee9b4b3ccce6c
SHA1 08103ba62fef8d8afd6596e2d500f892103e153d
SHA512 2e59a11282358becf2bb1fdbfaaf14d567a5a219fdb4a4c65683b1fc2f4e3feb35c2369332e41c76fd955f215d69bcadcaaae72802541a8bed475194efc0fd5d
SSDEEP 49152:1F06DIKdwc+eQnSt65aVWsENNASrrza/QLV1:fk9Z
TLSH
T1ABA56C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 682KB
SHA256 b8d169f288552c651cc31758522dcb3b99adff1cbc78a8da7e383da41faa9e59
MD5 5c9fa369334a0e7637257e2caaccd16e
SHA1 5281f19586965e81bcceef55597580020e499a7c
SHA512 1908e1fb362d5384690bed81c19a5db4192e2a22cba3d17ab6eff5b3f30c2bd150b91a2b17aa3e983573a9c611928ec508ebae427399270af9bde8db9db76596
SSDEEP 12288:XEP3RiKKMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTYk2:ciKKsENNASSSr+GSR1g6/QuUVma
TLSH
T16AE4122D27FD61C5E22B917CC1A18149D372B0B56B5233EF0691C27E0E77EEA1E38A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 734KB
SHA256 3453309bfab2ab49f74ee881b420706a62eaeeeddadadcc7764d8193ee27e1c2
MD5 3172f436523f4599161229ed3ede2a39
SHA1 bb23ee7cde5ef92f8737ec67dbd13ef8781c2bcb
SHA512 1773ff9dc3a1a7c651196c8df91de300cc288098e02aa6ea0f259683aa3d23d2d1cab6b8357c5093c25a8071966c8e2c40ae473d61356c03990e7c0616c76162
SSDEEP 12288:QjkysKMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTYk2:QIysKsENNASSSr+GSR1g6/QuUVma
TLSH
T145F4120863F95681E2BB4278C2B291994A357C71AF2163DF1140E27F2E73FC96D70B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 605KB
SHA256 ad1b70e5fbbd588d485b2a201dd08edf6ab49029c40d0fb0857b53476dceffef
MD5 73b65e7e7f94dc03454050aa8539b178
SHA1 bfa4f2ad69750ad7e90d960b0b297d45c38ffd1c
SHA512 cb67d702e31c3ade5db3ef17002b84caa1990d940cb1cfceafd7398b015784c7e36dd674e4afa7e8cd25de8012a129a8be619bc8d8e7ded892e8ccbdf4609b99
SSDEEP 12288:BkDKMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTYk2:SDKsENNASSSr+GSR1g6/QuUVma
TLSH
T1BDD4232C62FB4B82F22F81B4C1B9E54D003534FABE4232BD0551D2F75EB6ECA16E4995
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 12787889ff2aaf56061ff524cf1e68a61e975c8d9cd8afb0e0d8c2b0b7a90a1c
MD5 aeefe9f388313935bdb36fcc529b0d71
SHA1 9d3abc2f857762cda8f406d7563299568b70e30e
SHA512 26e9d9a98abe6d7e0ffe7c1a30d431fed01cf3d5a3b43d6525887e39c62cb25598ef0128c04710a12a6e53cd15902240afbc59c749dd7aaca349050a1f89c561
SSDEEP 24576:3Q9MxZKdcz9ew37KsENNASSSr+GSR1g6/QuUVma:3VKiusENNASrrza/QLV1
TLSH
T19D557C2DABF9098AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 794KB
SHA256 2f8fe0944cf38c5309461a19d168d13b20f95afd68c5891aafbf896278052ed0
MD5 85e13b43146cb3e33f0680fd04574fb3
SHA1 a8309db674bc1a7fe950211f44871221a85b640d
SHA512 55858f0062c2e2d39e17a77d1157c4c6c0a2481105e9010e4ef23f513f4f63da15b1ca6aa06dff2647568a5847d1b0a4abdd10ea30086df551c8c15931ed9b2a
SSDEEP 24576:Pyoc8AphKsENNASSSr+GSR1g6/QuUVma:Koc8ApMsENNASrrza/QLV1
TLSH
T15305E01FBBBA4092E177813CC9858249E77370706B6263CB5691C33E4E63AE97D34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 83e7bad951e02406e20f1b288241acd8885df8260bbbbbfef2391925c8254afb
MD5 357faf09b4d0f1ecf1fff538f3b12b68
SHA1 3a38f77e2d86fad65737d8b24c967b81979216e3
SHA512 749b640c7730fbab399f26cb9af4e566f2ba9b0c1ab1436b99d59e96fc2786cfe2d32f0a43a2de2d8231e6aaa665c58de6885cf21246b362ed20d52208585497
SSDEEP 49152:HvcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKAsENNASrrza/QLV1:00zuNIA9Z
TLSH
T1CFA57C3DA2F800A9D9AAC375C1451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-447-0x0000017054F00000-0x0000017054F10000-memory.dmp

Download

memory/628-452-0x0000017054F00000-0x0000017054F10000-memory.dmp

Download

memory/628-451-0x0000017054F00000-0x0000017054F10000-memory.dmp

Download

memory/628-450-0x0000017054F00000-0x0000017054F10000-memory.dmp

Download

memory/628-448-0x0000017054F00000-0x0000017054F10000-memory.dmp

Download

memory/628-446-0x0000017054F00000-0x0000017054F10000-memory.dmp

Download

memory/1424-296-0x00007FF6C5FA0000-0x00007FF6C64CB000-memory.dmp

Download

memory/1424-229-0x000001CB4DCA0000-0x000001CB4DD06000-memory.dmp

Download

memory/1424-230-0x000001CB4DCA0000-0x000001CB4DD06000-memory.dmp

Download

memory/1424-228-0x00007FF6C5FA0000-0x00007FF6C64CB000-memory.dmp

Download

memory/1596-161-0x00000131F3AC0000-0x00000131F3B26000-memory.dmp

Download

memory/1596-162-0x00007FF6977E0000-0x00007FF697B04000-memory.dmp

Download

memory/1596-160-0x00000131F3AC0000-0x00000131F3B26000-memory.dmp

Download

memory/1596-224-0x00007FF6977E0000-0x00007FF697B04000-memory.dmp

Download

memory/2108-170-0x0000022A44950000-0x0000022A449B6000-memory.dmp

Download

memory/2108-169-0x00007FF6D90D0000-0x00007FF6D92BF000-memory.dmp

Download

memory/2108-171-0x0000022A44950000-0x0000022A449B6000-memory.dmp

Download

memory/2108-227-0x00007FF6D90D0000-0x00007FF6D92BF000-memory.dmp

Download

memory/2180-196-0x00007FF744E30000-0x00007FF745259000-memory.dmp

Download

memory/2180-188-0x000001CCB7210000-0x000001CCB7276000-memory.dmp

Download

memory/2180-189-0x000001CCB7210000-0x000001CCB7276000-memory.dmp

Download

memory/2180-194-0x000001CCB7210000-0x000001CCB7276000-memory.dmp

Download

memory/2180-193-0x00007FF744E30000-0x00007FF745259000-memory.dmp

Download

memory/2276-46-0x00000279CA5F0000-0x00000279CA656000-memory.dmp

Download

memory/2276-45-0x00007FF699370000-0x00007FF6995F8000-memory.dmp

Download

memory/2276-47-0x00000279CA5F0000-0x00000279CA656000-memory.dmp

Download

memory/2276-51-0x00000279CA5F0000-0x00000279CA656000-memory.dmp

Download

memory/2276-53-0x00007FF699370000-0x00007FF6995F8000-memory.dmp

Download

memory/2400-252-0x000001BA2F970000-0x000001BA2F980000-memory.dmp

Download

memory/2400-246-0x000001BA2EA20000-0x000001BA2EA86000-memory.dmp

Download

memory/2400-268-0x000001BA2FBA0000-0x000001BA2FBB0000-memory.dmp

Download

memory/2400-247-0x000001BA2EA20000-0x000001BA2EA86000-memory.dmp

Download

memory/2400-300-0x00007FF6D9660000-0x00007FF6D99B4000-memory.dmp

Download

memory/2400-308-0x000001BA391D0000-0x000001BA391D8000-memory.dmp

Download

memory/2400-248-0x00007FF6D9660000-0x00007FF6D99B4000-memory.dmp

Download

memory/2400-284-0x000001BA37F60000-0x000001BA37F68000-memory.dmp

Download

memory/2660-200-0x00007FF6B2820000-0x00007FF6B2ADE000-memory.dmp

Download

memory/2660-289-0x00007FF6B2820000-0x00007FF6B2ADE000-memory.dmp

Download

memory/2992-136-0x000001BD2F4E0000-0x000001BD2F546000-memory.dmp

Download

memory/2992-197-0x00007FF78DFB0000-0x00007FF78E058000-memory.dmp

Download

memory/2992-135-0x000001BD2F4E0000-0x000001BD2F546000-memory.dmp

Download

memory/2992-137-0x00007FF78DFB0000-0x00007FF78E058000-memory.dmp

Download

memory/3048-0-0x0000000009D70000-0x0000000009E4B000-memory.dmp

Download

memory/3048-8-0x0000000009F20000-0x0000000009F86000-memory.dmp

Download

memory/3048-1-0x0000000009F20000-0x0000000009F86000-memory.dmp

Download

memory/3048-56-0x000000000B080000-0x000000000B0A4000-memory.dmp

Download

memory/3096-184-0x00007FF68C500000-0x00007FF68C5EA000-memory.dmp

Download

memory/3096-115-0x00007FF68C500000-0x00007FF68C5EA000-memory.dmp

Download

memory/3096-117-0x0000025573330000-0x0000025573396000-memory.dmp

Download

memory/3096-116-0x0000025573330000-0x0000025573396000-memory.dmp

Download

memory/3256-297-0x00007FF7A8BC0000-0x00007FF7A8CFB000-memory.dmp

Download

memory/3256-237-0x00007FF7A8BC0000-0x00007FF7A8CFB000-memory.dmp

Download

memory/3256-239-0x000002AA09250000-0x000002AA092B6000-memory.dmp

Download

memory/3256-238-0x000002AA09250000-0x000002AA092B6000-memory.dmp

Download

memory/3336-64-0x00000257AE310000-0x00000257AE376000-memory.dmp

Download

memory/3336-62-0x00000257AE100000-0x00000257AE233000-memory.dmp

Download

memory/3336-63-0x00000257AE310000-0x00000257AE376000-memory.dmp

Download

memory/3456-214-0x000001D681550000-0x000001D6815B6000-memory.dmp

Download

memory/3456-293-0x00007FF741FF0000-0x00007FF7424CD000-memory.dmp

Download

memory/3456-216-0x00007FF741FF0000-0x00007FF7424CD000-memory.dmp

Download

memory/3456-215-0x000001D681550000-0x000001D6815B6000-memory.dmp

Download

memory/3584-123-0x0000000000880000-0x00000000008E9000-memory.dmp

Download

memory/3584-128-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/3584-129-0x0000000000880000-0x00000000008E9000-memory.dmp

Download

memory/3584-187-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/3936-71-0x00007FF66F0D0000-0x00007FF66F1B7000-memory.dmp

Download

memory/3936-16-0x00007FF66F0D0000-0x00007FF66F1B7000-memory.dmp

Download

memory/3936-19-0x000001DDC1980000-0x000001DDC19E6000-memory.dmp

Download

memory/3936-17-0x000001DDC1980000-0x000001DDC19E6000-memory.dmp

Download

memory/3992-236-0x00007FF74ECA0000-0x00007FF74EE2F000-memory.dmp

Download

memory/3992-180-0x00007FF74ECA0000-0x00007FF74EE2F000-memory.dmp

Download

memory/3992-178-0x000002C754270000-0x000002C7542D6000-memory.dmp

Download

memory/3992-179-0x000002C754270000-0x000002C7542D6000-memory.dmp

Download

memory/4032-108-0x00000278E8DD0000-0x00000278E8E36000-memory.dmp

Download

memory/4032-109-0x00000278E8DD0000-0x00000278E8E36000-memory.dmp

Download

memory/4032-107-0x00000278E8BC0000-0x00000278E8CF3000-memory.dmp

Download

memory/4388-83-0x00000299A8B70000-0x00000299A8BD6000-memory.dmp

Download

memory/4388-82-0x00000299A8B70000-0x00000299A8BD6000-memory.dmp

Download

memory/4388-89-0x00000299A8B70000-0x00000299A8BD6000-memory.dmp

Download

memory/4388-84-0x00007FF61BBA0000-0x00007FF61BD08000-memory.dmp

Download

memory/4388-91-0x00007FF61BBA0000-0x00007FF61BD08000-memory.dmp

Download

memory/4552-35-0x0000000007ED0000-0x0000000007F36000-memory.dmp

Download

memory/4552-41-0x0000000007ED0000-0x0000000007F36000-memory.dmp

Download

memory/4552-68-0x0000000007ED0000-0x0000000007F36000-memory.dmp

Download

memory/4652-27-0x00007FF726060000-0x00007FF726144000-memory.dmp

Download

memory/4652-28-0x000001780ABD0000-0x000001780AC36000-memory.dmp

Download

memory/4652-94-0x00007FF726060000-0x00007FF726144000-memory.dmp

Download

memory/4652-29-0x000001780ABD0000-0x000001780AC36000-memory.dmp

Download

memory/4652-30-0x000001780ABD0000-0x000001780AC36000-memory.dmp

Download

memory/4740-74-0x00000241BE400000-0x00000241BE533000-memory.dmp

Download

memory/4740-75-0x00000241BE610000-0x00000241BE676000-memory.dmp

Download

memory/4740-76-0x00000241BE610000-0x00000241BE676000-memory.dmp

Download

memory/4788-223-0x00007FF7A5210000-0x00007FF7A567D000-memory.dmp

Download

memory/4788-221-0x000001F793860000-0x000001F7938C6000-memory.dmp

Download

memory/4788-145-0x00007FF7A5210000-0x00007FF7A567D000-memory.dmp

Download

memory/4788-201-0x00007FF7A5210000-0x00007FF7A567D000-memory.dmp

Download

memory/4788-144-0x000001F793860000-0x000001F7938C6000-memory.dmp

Download

memory/4788-143-0x000001F793860000-0x000001F7938C6000-memory.dmp

Download

memory/4892-152-0x00007FF6D0530000-0x00007FF6D05DB000-memory.dmp

Download

memory/4892-153-0x00000208D9890000-0x00000208D98F6000-memory.dmp

Download

memory/4892-154-0x00000208D9890000-0x00000208D98F6000-memory.dmp

Download

memory/4892-213-0x00007FF6D0530000-0x00007FF6D05DB000-memory.dmp

Download

memory/4996-177-0x00007FF711770000-0x00007FF711884000-memory.dmp

Download

memory/4996-96-0x0000023267D10000-0x0000023267D76000-memory.dmp

Download

memory/4996-97-0x0000023267D10000-0x0000023267D76000-memory.dmp

Download

memory/4996-95-0x00007FF711770000-0x00007FF711884000-memory.dmp

Download