fa522b5698cb702cc0a76cc50433f3d7dea9d7f06a280de0e9eb89b8fa370fdd

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Size 2.4MB
Sample260807-bcr4jsvcqa
SHA256 fa522b5698cb702cc0a76cc50433f3d7dea9d7f06a280de0e9eb89b8fa370fdd
MD5 263f4b726acdb04145ccecb018b63a98
SHA1 9dbf31a6603baa182a004eb56e7c5fbd7a5bc0c6
SHA512 c2e75aac0de90457ad9af1040f7fc236ecbe71af3dd79b9f3e1f253a11741b8c04e9d1beef5d76ab8a373e82f6c164272641e010eb8a6f0ccab892afa135b84c
SSDEEP 24576:clq+TZtG00f3GQgYHhDZRkPKIHJ4uyFteQdiOcIyTBlf0nQ/tbw/2Mkjy6Fr7g0o:cNTZ0VDVRkP3p0diOcpTvf0Q/lFTjN4
TLSH
T113B58D91B6E4D2B2CC41097050EAEE1D4B259E686737C0E3E1C93FDD8E378E1957628B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
952	alg.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
4752	fxssvc.exe
2392	elevation_service.exe
3972	elevation_service.exe
864	maintenanceservice.exe
1412	msdtc.exe
3036	OSE.EXE
1292	PerceptionSimulationService.exe
2968	perfhost.exe
632	locator.exe
704	SensorDataService.exe
3704	snmptrap.exe
3412	spectrum.exe
4876	ssh-agent.exe
3168	TieringEngineService.exe
3760	AgentService.exe
560	vds.exe
884	vssvc.exe
3104	wbengine.exe
3984	WmiApSrv.exe
4136	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a5647c1979c0b0e8.bin	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\java.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaws.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001952d3280826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cd4d1270826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068e7c5270826dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000436f0d280826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046e503280826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003867a8280826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2fe21290826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bbdd9e280826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f874a290826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Pictures"	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80d43aad2469a5304598e1ab02f9417aa80000	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
2868	DiagnosticsHub.StandardCollector.Service.exe
2868	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Token: SeAuditPrivilege	4752	fxssvc.exe
Token: SeRestorePrivilege	3168	TieringEngineService.exe
Token: SeManageVolumePrivilege	3168	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3760	AgentService.exe
Token: SeBackupPrivilege	884	vssvc.exe
Token: SeRestorePrivilege	884	vssvc.exe
Token: SeAuditPrivilege	884	vssvc.exe
Token: SeBackupPrivilege	3104	wbengine.exe
Token: SeRestorePrivilege	3104	wbengine.exe
Token: SeSecurityPrivilege	3104	wbengine.exe
Token: 33	4136	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4136	SearchIndexer.exe
Token: SeDebugPrivilege	3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Token: SeDebugPrivilege	3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Token: SeDebugPrivilege	3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Token: SeDebugPrivilege	3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Token: SeDebugPrivilege	3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Token: SeDebugPrivilege	2868	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3948	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 1780	4136	SearchIndexer.exe	113
PID 4136 wrote to memory of 4316	4136	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3948

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:952

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1180

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3972

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:864

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1412

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1292

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2968

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:632

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:704

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3704

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3412

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4876

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2748

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:884

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3984

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1780
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4316

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 71ba19b983871ef610c3393e8eb75df632ef48ef7bc46c67dc6f0af22ec5bceb
MD5 d3d65189884eaaf97dff3818dcac6c3c
SHA1 d158e1d33ec91262738e73bacecc0ee6952c8206
SHA512 ff6c4d4a4272a91670d1907138ff8aba10438e062d6e97bdc5be63971234af06c4942d6b9f37962e4a2b39e9ab87f956722cf90af7e0fcd0c510263a7023c57b
SSDEEP 49152:Bb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2Q/lFTjN4:H3q6HjBaLm
TLSH
T185D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 582e3a9ac32e7a1baf1ac59154fca884c25d1b71873dc081b495466b4d06af1a
MD5 6b56483bfbcebb4e3fce88b00602bb75
SHA1 7dbaa4b1cb55ca3480c577080953854f2bebeb43
SHA512 b7dd7d7628192a77c65f19f7a3ec1bb0346e3948c3380cac9f8fbeef82f9cd6351a05d7b466396885702eee4ab5c23478db1fe5c25a6aa5e76a374049fffc237
SSDEEP 12288:b1XLsswWkxy2lRq2czAZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:hXYfDtczApnQ/tbw/2Mkjy6Fr7g0o
TLSH
T18075F12877A448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 2e03b006450b572e54694d434273f5afa8b9babab0467e13dd7c4961cf2a1221
MD5 ffda03c0df7679e1dea95819a7fa37fc
SHA1 061ff3dc2513b87470df5262cb566e15fb698673
SHA512 85a55f6c0f9ec199030d03a3f5241f8daec0c02ff6b38fdf14c93c91c54761534a9b007df64d4eff535034ff8bb90d56eb3d9c16f58cbac5930eadf773d04582
SSDEEP 24576:K0Le5ji0hmxmrM+nQ/tbw/2Mkjy6Fr7g0o:KPji0AoTQ/lFTjN4
TLSH
T156959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0f05f266315d477d15436d582e3af8241e94d4f72de716c9cba140962ff5d163
MD5 437aba3f0df933f0c38eb5b59fcf56a6
SHA1 17240139889a2dfce7fa8af9e105459e93b3b5cb
SHA512 26ede3a91a56954f253f95286df42bae4b3f412d3403294513a4a2a0ec0b3d06888e2bd162c5b7b45fd36ad0599474ef5b78e10c2745908534da929f5192d650
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWE6q8wyu0nQ/tbw/2Mkjy6Fr7g0o:h/ezSC6vUzPvxHjynQ/lFTjN4
TLSH
T143755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e9b046cc8e2d319adb4163102bfec289d4551d5f8238d65eff4f07be6f6d6e89
MD5 92af54fea284d8215e8c30c5e2b8b61a
SHA1 e7f9522da255351ffff0b61eb68afa7ef0368679
SHA512 74f607bec3ca54fc5fe05eb1f8a7de691118e6d7a2309b5646d157f3ac406bf3b5717e32465b4c109c07801a30ae275cc233b99c25a8447555352018e4434f65
SSDEEP 24576:MVbqPb88hv/l+6FnQ/tbw/2Mkjy6Fr7g0o:MVO88hXl+yQ/lFTjN4
TLSH
T1D1559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 3efa0e26900c1d95bfdd102974cda8a2a0f7a8aee00716b0d83bcd44940810e7
MD5 bd1a3e140d989c99225a71bfd93de96c
SHA1 aff1e694ba4e49f5b8402fcc0f26ef8777ddc78a
SHA512 453c32abbcfd3a58be2557c1918ffd82639778d73759c2e6e9646d3d0dc7b664613c18794274207df36c5164db22a5416aa4d5ceb5eee95b592ffd569fffb8a2
SSDEEP 12288:a9qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:a9qnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1985523696624F887FB2B06F15CC38582AB7B0DC1AFD0A74E6B44322DC53C39496DB785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 90717fcc376fff6c0987ed68ace454a6bcb28b6a275285a5d642510472715d41
MD5 75ddd5ae86f7ce6660c3d65eb34edf18
SHA1 c532f4d9d6c36483deeb69a67dceefb0e6504d22
SHA512 603096e88006c462691d2641466dce4250e8085ab6d4240d8fcb3fd88ac2e50a0d8bf37b0af85c2fbd6cc91a5765b0cde06011164cf110460888d12e0617a291
SSDEEP 12288:heBNUbTVO86UtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:hJIUNnQ/tbw/2Mkjy6Fr7g0o
TLSH
T16F75CF3BAE28FCD2C27E4DB85A918640E77278704F51A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 03518a6f8661d87b54565f7be3f52c759342ea9f2553511467ccec9b9b45bf3e
MD5 1cbd8bf4cb33d142d8ea26e4de7823e4
SHA1 0350bca681b9291c4bf2badb3b2341a913815202
SHA512 ea18703e303b06af360ccb25a9fc3005799f85756b010ec7757f356cf622597c8057fcffd540775d5c3f6093082a4978dc61328b1ad2d7442aca401ea28601be
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH1:8QvGAdlCEL8c/yRNw5C3Lm
TLSH
T1C4267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 9f9139ea8f116a95a4e574e0a106b9092e349e63c05c73357e4ec360cb1a63ee
MD5 574d133ad6240de8b60a5712eb798f67
SHA1 49d04c32085341eb7a2d2e88c2804c87687143b9
SHA512 a7b972f30db8604496eb823c8d19bbeb1ea5d1b6d32f4f2e0e654301459487da0db88e1004596b04a5b507435d571b939b3d073910f86771147db18c1d57ebed
SSDEEP 12288:NAwSfxL/2Dc3kDLLmt0LDQewsAjzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:+5ewsAjjnQ/tbw/2Mkjy6Fr7g0o
TLSH
T12685E031FE74E436C77F0DB21B22C706683D69604FA11AC3E3A85A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6fbfc39f9ad51db41def96fd0aa709865f0cef8f2ec81829edec0485ca4f0345
MD5 bab7d0c85243dccbbc7d6204f3a73542
SHA1 70be58cabfe3af7894ac6cd58a0a5c226c7f43ce
SHA512 e40700fae8297911691a3510276137ff7ad5b28a195118dfa4fb57a39a417a5aafe35e128f7de1b6e159b26c49c55bcd67a0c2f893e5a7b3979f7721eb293906
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHwL:NUEtQevvqc2W1cpV2EI32
TLSH
T1BD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 364a7fe126faaa68f6d90034f3a8b1e76433337d2d636b6496901b762b930e52
MD5 70e350e499d87ac98163f0ded1395084
SHA1 bf82e88f1965401fa15b3237bf4708d14c08c05a
SHA512 cf13291eb88a38db315614bb96ecb22ba82048f2a4c43cec43151f4b4a4cae86db7fc880c7da553f8e42ce734b76e68fcb087f2612d99b391100c679d0ea6368
SSDEEP 49152:rCbRquA/m2yL5zQfFiV+XenmE3/zDQ/lFTjN4:0oqtVjnmLLm
TLSH
T1E6D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ba99fc948fc0a36e4364a0d4b07e04604ea8b2d1a51c7792ca5771933ab7e32a
MD5 f23688c5b3ebdb2509218aa41cabd8dd
SHA1 18ead146e51ca291b654509f0ab1147e4ae22732
SHA512 907aab2120c43f9ef5e0fefba2551b0839447da63c83ec25c3ab07337e6fd47d844e6109f5283a767e805578bbe3b1df5b983cb59cb6f7463fb36116bec41e19
SSDEEP 24576:zAhGLJIFoiwtA5l7S53InQ/tbw/2Mkjy6Fr7g0o:zAMyFoiq54Q/lFTjN4
TLSH
T1A235AD80E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E37A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d9029db8b4bc379a298b719f81a1715c7e8ba2eecb9bb558f3e8e8e0857a870f
MD5 ad5e257cd37b2591c0a51f8e0d57caa0
SHA1 42f4eeba3b788693ec9242a46ba528ff93a26279
SHA512 686d0a14425f6621e427d4cf2d9059cc4cb25a4b3b7e92fb1bdf2f4041d3f14b159444da5e9d7f97ff77dea9e1dddb418b916f1592255dcb30c27e5e0fcca39b
SSDEEP 12288:imw5HEjsChNZBFgl0WDm+C0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:7wu0OWHnQ/tbw/2Mkjy6Fr7g0o
TLSH
T19F75F14A36A41CF9EA6742398993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 0648050a6f78a1ca2772c348031b2268059df30b69f5e9b15d556ecdb4a9473a
MD5 64dfb5f18678662d05028497cb5b9c36
SHA1 5d6904e150813201c8f147183725eb1d53040389
SHA512 9fe9a3d6f7def991bbbdbd94f98ebfe516ee4e1eb6713934fb9b9e6effb7bdaf2331ea69318f161da71b310dce50f5bd6e4a34fa8349de52712f0768a7748cef
SSDEEP 12288:J1Z1IyDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:jZuGnQ/tbw/2Mkjy6Fr7g0o
TLSH
T12B65126933A470FAE6674278CCE28646E77338826BB193CF275442695F3B7C11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 229cad18e83f2103b5e8cf0b94ec187d12a5b57227d6ab42524a200e05100d31
MD5 a3f0049e54d438d1cd48167f0a0fde84
SHA1 9253ca27f07b4f8ed914941629b3a457a7cc967f
SHA512 056953943900bd212a0ad12cd05e87a8b4f947530a798ed02d856ffdb5c4c969a3ab7d49bff6912ab47bcbf18057e5e170918adfb0d9b750d989970a3a00592b
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:jQRQyi36YOcPQLvw2gAf+PN3WLm
TLSH
T166667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0a9dca0075553586d9208b122389863c626a4fb6c622d07f86557e4add9e0266
MD5 b622952f78422d64c8b515608da02e1d
SHA1 921936207e161338d44d4a28e9d83e363bbaaf34
SHA512 491f1edb15384fe52bdb0c2fde81267e05942ce6f4476b014bfc13039d9b31f362926167c16db1198a029318df15a026e42867de249fb2393c9b87a7a16e3bb8
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:UQRQyi36YOcPQLvw2gAf+PN3WLm
TLSH
T154667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e6a115a7e047912b4e975f2b590a4e2260db4e59fcf540be8e54a4801599cf83
MD5 8a33eb1b73ea83ad5279a07de4571807
SHA1 40c9b7a5e27d059f82838eec9250c67259f0fa44
SHA512 b42ca4791d1b64ded88aa458b219ae1f7b1beadeb66f4a3acd6c29bbdcd052c5ebd540cb4bef83ebdf051ed17e225770a44609571eb4b2819dadc76b3482cd44
SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL02nQ/tbw/2Mkjy6C:j68Qg55nhheWu7PNU3/TQ/lFTjN4
TLSH
T170B55A33B2F60099C44DE1769F46873196E27C758FE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ed67c9724165cb2b00eff9540ff70d1419d1d8d31dfceb7fc3e977f4ef9faf10
MD5 a71204da4fd6494e3d213d4447812b5a
SHA1 7c8b6f1e2f19c8e32f6b287245f1cca12acfda3d
SHA512 243fef55299db4c9da161e2e4bffdadd2459aebbdf26296c117810655fa0164904eb5b515a233d8f3c6fa34f82ad0187762161af4978e1884a083ccf391a7514
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk997:Sy5112gYy5azzVvL69nLKnhZlLm
TLSH
T155167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1634e0ab05c5b6c16b3606727979e99d795d9831e8562d4c16f12c838ca9aa26
MD5 1b622eeef67d51af07f17c60f61947cd
SHA1 4f8111a713e2b346978f0a8924f9813961754227
SHA512 7b179bc4501eef62fcc85fe1189f481cf80f87aba8260a9f6e9f650441f318898edb9414fe0147088529f1fd01d33777b8d7a6aeb12c270da6f72c90e75ca2ba
SSDEEP 49152:YB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glZQ/lFTjN4:yu6JmVxd2dOLm
TLSH
T11ED59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ead7ad782718068673c7a62162b718f788f4fecec134c6e11768067c725dca3f
MD5 9b59e13b0be212c7556864467d0701a1
SHA1 a080e3a9eaeec4ce16ddde482561a788b35c86f4
SHA512 48e7d90cc5e521ceb67c0fc84bc44ab419a6d14159b54dba56b401ccc72b171dcf6cf1fb7fcd032713532379db1f9e0742ea3a8fa5728c214c18424e86b697ad
SSDEEP 49152:F1hpsNoJpF1A6UU44CwH7R4xtQ/lFTjN4:FmifPbRLLm
TLSH
T1C3B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d4d35cb2253d7365e0b4b707e595f15afe1ef74e9aea109270bc434c26881454
MD5 e7698f737491f1330f9edb09ac3d162c
SHA1 a30a787d44a9f93138c1bc6347b49e57f3837960
SHA512 cab53cba0aff9d145724655409edf54c578e283a6d8f10a8f2726c80e77bd68fbf6b40725641976fd5e4738643bc0c41e496d6a31237e090446b3c899fa8a84b
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHqGQ/lFTjN4:w5dKTi61RLm
TLSH
T124C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 daa46ef6cd95017e463a21d6362b813fbdd1c27d7c68d280c659d10a5b64b7b2
MD5 1bcb62c86570924fcefc93dd7e1b3c8c
SHA1 09e196a700b858fa3641c30ad30eb71b3e881680
SHA512 a91bfa1fbd6b5a0fdad3df39195415470305275919947cd3f04ce99edbdfc99cef3508f5807be4327cce2b242602fa8a03e2daad4e0aa686a647cac7a61398a4
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5wpQ/lFTjN4:LX2iyph/Lm
TLSH
T15695BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 b0ad8d480e6156d749e04946c1cd5245c33048a0ebfa172fe3c674cde748de39
MD5 29c324d711093c2643598a034da0e38a
SHA1 7a4956ee1de48d234349ed5606761d8fe12ef0c7
SHA512 5b629f25cb4f86bd8c444a2e6d4a782e4b29341de4d8afbe0d87a64e5d6d6d5e04dd97a428cc0137532ba73bfc287c4ffa9a19155433d16249fbe009a4ca6943
SSDEEP 12288:YyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:YynQ/tbw/2Mkjy6Fr7g0o
TLSH
T1665523686565F98BFB1706F18C838182A77F0DC6BFD1A38E77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 29e55fae4c9ecaa0d4d050c245fd37667a4b952947a5cc80400fbff978a86533
MD5 1b18040dc68a0ce19f08c981c704c5ae
SHA1 39f3d4c3721e164b325c670bcff13bf7ed6e665b
SHA512 4223422681255c0978c957926794600744ac67601eca599a7664d80c69256e955d0ca670a8ef3984a240318ea9aab0c7b3b40655f894c0f88483d0d2b5f797fc
SSDEEP 12288:r/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:rfnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F05523687565F98BFB1706F18C838182A73B0DC6BFD1A38E7B482129967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 be5d8a728a122b89e6dc557c5c31312800102bb4fd5b756568d6c60abf6aff82
MD5 3bee2426f12098a18cc9d95bf7382059
SHA1 cb7c2c17fd4dcd7448055912944fbca4f6a2ac78
SHA512 cd03ba56447027d03c29a8046d308a80ba602c91fc9287bb746ef9cdb5956c3f9e97facf2a847061b2c576055dfd58f9acf3104af79e0b91df998b988228ae9d
SSDEEP 12288:NVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:N1nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D85523686555F98BFA1706F188838182AB7B0DC6BFD1A38E7B482128D67D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 13ac264d7b32044027e73bdc21b0057c8cfdef6ba47fac17e7233d62335a6c87
MD5 9e0b84043e842528a20d87b90801dbde
SHA1 c326b9db9ef300c0ce26e6d85c4d3062cb5db964
SHA512 ec2aab014e08cdc3e6694d8ab2fcb9e194d1503209774c48c96252815eef5c05b9c8e386b60aa8bf0e7b699af26b1bb0ecdcce98ce627e1d2f3648bc8dc939f0
SSDEEP 12288:tVoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:gnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1EB5523693669B4C7F92746F5CC938142F77B3CC5BBA1A3CF6B0011194E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 508aa20321fefe062c5299a042019aa259dba414bed219bbcfa8819442b9bb0d
MD5 7e1ce0f9bc18dc74d8b44dea5e46e468
SHA1 b00fd26a54302f0d0687ee5e7f0aa5b67371bf9e
SHA512 acb5828de44e8a2d0ed29f4ebc0049ba99bb5732577829e4aae5ec078afe95859e0f3137f3ec8f4b7eea98a0341d2925d282a3459ddb01a55523bc079950b007
SSDEEP 12288:kgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:kAnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1525523687565F98BFA1706F18C838182AB7B0DC6BFD1A38E77482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 52c8dd1a86e26ac3e73f5196b1e43d2584922a367e555ceff3aa57a4f9d33d8f
MD5 54d7462ea02ce2e8bf4b5e250d06778c
SHA1 cfe46889f0903c8466bc4407990c000f44cf8841
SHA512 ae47b0d589829977e9619b05a4201c583be5d9e08edc4f6dbc4ccb7c420b3a3ff6066c33531061f02a247778fee645bcf3af5adc2276390270030de48078d7f2
SSDEEP 12288:WbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:WLnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1805523687565F98BFA1706F18C838182A77B0DC6BFD1A38E7B482129967C39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 e86123847cade93847352004df4fc01272ded37fbefed6d488ab7b777f55bd23
MD5 c2f32d6c4e79d6c857d4053a735bdfb6
SHA1 7140f810c55381c6b6182a9d49be700ca4c68a7e
SHA512 8fb724fcd8d380bb64368a8099ff0219f0d78da1bfd28c687e9fda6d3d2e2a0437c44838b2aef47b47add178dc76d7bfd2644ba390f94ae0e7bd9ce7ee97ae74
SSDEEP 12288:jXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:j3nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A25523686955F98BFB2706F18C828182AB7F0DC6BFD1A38E7B481129967C39415CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 99b8daa0848f5bbd9ee05d51c91c35ac284e5127ad2bf09349a7192cf445406f
MD5 8034ffaf9beb80ffe2563472595e2e26
SHA1 0dcbc1da0525a8efc7cce93483078e28fa2a170a
SHA512 0c1f675dd91635b2e4502d2eadc0dc5046cfcd6be539d58bf4b571587234a7d7dd67cc679a4c747f07ab7580a5b13959079f308e9c43db10b7cbb57b67dc6896
SSDEEP 12288:eiZwb2zzFEoS2cPvyfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:BZM2zFVSO/nQ/tbw/2Mkjy6Fr7g0o
TLSH
T13E7501A4B3505CF9EC67827ECC528906D6B27C5A1BA0C75F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 0b662feeb1c468224d5e2329124b612aa5712fc2a599bd1d540cb4d3e6bd9bf5
MD5 98d767ff46d2274e46293d4b20175207
SHA1 6aef2d5b5f534da8d3b928ad3e3fe55123b75ea5
SHA512 fd9af94509ebb581c9ed3bc35850e449eb08e9d4957fe5eeb4b937a30c5ed6b6eadaf4f51ef92282e9eeba48e9d68b7a66cf42ea522e65f7f39f85e037cf2c99
SSDEEP 12288:o2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:oWnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1695523687555F98BFA1706F588838182AB7F0DC6BFD1A38E7B482128967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 4cafb1fbf4451ba18c39be1371f3820844c53e3f33d64010ae9519a003904b8d
MD5 6ede3936e6635c67a6e019497dd2ef57
SHA1 d87f34a2043e535aba74632cdea75837b81ae56a
SHA512 f5ee8c7d215e22d8f3c3f1fb3671ed8f0a903f376066da179086e515cb2d8061c5f408be4391bcc2e026d637f9319f426e8056b4657f9a45e2163cf20ab38361
SSDEEP 12288:N6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:N6nQ/tbw/2Mkjy6Fr7g0o
TLSH
T19F5523697554F98BFA1706F188838182AB7F0DC6BFD1A38E7B482129967C39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 3c9590414be2ef1fa13f99fbcb2529b84898cc004848dfb9a6a9997f4870f243
MD5 c621c4ff07019c5a65e25c182f31ace5
SHA1 e94cc99fa301e91fbba858ac015962dba42e1320
SHA512 e3a549d66ee6d246e10fbe9c998a679bc53dc3f1c8b7e8a47ead7a29e7396f11d54c7f5bbec0583b5c966bd0e6db80b9641483ffdb0df790eb368c53efb0705f
SSDEEP 12288:wyPz5L8DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:BzyznQ/tbw/2Mkjy6Fr7g0o
TLSH
T19565021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 8ee8c062f6b43407a4910bc9f1956006722a29cda736f0404dc5ff2f890e6227
MD5 b77bec8f7a0214856bd5ecc726dd3446
SHA1 726e7ce66889bd4ed77fc80373c3bb7449e7ddb1
SHA512 2c29e95e72c090e73873f6ba21f808eeec302f7a06e47c956f18609fcb335844fbab756f69c8d59d805ee2aeda8af26aba8851837eefc88848c47bfbac803dbb
SSDEEP 12288:D2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:DWnQ/tbw/2Mkjy6Fr7g0o
TLSH
T15B5523687554F98BFA1706F588838182AB7F0DC6BFD1A38E7B482128967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 541ace9e652bfaf1087951a9b222b05d7bad782226edc73b0f0d52492db7d822
MD5 edfbfee5ab4926ed521e780bb9660918
SHA1 8d434afe6ea3236ece47b0533db8ce583da52fd4
SHA512 75af4f7a13c211434743b8d25cbdb6a8dc71f7e6cc80e8bfe99f1b2954179662c4e58337ed250544c2755eeacde38439fdf3cd03d181264aa2491caa9b864109
SSDEEP 12288:P2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:PWnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1905523687554F98BFA1706F548838182AB7F0DC6BFD1A38E7B482128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 9334cde71c2382970c240a0d14498a9c618738a8dc81b43fcb1fed08a1fb2106
MD5 9dfb7a81163dfb9b9cbffc18569ea228
SHA1 66976632f064e217e0918bd05a1f2a0278888c10
SHA512 ec95123d92fc2adae0f07a591253fcd40b18c381207ca5aebf2fbdf897afd8ac543bbc9aefccf277c482244ebe5be8da32af004fc46add2b577f137eab6cf484
SSDEEP 12288:tyPz5L8DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:EzyznQ/tbw/2Mkjy6Fr7g0o
TLSH
T10865021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 1065a6f2954d54339936e1c5cb8ec379ed97c30e1c10542fb5e4a815873b9ad1
MD5 53612b3fa4a74fda9dd2dd169db58fa6
SHA1 2fe885061a140fd65998f4eb9128765a02281d78
SHA512 1c5c01a15b3995bcfdba45a4c30ea10b4e4e3a8d39a8de6cca68316039429b7a218067ada01cd887819e2faee5fefb3665e85f1fd3bf23aa302ebe4719b98537
SSDEEP 24576:4cP4mcvIjkGOxhKP2l71nNKbrh/8KBunQ/tbw/2Mkjy6Fr7g0o:DP4m4IpOO67W8KEQ/lFTjN4
TLSH
T10A65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 1e6fa3976d14d1408fce133271c0f44031f4b388ed192d5165a4573c09504d13
MD5 a85fca267426a0989c28c9473a8799c0
SHA1 61c29256416e8457db9ca9848cdb56cd38ebb4d4
SHA512 95d9e37e160b42296b0d45703970a136a4ea00bad12d58941760e537d9362926f9d6eec1f87c3d7121e1b29b004ec6ee38e593ac54b307ced0015421bf18991f
SSDEEP 12288:vRsfmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:YGnQ/tbw/2Mkjy6Fr7g0o
TLSH
T18065F019E29852D9D12E52B5CB828641B3373C9597E1D3CB67C0F13E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 0246afbd9de124194b28534ada2e8147ecfb8d26615ca3ed8c4869f06ad2c25d
MD5 1ed4ebcb394529fb1219423e362e144b
SHA1 cc6830d6aef94f7211e3f0be83e8095c2a07eda7
SHA512 4c7994d80aebce8ef3e06088fcd8915c738f0ad2c6d7790477c76cd6f42b3c752b9484d7efc09b83eda65974540be629a0ef7dad4ccb159ef4afcf997fd10084
SSDEEP 12288:tGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:tmnQ/tbw/2Mkjy6Fr7g0o
TLSH
T164552369A668F94BFA3B06F05883C151773F1EC5AF90D38FBB442229953C3D01DAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 24f1fcacf0778d4f2d1dddf7ecc048a17a77416cb18d03be6b2ae0f6cce77fa6
MD5 a7e2735fdb678485b2e1948eb37aeff1
SHA1 b4dbf2f102a00c59c18d1c6f2d9c6c56ab9e6c5d
SHA512 f31551cc20fb3f9fd179605b66fe90e00f13002759e5cd655d26e5928829cad88986168c4c3ee427cfcaf81a9c41bbad1e67dad20dbd13a3422ba598a33a1191
SSDEEP 49152:6a0h2GEkuAe73q3pp46zwwQAQ/lFTjN4:6a0hNYG4JwwLm
TLSH
T1ED859F1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 3a959ceb0516a950c70649a4e3d2f8932174a09418837b24ac4d97edc31114c4
MD5 e732129547ef8037c1ea7e6639af4f68
SHA1 01a3bcc4f72dd42e9dc0aeb52dd900f733dbc9db
SHA512 cfc86cfa36af843d1911bf8bd80796a9389a0f288d8b78f6d1541ee31d5ccc1b21c896f206a5dd77e575a330a0aedf738fa20aa40c5bfb11efdaa05153d60904
SSDEEP 12288:lhbHjfXvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:lhbHjPPnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B265027D26AC20DAF63692BD88928546D7327C552B11A3DF2381423D4F3BBD41D7AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 df1a96334387e2962804192998323fe9c04b98a598f39a1729c29e939ae71845
MD5 7e8b5fa0bcd54941e1517e582f193ca2
SHA1 8132af17c4f94282fce3d045c0f9153da85331bc
SHA512 aab493e4915fd0ddee46e49d7a6caae48c8255cc127d86ad93bd215a114c94995b075b8b4b66606a0aeca5c7cdabc46f45ba288ad74253ee72c7282dc1490363
SSDEEP 24576:g3YgnJcRTk4yti+R5dBR/HnQ/tbw/2Mkjy6Fr7g0o:gIgnaTk46pBR/HQ/lFTjN4
TLSH
T16345BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 496c1c17b3ca80f79b574293c9c5dd5469b153e1d5680d4de4d77c6231803e63
MD5 938712754fb6ac7753632084fa1610d3
SHA1 45db5828392f502cf14bfb3b5d95d34059c690c2
SHA512 6a83408be1f0dd5324d6754f5caf7d66d6298e0da48f9f2217f195b2a63b966cf5013cd1f8b82badd5a8b6216ed303a2f2b68ffe034928395e8aabf4a1a45242
SSDEEP 12288:TKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:TKnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1565523686558F98BFA2706F54C838542773A0EC17F91A3CF7B482229967D3D41AFB780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 83a8b2d9c6f8458666a850084bb653b1b63036527f880e854d77e997fbb5c87e
MD5 9c7e6e521c0ab4847ba88ab4fadc83d2
SHA1 d06421bd3e986b6543d706d07d1625f4b2a7511b
SHA512 182ddbcfccc61ee8bfe55db046a13c477b653ad64edae5b092b5a842404a47dada316845d9363226bb8d92184eae828924082f0a1c0d988b696ac085fb5f1889
SSDEEP 12288:OObZA4LWOsvAYFTZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:3tL3UTpnQ/tbw/2Mkjy6Fr7g0o
TLSH
T18A85F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 0db217b0ea429445f879d3028abbb294bfaa8947d1389ef2b36a4ea87bd13cb7
MD5 30a47eab1f48b14c3963a5d64efb3157
SHA1 060211863d216e0ea1e068a2068db681007e3095
SHA512 8d86b8b467f484494d5047b959c4fcf8b83c7289ea43cd7664a34bea1f57fe274c037edc0a88189f4db453b14936b0181e3c32a57bb44f8e01dc2812836ae7fe
SSDEEP 12288:TpFtdONGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:rOtnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1AC65022D36EC20E6E536527D89838249E37278921B6253DF07C0817E5F77BE85C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 05f25b534155b2c7537594a3769b1559b3158f3a4abe56be243401c19c71bea4
MD5 0a1f0ddf036f761c5dd519fdbea2aea7
SHA1 3aedf91f39e0c35bde8a77ec7ee33530fddbcd48
SHA512 c603cde26c1aca302b83cf9c57c22c05937dcb3a905f4cd17a0272fe5c66702255df26935c3ffded54dcd23ad6885a9f0ab7b04de59be2dd0b3e8a8e5f369a4e
SSDEEP 24576:57NM9YqZqmWMUkPjZM48Mv6bEhsWnQ/tbw/2Mkjy6Fr7g0o:57cBWMpPjN8DbEhvQ/lFTjN4
TLSH
T1A0659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 676f540fb172366d96c7f71658b9914d30ec350ef41997d3d0e60a6843b9c9ef
MD5 ee27567a6d28c2ae0e9b1990c462977d
SHA1 5d7d4765761f2109a37cf83aa147c6ddb1f15377
SHA512 8fa67d3996723437639cf57e9036bc47a60cf762e16cd056da78195347f9893bfc19185a190d4df2b70cf7a209b66ebf49c51a1c4b4f835c22ac9c83958ecd11
SSDEEP 24576:xW6BApg2YuyuNDYTabvcdvNYf8km1MnQ/tbw/2Mkjy6Fr7g0o:xF2YuHNETovAvNYf8km2Q/lFTjN4
TLSH
T1E2857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 63457f7ba2b1558d02fd93f4fbe5423d044978ee65856b5f9d3467dcfbee391c
MD5 f2f096f322e2b16721506287b351e9a0
SHA1 f8b98168ad13ae26f01490e5afba6b256de8a8df
SHA512 0a9e0e9f4bb2f27f7093522c2f7a44405921d181c678a38436cc0fc21ac65fdfdd300d220451017d216c57da83f62bc51fb08d8c874b300620de8684c49408c1
SSDEEP 24576:9AFs06+Omlf3NXEbToRnQ/tbw/2Mkjy6Fr7g0o:yFs060lVXugQ/lFTjN4
TLSH
T12765AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 a5a62672c3720b979688116422cfa4f4dd20377cf9acda8790b227e35c2c1c56
MD5 a6e6e4f4d7def8c6a568bb1ab1547fb0
SHA1 59fd1c61d12a192c95036f171aa5c158703c3805
SHA512 8e48c56aa72429aa90269de18b8403e51b7a22248b20b06b6aaf0b7e1a476869bdeb91f6b563532dc47a0910bc683e5dd797fb6f0f603539ac606bf722591121
SSDEEP 12288:CCJnJ5D3VkrszxWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:DJnJ5D3WYgnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A275D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8e4e752595d476cbc1d15af1b52d9db5d9acb9c310fc91aae9d0748b05058a73
MD5 85b8d800d643169b608ef4d587add69c
SHA1 ff85619a48a3ef3e1950c726423d8d743c79d994
SHA512 99e5e1fb4d84d9a66843c5bdd7087c01aa27c2b77178bce85ce54e573eaa40fae45de9d9a30da37310a34b8d4c0123e0f9c5e6dee5a4fa3c3b6eb8273f33ad84
SSDEEP 24576:lEPghm6/7IIXdwcXrif7qQncjlP65i3VuHnQ/tbw/2Mkjy6Fr7g0o:yg06DIKdwc+eQnSt65aVyQ/lFTjN4
TLSH
T1A3955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 f2190c1de27f120a3c1b83681e76b4ec79396233c749c3ed389ec7974af60ece
MD5 bb7c06419830a2ba088a367fa92d975b
SHA1 ac2c4b7b96678337e2acbd76eb491cadf95523eb
SHA512 aa9a760dd1fadf6c8f4ed1a6aa75ffb70b0e5bc0710c1acb70168e2902aff25f7a0fd15b4478dd74eb1c7cb6cb07c70d22c03a12ae39040dbb2f622dc8a31dce
SSDEEP 12288:oEP3Rj0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:DjUnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A365126D27ACB0DAE53B917D84928145D372F4A12B5267EF2690823D8F3B7E41E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 b052a32b027b34948029d0927cbe917683d0b2d51fbffe18c23aea1b200f8574
MD5 2713b78c35f5199c52c85986a7d7e8d5
SHA1 781901fb111e9c9b684ddc24e8a2170034fddbc3
SHA512 7eabcc8310d473be3b85ba5e7a28611442f21a0b169c40c6ddd3759447e8e4e681ac83abc296bd1950f0e053c0b20bc366cdc3d97efdf2e6f233a3db20c41828
SSDEEP 12288:5jky/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:5IyfnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1156513186398B4C6FA7A06788DA381919B367C506F2193DF6280F33E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 2975ce21e9faa0ae737426d42f9c9d736c28b188557442fd67af20cf907722f0
MD5 990ca5f51fddb10401a269367b896091
SHA1 4feadf58d8f0e5dc4bdaefae807e2505a0616ead
SHA512 c1b53f01b457a6710ce759acc572d56e1cf288f85c2b55f4a69c218031ccf763e411eaf8c7e61335c8717eac94d81ef55bd5e13690d582820331960286a2a1a5
SSDEEP 12288:jWdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:69nQ/tbw/2Mkjy6Fr7g0o
TLSH
T11755236C2625F88BFA2706F448938542A73A19D17F9163EF36C46239CB7D3D015BBB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a6df91c0a1d9631b13415a80fe6411f3871fec3f74fda70594d2d54d628b7fa3
MD5 5e318e0e561341497b3543efa16411e6
SHA1 0860c10ee4e99a95cfe7eadcb3017319c63d3d18
SHA512 ef2a54c718361946162c1e3d2df0b7400b11a4bedb62121e7e82173c1cd56d74ef2c6dc1026f4196e492ba19c5df861c6599698c813ea4743635011e814f7d64
SSDEEP 24576:fQ9MxZKdcz9dw3enQ/tbw/2Mkjy6Fr7g0o:fVKZeQ/lFTjN4
TLSH
T15C558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 2b49db4490f48efc1086503f94aadfe12ce20ac194e5a3c126f8ecb0cf9e03d2
MD5 b3eec0b0fb4438908598585b7f0516f1
SHA1 cecd0e9ab3430d1da4634127886743335e779cfa
SHA512 f5df6c086d28667b10ac980a61212d91c770a7dfaf7eea60db3ce5c30bacfdbdd6fb5db6526d1d192c3837effe5f2fca9bb72379be7a0c2ed73dfb9c937b4ed6
SSDEEP 12288:iyoKo2FRple9pzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:iyocHApjnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A475E01FBB6940A2E136813C88818745E773B4706B6263CB6691C33D8F77AE87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 38beccc8ee71a167a71fdd50174c3200cd9a8a51c72385183d2375bdd26952e2
MD5 cf58a4a0d3604c892151f12ebc9613ad
SHA1 d8998276cb63b6da3b56cba8ff745e1e9db0bc26
SHA512 6fa94c2d55a663aebc2b693201d56f9151d02306d11f7179a11e4180e154270acac9930418fbd1fe72317e5658548b660d427cd30d5429cd25759f2ef6af2e34
SSDEEP 49152:4WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKjQ/lFTjN4:a0zuNIeLm
TLSH
T1CEA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5ee00940d3362411c351ef109588c311780b160b57ab2ca7a2313d76db90c0c2
MD5 2ce6bdaefb9ef39d5c96046d1bfdd096
SHA1 27b254b6bdd6890ccf6b71d10a82d8268e5f81bf
SHA512 d8acd43e2028a7c315ff8d3c31da040055ead6159f60bc272fbe7bfd2099de07157df759a034088317c64bf3188d8cac89a77a87239e5d48363f29a2fb169fdf
SSDEEP 24576:i1QT7EcpfxR+N5AWAz3ooiYtjMqbUnQ/tbw/2Mkjy6Fr7g0o:/TDxR+N5YzTfjMNQ/lFTjN4
TLSH
T1F155B02EA7F855E9D17E85798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 ad572f365cc824c2df5eadaa75b327d466a134920f452ea0eceecec8cff4c961
MD5 93d15b3856e3c14002c26cb795567526
SHA1 3fb4e47da5be31eed1b8fa9fe9c01962e4af45b3
SHA512 ed6c794eacc158806732ef3b6ed7496f8ad81745b6f34ab4bad7eacf1d357e7334976c3f7e6591a4601dabd35934809f8a127a13fee4b50429fbcbb5028abd88
SSDEEP 24576:vTMdOz0FFS+2mSLonQ/tbw/2Mkjy6Fr7g0o:t0K+2mSLoQ/lFTjN4
TLSH
T16875E17E636D14E5E53BC27D9A438906F67234620322A7DB0690C1792F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 9f535678ad750a0b0d28137bf2dae7679a45c4d8084788ebad5b91a7a576ed2f
MD5 39fb86d4be029c72392b60bb53141052
SHA1 a37f60b5f7c090762847ce4c94a8be89db2af081
SHA512 f147526a1d94b5809c03d3f00a17c474511b9174b2e96b129dc53b356a2f8a2f1017df623d16bf3cafa04d2a5a2534ed6ac377406e66011782994d83837a5c4c
SSDEEP 12288:t4+ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:FpnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A465122C23E874D6F93752B48962414297327CA22B6167FF36C4D23E8F3A3D4597AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/560-365-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/632-112-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/632-167-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/704-347-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/704-115-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/704-177-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/864-54-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/864-55-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/864-61-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/864-65-0x0000000002240000-0x00000000022A0000-memory.dmp

Download

memory/864-67-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/884-159-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/884-366-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/952-108-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/952-12-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/1292-86-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1292-92-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1292-94-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/1292-158-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/1412-71-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1412-149-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2392-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2392-38-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2392-129-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2392-32-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2868-16-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2868-24-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/2868-25-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2968-100-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/2968-105-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/2968-163-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/2968-109-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/3036-74-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3036-155-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/3036-84-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/3036-80-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3104-367-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3104-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3168-147-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/3168-361-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/3412-121-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3412-127-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3412-326-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3412-130-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3704-119-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/3704-254-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/3760-152-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3760-150-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3948-1-0x0000000002420000-0x0000000002486000-memory.dmp

Download

memory/3948-83-0x0000000000400000-0x0000000000677000-memory.dmp

Download

memory/3948-8-0x0000000002420000-0x0000000002486000-memory.dmp

Download

memory/3948-0-0x0000000000400000-0x0000000000677000-memory.dmp

Download

memory/3972-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3972-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3972-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3972-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3984-168-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/3984-384-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/4136-178-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4136-219-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4136-249-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4136-385-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4136-203-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4136-363-0x000000000C930000-0x000000000C938000-memory.dmp

Download

memory/4316-375-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-383-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-459-0x0000029468610000-0x000002946888E000-memory.dmp

Download

memory/4316-460-0x0000029466190000-0x00000294661AD000-memory.dmp

Download

memory/4316-386-0x0000029468610000-0x000002946888E000-memory.dmp

Download

memory/4316-368-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-387-0x0000029466190000-0x00000294661AD000-memory.dmp

Download

memory/4316-371-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-372-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-373-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-374-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-376-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-377-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-369-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-378-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-379-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-380-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-381-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-382-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4316-370-0x0000029466170000-0x0000029466180000-memory.dmp

Download

memory/4752-68-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4752-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4876-144-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/4876-140-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4876-346-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/4876-134-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download