42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Size 8.3MB
Sample260804-a35lwsac44
SHA256 42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84
MD5 56005270408300dc74d52b69f7c2e6cc
SHA1 f4089edde57e3439c2d80fe538c04f58126e332f
SHA512 c9cbbba5949a4eb8f5057d29d96cf0d37aaadacfb49f0064e3fa2b5cb3294eba6972f303d0b638bd8570a23a0bdc428f3848e35275efc5037f3a7856c22b2af3
SSDEEP 196608:mI9CAKtGb/sHpSoazmClL5XfOQwvp10dPDkTZ:l91KtGQJSpzrXffOp1mP4T
TLSH
T158969E76B6A800E9C167C23D9696C547F3B3B8501B36A7DB0661472E5F339E05E3E232
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5972	alg.exe
2144	GameInputSvc.exe
4740	GameInputSvc.exe
5216	elevation_service.exe
4204	elevation_service.exe
5744	maintenanceservice.exe
4536	msdtc.exe
1500	OSE.EXE
1528	PerceptionSimulationService.exe
5092	perfhost.exe
3456	ReFsDedupSvc.exe
3816	locator.exe
4676	SensorDataService.exe
3820	snmptrap.exe
3772	ssh-agent.exe
2600	TieringEngineService.exe
4296	AgentService.exe
1924	vds.exe
5412	vssvc.exe
924	wbengine.exe
2748	WmiApSrv.exe
6116	SearchIndexer.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Privacy Eraser = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe\" /Startup"	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Checks for any installed AV software in registry 1 TTPs 8 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Desktop	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\SOFTWARE\Avira\AntiVirus	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Speedup	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Speedup	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Avast Software\Avast	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Avast Software\Avast	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Key opened	\REGISTRY\MACHINE\Software\Avast Software\Avast	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Desktop	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\W:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\M:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\K:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\N:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\S:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\V:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\Y:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\J:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\T:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\R:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\U:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\Z:	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\System32\msdtc.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\locator.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d5e99b7ae05f6396.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\AgentService.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\System32\vds.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\System32\alg.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\msiexec.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\wbengine.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000589829baaa23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000029a98baaa23dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087cb57baaa23dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4740	GameInputSvc.exe
4740	GameInputSvc.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Token: SeTcbPrivilege	2144	GameInputSvc.exe
Token: SeDebugPrivilege	4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Token: SeBackupPrivilege	3456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2600	TieringEngineService.exe
Token: SeManageVolumePrivilege	2600	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4296	AgentService.exe
Token: SeBackupPrivilege	5412	vssvc.exe
Token: SeRestorePrivilege	5412	vssvc.exe
Token: SeAuditPrivilege	5412	vssvc.exe
Token: SeBackupPrivilege	924	wbengine.exe
Token: SeRestorePrivilege	924	wbengine.exe
Token: SeSecurityPrivilege	924	wbengine.exe
Token: 33	6116	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6116	SearchIndexer.exe
Token: SeDebugPrivilege	4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Token: SeDebugPrivilege	4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Token: SeDebugPrivilege	4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
Token: SeDebugPrivilege	4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
4848	42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 4740	2144	GameInputSvc.exe	91
PID 6116 wrote to memory of 3148	6116	SearchIndexer.exe	115
PID 6116 wrote to memory of 4932	6116	SearchIndexer.exe	116
PID 6116 wrote to memory of 1564	6116	SearchIndexer.exe	117
PID 6116 wrote to memory of 3508	6116	SearchIndexer.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
"C:\Users\Admin\AppData\Local\Temp\42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe"
1⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4848

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5972

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4740

C:\Users\Admin\AppData\Local\Temp\42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe
"C:\Users\Admin\AppData\Local\Temp\42d8962d306a649ac8b42ca6458603589f80a5f6e5985ce179327a7e18dbcd84.exe" /Startup
1⤵
PID:3180

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4204

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5744

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4536

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1500

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1528

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5092

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3816

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4676

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3820

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3772

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1924

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5412

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2748

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3068 3040 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2332 2352 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b2fb914ffa1074d857ddea3e85623987eb4fad5ea2793b99dce6f5d3859bd552
MD5 27f910549d628aa6a0bcfc54cd8b4180
SHA1 2394de3cabe073f0df535d48ca4e2e41f60facc7
SHA512 61ce7f65d4a77b743a0affa6421e12d453bafc3da7566d3c739cf91d322a397e1f6f6e41f3a7c3ec49527abf9b2dc4593f58a204d3e61de896eec093d4e5a41a
SSDEEP 49152:/b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnkKsENNASrrza/QLV1:93q6gjBy9Z
TLSH
T1A9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 203KB
SHA256 477f03ba3b1bffada4f928ee9857d9831c692367f80a15384c563f13d429f4f8
MD5 8288d781442a140964666d3c300cb262
SHA1 306ffd9b062655578b8d07ea9c6cff01898cd5ca
SHA512 e61257a4887a3c917ccc0971f5b27b3ef5c1425859005f1a6e9bccd3531316064efa5e3dde738e55009db44e8f414165db5a71582f55dc2274b20dd08ae1e2de
SSDEEP 3072:M97OwdyYUHSdhxbT1XaMsbrQbuGhVkSIuTUu36fohvNRHbC2lRBNSfsiLMv5:h41XLs3QysVkFxA1NBC2lRBN2/a
TLSH
T181147B38A79001F9ED5B817CC9A2C512EA72B45647A0E3DB03E49A751F337D06E3E782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 e46007f98e2e0d0cc5114acbc87326387246a59f8d1833627fce5a0042a73d2f
MD5 934b5f108d222b05c3bb0bc23bd8340d
SHA1 cb320c3d743fca3a29718f42cd178b0e7c9b48ec
SHA512 e77d8179f13c175a0787ec4f8080faf3abd738d66bb96e3b333b0d0304abf5dc6a06a5f1876705c22ac67a194162b69e257e1ec4bc5b142995d2bc41a7bbd4e7
SSDEEP 24576:IXY1DAczA+KsENNASSSr+GSR1g6/QuUVma:dAcysENNASrrza/QLV1
TLSH
T18D05012873E509E9ED6B817CC8A2C516E633789547A0F79B03A485661F337C81E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 29143a4f1c07618a72713180c9554d3b193d24c8121a22aca9da9b3d964fc4ec
MD5 5c7f373a7f9354153f1e3c5ebd957aa2
SHA1 b11a56f5274a8f94b0845d72f64836343b1b5560
SHA512 08f134bc9ddb47803e1f49564331b7c6db4c4268ad2804d8502700bb92a9e5ea0a32a0d4fcf3c71a80e7503c7d4f3d248a4c63f962c1d2902dac0ce978b957ec
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+C/KMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSRO5:uwuuOWQKsENNASSSr+GSR1g6/QuUVma
TLSH
T15305F14677F50CE9E66B8238C197D13AE7B278522A21D71F0760C29B6F373516E2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 80836402861c9c02824ac96e97f26add50a13f06ab2e87e7a222032bf33cbf14
MD5 8eacd25874e88e83b7e6f86da52adf0e
SHA1 4f9595155499a1137a74c6acb4d10acbc82d7073
SHA512 3516f0e82773d1711e965c743181bbc8a7e64069488cce721e6dee4dad451a6dd30ad50f7c99720ee174a86b37185fd714e98517e5d25d148e017c3e0b17e08a
SSDEEP 49152:8x+taZ3usBWOBr4tEGp0bqx0z+n217aau1glgsENNASrrza/QLV1:yu6JmTxd2dg9Z
TLSH
T124D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 75039c697248740ab7d95da165327805938da48c15c643da4c3e5ec6d78b510c
MD5 4e2da3e92ee9d2fdcdfc875c443d6312
SHA1 6ead35dab19be5ae3e0a58ad882fa8ec78c47695
SHA512 7242d9b8b265bfb2646a6d69d8c1ee74bc23dc2a5ebb9b42c80de5d11f0b0595870fb61fbd1c537f8a86c970b604e22e3a2b450edeaaf91e3548e3c553e24aa5
SSDEEP 12288:VOh+/U3fTT+M8KdScjHq4EJZE/7zRV4/7v1PnHcZ3/JI1SjLy:VgAUPn8KjgJQzUz1PHE3/m1SjLy
TLSH
T170352800766AC75FC6AD40325E37D2CCA7707D41EE04AF0772C8873F9576669BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 26c2187ef434f00dc4eba5d623ee346619f51834e2cd21ded2423e71876dd176
MD5 e3fcd91063a8ed1408bf4b35d6e18c6b
SHA1 de78a8a4fabd60abef031bb42b992549a099667e
SHA512 0d3776895c21568fffda4844cbba3a2db18ddf6269f64f603b5424e473f393801eda217570fc1b4c85e99c1df9e915099218f876dad4d1a495f60c603b787d42
SSDEEP 6144:gAd9D/AUILVmfUaawLbYq26tMxJfFf26tMxHH4F9l0P/TYn:dxEsbam3U
TLSH
T1EC55D8815537E38FD5FA6032072A6B4CA764AC0777096F26B3C8453AD827B25A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 e2fda2f45fd2718aa52cce8cc74fc2418a69ed265a06580427187c83b1c7e7fb
MD5 45f82695f13ea054413a2492443f984b
SHA1 11c62b55d3e39f1ad7e1b2f84d2eefa1dcfe343b
SHA512 ef7b37b22a698b8fd020df0676b7fb039b47393f050ede56915c1763e1c5d3271231f9c1f65da444a4562d47fc525f36cccc8a3d407a38f8f1b824e7c0dc0e91
SSDEEP 12288:sf7MKMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTYk2:KMKsENNASSSr+GSR1g6/QuUVma
TLSH
T121D42331A7FA4F42F27F51B0D1A9E01D103E34FABF41B295550192DB2CB2ECA1EE465A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5fec060cfad856ab31369f85db5651fc95634abd9160e7bb6e0611a26fb70daf
MD5 4384e2fccfa10dd614212560fb0c220d
SHA1 c9910deb74b18e6d83d4474eb832b56830e0c0a0
SHA512 2302a4023386182586a3e62bb225056946eb53eedd316e7d808ba73be0234e135a136b537733c33a5bcdb4e8b75829be3bf79045c99d953307307582a5ad83ce
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYRKsENNASSSr+GSR1g6/QuUVma:sgb4mBIBhGFFsENNASrrza/QLV1
TLSH
T11765AF1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 c81f45e05256b25c051ca30e80170f70535d752ca26baa15938797c79fa9e01f
MD5 1d6fe80e630e1e9f68537001e641332a
SHA1 464805b2a4a972580b7495a18626237e209c47b7
SHA512 701538321cb785184c4e2a1c8f91f9101b968dc1fce17fd6f09fccc0c08983309f4591c07f1f1d604b2ae5c73b660618aeaf52c87c58f4e18a40f32a72a7498b
SSDEEP 12288:WDGyKMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTYk2:0GyKsENNASSSr+GSR1g6/QuUVma
TLSH
T1F9E4223D32FA2684D23FC2B4C0B5A05E347130F1AB1532EF0991D1BA5EB6ED52678D99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 b4c55d35b871c5247a502c1b65d0aa66c1316b4ac1390ede59de3448d7b3024a
MD5 3d44a72e0a80b60545084d2e86c560eb
SHA1 f1af4ff73c550aaa1a0bc6b3dc33288d52a42fb2
SHA512 a5f4a433b04b6159ed988d51dee88d4ec44b35c0c27c5dacc51eb99a4087b5dcb6d2e79e56a6db044b161a76cf0db09c865091bea78976145da26beb083c4fe4
SSDEEP 12288:bmKMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTYk2:bmKsENNASSSr+GSR1g6/QuUVma
TLSH
T135D4232462FB4B82E26F91B4D1A6E04D103914F6BF8633D7051292D72CF6ECE1AF45A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 bd74423eb1226ab51a538911ec3d1ff75f4b7b3ee86f0c4223a5c9ff72ce39f0
MD5 b02021a5757bc7675a5ecb2d14147b9d
SHA1 adc1baff975575ec46853820803d25d8de8d1a3c
SHA512 15937ade41706edf6003c947f3e4e76551a22ff31b765597c8adfcdcd3001a7d98bd710841fb9b6442773ca1edd88c820efcd746cebbbb831f96a351957e00fb
SSDEEP 24576:IgF8R8rzJqH1Mzria7/m6KsENNASSSr+GSR1g6/QuUVma:R6arlqVra7/4sENNASrrza/QLV1
TLSH
T12635F12576F102F1D07BD13889864667F6B2B4251364FBDF07A88B921F23AD50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 c64943246246782a575e84536c6ef18ab296d6f787bd127d900b285cd2f3efb7
MD5 1ceb894649a034398f4ff16c25fd1eee
SHA1 8c2e1aec245a6bc529f2070d9884dba2dd00e7b3
SHA512 fbb5e2c986b5a3d29952a3f9492f33abf9320f7fcbf6c02cabc08f1b600cf4bb6b9007e35cf1097e8d8a88292d3b849a279832beed6d3f869e0ec93a2998ae8d
SSDEEP 24576:WPUr+NQyKsENNASSSr+GSR1g6/QuUVma:WJQtsENNASrrza/QLV1
TLSH
T16605E12E62FD18D5E27BE17CC586860DE77274621712A2CF02A1817E1E67ED87D39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 bac9760854e51feae00f069c9fdac5b9f16fb4124903ed27d315484158285a37
MD5 76defc9f6d7697501eb448e90fbb5ee3
SHA1 4eb6399bed4f32f25499f1f7c8c5668afd3a2c13
SHA512 75613a8ee43470c6107f8c52c1a54080b2ab6fb933c257faa3b106675da91a3148b2b06a6fb23742b63f12dcaa3bfd88add196bf63b21a5e2359ea8ac250b6cc
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNsENNASrrza/QLV1:cG05lO43ba9Z
TLSH
T1DDD5CF6A62FC01F9D1BBD17CDAC6860BEBB23425032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 ca5c09a1099dd04a9ca846925a8d282b77f9239cb60575daf9cc2c8d72b96a86
MD5 ef3ffbcc49a5d3dfce0df4e1d25953dc
SHA1 4c58d3defd3d542036b942153e1020652d92d522
SHA512 1eb988ee4a76d6a0f79bde960711f3ece59e4069e5ae03870bbed2f828689cb08126aabb5cf38067db6b916f3b77b9e41a0a7ac1e1e6c88e0ab6d7ab9d1d051c
SSDEEP 24576:loa5POZ3dpbWVM50JicR2hG0lasx2+47eidn3KsENNASSSr+GSR1g6/QuUVma:ma5POZ3wJt2pasx2+mwsENNASrrza/Qf
TLSH
T18C65AF5EA6FC01D5D179D17CC583861AE5B1346653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 48e134926e00f7c07b9184fe3500b30720b9a39ecb8002fc30ad7fefd95b466c
MD5 8d3297de2e5b314a6c65032f3d0ac039
SHA1 a2e396d1f23570ba3a7249b5b62071f7cc46e3ef
SHA512 e41e53929e2ce69212970f62d27a1ff77f277e08308d87dd85dae62a33d14931e61afc52dba5f76a9a3f4caebdb28aef05edd79aeabc8b7daba4e449f9214bf2
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7FkmKsENNASSSr+GSR1g6/QuUVma:lNc/zEOVHFgsENNASrrza/QLV1
TLSH
T1F7858B2623E901E4F1BBE1BE89779546FA717869573086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 f49ef1e140c4fdf4e162c8f6be9105825b6f189c011ac49ab6f6a24cfe689c08
MD5 78fd12f8e029f2b278c74884c8498cec
SHA1 ef44b28811613b18c21c8d240fda07cd834d4be8
SHA512 ba4fc791b99819e9311d81f383c1aff869ddd93e9b391e2f142f3bc22d51e9dcfe627528fcc74a2d314f8b6ba5d2405119161e4ea5888e64684d19a1129e19ce
SSDEEP 24576:AJnJPbzB4SrKsENNASSSr+GSR1g6/QuUVma:AJnJv6S+sENNASrrza/QLV1
TLSH
T1B615E03DD2A810D8E0B7C2B4815A265AFE31387D2F2269C719B4D5353F52FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ad04891c5799b90ffe3898f43e76d55c4b4584307b417e04f18f67e50ac79ce2
MD5 6cf2eeed9ed19794d31be3f276716220
SHA1 1da333f92d0d35f61c962b8d100a0f3c27a8a1fd
SHA512 810a7b81023a25194e28c4599d0b59ec6b3589bfa96e8af3dab5d46da9cbc82bbead0aa4e610dfba2c3af7f9671bf75dd901522763d11e0d324c524fbb24ea72
SSDEEP 49152:UCLHGeeV5ijCmlDWDkSsENNASrrza/QLV1:vY9Z
TLSH
T12EA56B05A7EB4184F8F3CAF4CA2694169A327C549B34F7EF4A80C96A1E32FD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 c1da37a5de30265242aea26bec0e7c8cd27cfc42b109efab11a8d11c467a00ee
MD5 3b7065a1c76d58d670eab4281b815221
SHA1 8d3b4f6fcdb7cc9526e87b99fdaccf6150ddcf01
SHA512 284aa725052a45f861c628c5ae8291b81b3848f9f1a3757372ac71b45d9d26f340b227b0eb2f03453b7a7e1a5d2bdc205190f7e86eb5c032c3c514a211cb7a37
SSDEEP 12288:y1Hnk6j5ZI7hKMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTYk2:j6DINKsENNASSSr+GSR1g6/QuUVma
TLSH
T16605012D33BA11F6E17BD07DC2934106D2B270B5975266DF0A94C1BA5EA3ECCB938E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 a0af9c2fc472a3817929e045b1fade7c125510104edb618442ddc17d73a388a2
MD5 7e3a4716935f62001d65513410cf38d8
SHA1 860dca0fdfeebc1f368b8289ae5309294d793ef1
SHA512 b5bd40082f3807febdd4be100d9f6e6480b7b5467ac7c9dbec3c4efb12511102db2fdf670eb0ea54edc5114c57ba3f0089dca88b9fba7ac50dd2567a6e2cf70b
SSDEEP 12288:AG6kyMKMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTYk2:RtyMKsENNASSSr+GSR1g6/QuUVma
TLSH
T165F4121463F956C1F2BF4278C2B281984A353C71AF1263DF0691E27F2E72BC96970B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 7dbc9ef6952c974ac88bbabadcffa127cd833847dc58dd942e78648a932f4385
MD5 edd109e77509d7f56b353436a2ba6b5a
SHA1 38462d8fa48c782843ef8d82acc6fb028b5a6014
SHA512 4d9a1552eaaf87c94c52f9f80cea10635f4637cdba456efb9de5de69b1c6afbb6b6cd32280e956e6025cbb42c30281c784b47adf8b1e32e1eff5655beec4685a
SSDEEP 12288:j7pKMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTYk2:XpKsENNASSSr+GSR1g6/QuUVma
TLSH
T1B9D4233862FB1B82E22F91B4D175A14E103930F6BF4632EF1551C2F71DB6ECA1AB0995
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 53735cc4a61bb184e32e3a01d784e924140519221535be5fc015ba1622dc3dd7
MD5 03553701320615f6f30a821a7f3a48bb
SHA1 2f68fbdc056818e2466d3b082c6ca24278eceddb
SHA512 fd79d2380229a48c6ef66cb4eb4e176cce48ab6d78e603efef9f1e86877df4585e48a8619cc26510e37c03a532ec24dd38ec85c73edfaa3c78a8665dfcfc9159
SSDEEP 24576:U4g4OoTfaidZiKsENNASSSr+GSR1g6/QuUVma:9gwTrZ9sENNASrrza/QLV1
TLSH
T139558C1D63EA06CAE2B2D275D8725493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 4ac519ee12d20c2cfc73d3c268b0ef54a41f0a2db1ebc7f1a641803f8f96227f
MD5 055d04e135eb3a5222785432c2b09d46
SHA1 23abb3b91359129668e63983bc35fd357069b804
SHA512 7945ec00db6aa7ecd91b85870705f714f787c8acfafca49191f7a874257b0b1ab0c4bfa319b9ba131e47071636b199638ed5d1641449d0965013e156478622fc
SSDEEP 12288:NpJcm8CN7KMTC3NpLASSi/nr+GpkPzgO+fJKUO3gRzLYroSROBuUVMDTYk2:NrcmR7KsENNASSSr+GSR1g6/QuUVma
TLSH
T19B05F11EB2BE00D6E1BB817CC981814AE6B37071675263DF02A1C3BE4E67AD97D34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b2c5a4b089a62062dd4dc79319c714bc6aef9720ead402c1df4c673eda6f7a4a
MD5 8599f608d3900c5d0526e344b46069ac
SHA1 20233415e45b0ee959725750e3e8d40f53c27a26
SHA512 f34051accc8192c3349a2678aab9c235f0db94f59a3dc319966eafc3360f9ec5ea16d7cd9ddc465ea66c95e303e79a07dd414d49d731cd10670478c4a684d1d8
SSDEEP 49152:IDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3+sENNASrrza/QLV1:V3Upow8sBV9Z
TLSH
T108A57C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6235bdb84dec6ea9230361267db5fa296d7c72b2fdb42f4dbf3a35288759e16f
MD5 9e85b4c926f3c8164561a79662efa8ef
SHA1 3fb67c029d84fa55aa332dcf39eaa436703624f5
SHA512 7b07e19d154a720c78ee3eda876766a7ca79d95eb53e45cf9cf5ba37b1b7a49eec83a4275de025f22a621ba4003094841407ef5a761fcc73eadde9f3b9e57134
SSDEEP 24576:STkNvNnaFeYhJNtmZBmgKsENNASSSr+GSR1g6/QuUVma:STMwBtOmjsENNASrrza/QLV1
TLSH
T1A755AE2EA6F806E4E1FEC6B4CD238516E6727461173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/924-218-0x0000020B110F0000-0x0000020B11156000-memory.dmp

Download

memory/924-271-0x00007FF77C4B0000-0x00007FF77C9B7000-memory.dmp

Download

memory/924-219-0x00007FF77C4B0000-0x00007FF77C9B7000-memory.dmp

Download

memory/924-220-0x0000020B110F0000-0x0000020B11156000-memory.dmp

Download

memory/1500-100-0x000001D9F6230000-0x000001D9F6296000-memory.dmp

Download

memory/1500-99-0x000001D9F62C0000-0x000001D9F63F3000-memory.dmp

Download

memory/1500-101-0x000001D9F6230000-0x000001D9F6296000-memory.dmp

Download

memory/1528-108-0x00007FF732840000-0x00007FF73298A000-memory.dmp

Download

memory/1528-109-0x00000281F22C0000-0x00000281F2326000-memory.dmp

Download

memory/1528-110-0x00000281F22C0000-0x00000281F2326000-memory.dmp

Download

memory/1528-187-0x00007FF732840000-0x00007FF73298A000-memory.dmp

Download

memory/1924-259-0x00007FF7E2540000-0x00007FF7E27CB000-memory.dmp

Download

memory/1924-201-0x000001A2AA2C0000-0x000001A2AA326000-memory.dmp

Download

memory/1924-202-0x00007FF7E2540000-0x00007FF7E27CB000-memory.dmp

Download

memory/1924-200-0x000001A2AA2C0000-0x000001A2AA326000-memory.dmp

Download

memory/2144-29-0x0000021B1C590000-0x0000021B1C5F6000-memory.dmp

Download

memory/2144-30-0x0000021B1C590000-0x0000021B1C5F6000-memory.dmp

Download

memory/2144-28-0x0000021B1C590000-0x0000021B1C5F6000-memory.dmp

Download

memory/2144-27-0x00007FF7C3CE0000-0x00007FF7C3DA9000-memory.dmp

Download

memory/2144-129-0x00007FF7C3CE0000-0x00007FF7C3DA9000-memory.dmp

Download

memory/2600-252-0x00007FF63AC20000-0x00007FF63ADB5000-memory.dmp

Download

memory/2600-181-0x0000026057240000-0x00000260572A6000-memory.dmp

Download

memory/2600-180-0x0000026057240000-0x00000260572A6000-memory.dmp

Download

memory/2600-179-0x00007FF63AC20000-0x00007FF63ADB5000-memory.dmp

Download

memory/2748-272-0x00007FF764440000-0x00007FF76456F000-memory.dmp

Download

memory/2748-228-0x00007FF764440000-0x00007FF76456F000-memory.dmp

Download

memory/2748-229-0x000001E95CCE0000-0x000001E95CD46000-memory.dmp

Download

memory/2748-230-0x000001E95CCE0000-0x000001E95CD46000-memory.dmp

Download

memory/3180-43-0x0000000007E10000-0x0000000007E76000-memory.dmp

Download

memory/3180-49-0x0000000007E10000-0x0000000007E76000-memory.dmp

Download

memory/3180-144-0x0000000007E10000-0x0000000007E76000-memory.dmp

Download

memory/3456-132-0x000002243E4C0000-0x000002243E526000-memory.dmp

Download

memory/3456-130-0x00007FF6F4160000-0x00007FF6F48A4000-memory.dmp

Download

memory/3456-131-0x000002243E4C0000-0x000002243E526000-memory.dmp

Download

memory/3456-281-0x000002243E4C0000-0x000002243E526000-memory.dmp

Download

memory/3456-283-0x00007FF6F4160000-0x00007FF6F48A4000-memory.dmp

Download

memory/3456-214-0x00007FF6F4160000-0x00007FF6F48A4000-memory.dmp

Download

memory/3772-172-0x0000028CBABE0000-0x0000028CBAC46000-memory.dmp

Download

memory/3772-171-0x0000028CBABE0000-0x0000028CBAC46000-memory.dmp

Download

memory/3772-238-0x00007FF7BA470000-0x00007FF7BA713000-memory.dmp

Download

memory/3772-170-0x00007FF7BA470000-0x00007FF7BA713000-memory.dmp

Download

memory/3816-139-0x000001B066440000-0x000001B0664A6000-memory.dmp

Download

memory/3816-217-0x00007FF7BD930000-0x00007FF7BD9DE000-memory.dmp

Download

memory/3816-140-0x000001B066440000-0x000001B0664A6000-memory.dmp

Download

memory/3816-138-0x00007FF7BD930000-0x00007FF7BD9DE000-memory.dmp

Download

memory/3820-160-0x00007FF698F40000-0x00007FF698FF4000-memory.dmp

Download

memory/3820-162-0x000002178FE80000-0x000002178FEE6000-memory.dmp

Download

memory/3820-161-0x000002178FE80000-0x000002178FEE6000-memory.dmp

Download

memory/3820-235-0x00007FF698F40000-0x00007FF698FF4000-memory.dmp

Download

memory/4204-65-0x000002637B750000-0x000002637B7B6000-memory.dmp

Download

memory/4204-62-0x000002637B750000-0x000002637B7B6000-memory.dmp

Download

memory/4204-61-0x000002637B4F0000-0x000002637B623000-memory.dmp

Download

memory/4296-188-0x000001D42E1D0000-0x000001D42E236000-memory.dmp

Download

memory/4296-196-0x00007FF79AF80000-0x00007FF79B2A1000-memory.dmp

Download

memory/4296-194-0x000001D42E1D0000-0x000001D42E236000-memory.dmp

Download

memory/4296-189-0x00007FF79AF80000-0x00007FF79B2A1000-memory.dmp

Download

memory/4296-190-0x000001D42E1D0000-0x000001D42E236000-memory.dmp

Download

memory/4536-88-0x000001F5563F0000-0x000001F556456000-memory.dmp

Download

memory/4536-178-0x00007FF73B670000-0x00007FF73B78A000-memory.dmp

Download

memory/4536-87-0x00007FF73B670000-0x00007FF73B78A000-memory.dmp

Download

memory/4536-89-0x000001F5563F0000-0x000001F556456000-memory.dmp

Download

memory/4676-254-0x0000017B98B50000-0x0000017B98BB6000-memory.dmp

Download

memory/4676-151-0x0000017B98B50000-0x0000017B98BB6000-memory.dmp

Download

memory/4676-153-0x00007FF686280000-0x00007FF686697000-memory.dmp

Download

memory/4676-227-0x00007FF686280000-0x00007FF686697000-memory.dmp

Download

memory/4676-256-0x00007FF686280000-0x00007FF686697000-memory.dmp

Download

memory/4676-152-0x0000017B98B50000-0x0000017B98BB6000-memory.dmp

Download

memory/4740-36-0x00007FF7C3CE0000-0x00007FF7C3DA9000-memory.dmp

Download

memory/4740-37-0x000001E0B3C70000-0x000001E0B3CD6000-memory.dmp

Download

memory/4740-38-0x000001E0B3C70000-0x000001E0B3CD6000-memory.dmp

Download

memory/4740-148-0x00007FF7C3CE0000-0x00007FF7C3DA9000-memory.dmp

Download

memory/4848-66-0x000000000A8D0000-0x000000000A8F4000-memory.dmp

Download

memory/4848-1-0x000000000A010000-0x000000000A076000-memory.dmp

Download

memory/4848-7-0x000000000A010000-0x000000000A076000-memory.dmp

Download

memory/4848-8-0x000000000A010000-0x000000000A076000-memory.dmp

Download

memory/4848-0-0x0000000009E60000-0x0000000009F3B000-memory.dmp

Download

memory/5092-123-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/5092-117-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5092-118-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/5092-199-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5216-55-0x000001FAA0430000-0x000001FAA0496000-memory.dmp

Download

memory/5216-53-0x000001FAA0220000-0x000001FAA0353000-memory.dmp

Download

memory/5216-54-0x000001FAA0430000-0x000001FAA0496000-memory.dmp

Download

memory/5412-208-0x0000025BE3CE0000-0x0000025BE3D46000-memory.dmp

Download

memory/5412-210-0x0000025BE3CE0000-0x0000025BE3D46000-memory.dmp

Download

memory/5412-268-0x00007FF7180B0000-0x00007FF718581000-memory.dmp

Download

memory/5412-209-0x00007FF7180B0000-0x00007FF718581000-memory.dmp

Download

memory/5744-83-0x000001BFC1290000-0x000001BFC12F6000-memory.dmp

Download

memory/5744-85-0x00007FF74FA70000-0x00007FF74FBD8000-memory.dmp

Download

memory/5744-76-0x000001BFC1290000-0x000001BFC12F6000-memory.dmp

Download

memory/5744-77-0x000001BFC1290000-0x000001BFC12F6000-memory.dmp

Download

memory/5744-72-0x00007FF74FA70000-0x00007FF74FBD8000-memory.dmp

Download

memory/5972-19-0x00000192A9F70000-0x00000192A9FD6000-memory.dmp

Download

memory/5972-116-0x00007FF619BD0000-0x00007FF619CF3000-memory.dmp

Download

memory/5972-16-0x00007FF619BD0000-0x00007FF619CF3000-memory.dmp

Download

memory/5972-17-0x00000192A9F70000-0x00000192A9FD6000-memory.dmp

Download

memory/5972-18-0x00000192A9F70000-0x00000192A9FD6000-memory.dmp

Download

memory/6116-241-0x000001B9A3A00000-0x000001B9A3A66000-memory.dmp

Download

memory/6116-273-0x00007FF663BB0000-0x00007FF663EEF000-memory.dmp

Download

memory/6116-239-0x000001B9A3A00000-0x000001B9A3A66000-memory.dmp

Download

memory/6116-240-0x00007FF663BB0000-0x00007FF663EEF000-memory.dmp

Download