3b034159fbee381e1c351bbebb6e517b1fce7ef89f859309e3aba74ce06b2f26

Analysis

user interaction
yes
max time kernel
1s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 23.2MB
Sample260831-sdmc5avaja
SHA256 3b034159fbee381e1c351bbebb6e517b1fce7ef89f859309e3aba74ce06b2f26
MD5 6ec95fe36d35278150aca62284622585
SHA1 1fad9d5161af60acf32a3bbc3466e8f236e33c03
SHA512 069e2886410c53233d805e524f907b3bc294d98c79c0a963e0e1044e290398b584ab9a782235b48ca34eb1f1716a0bb7db7d39fd233e63f8504fd6eda24094af
SSDEEP 393216:MSIYMNG52UkMbjGSYB2K8xvSk9GR64AEzS8bGhgpo8WsvyR8PhrqWjjFshhEZSN7:MeMNGsUBbjRm8lSkgmEzS86SpypKVqko
TLSH
T1CF37F10546E92FC9EB3D6636C6B5F403C6CC3AF5C5D2A3211A42624139F2DBAC3DB15A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
3456	alg.exe
1364	DiagnosticsHub.StandardCollector.Service.exe
2460	fxssvc.exe
2240	elevation_service.exe
2332	elevation_service.exe
4128	maintenanceservice.exe
3308	msdtc.exe
4668	OSE.EXE
4876	PerceptionSimulationService.exe
2296	perfhost.exe
4988	locator.exe
2520	SensorDataService.exe
4596	snmptrap.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d33a5fbea19fe9b3.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 27 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	688	loader.exe
Token: SeAuditPrivilege	2460	fxssvc.exe

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3456

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3244

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2332

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4128

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3308

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4668

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4876

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2296

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4988

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2520

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4596

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
PID:2724

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4072

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:3080

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:3844

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1568

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4236

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:388

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:736

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:3824
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:3500
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 072517f39cffed6bcdf515ae1a429b31c4e293ee44d07b8ec686fed38dd3a7e3
MD5 5e7164297100b246a1baba702e04dbca
SHA1 b9b84754ff10f276e32cf54c7eab4422dd27c975
SHA512 3321889c65f572c23d84ad6522b3da813035662f854ebc48a67b153fff4e76e322d586405db59ed2ddf303e43d4d9c85fd3bfc9ad94d2e58089a4eae0c624a05
SSDEEP 49152:2b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnySkS/Su37odjIv:o3q6HjBNSDFU1Iv
TLSH
T163D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 eb2bded6274e9f1128d8c434124da14d293ab16002229aca8b8c1e94eff7ea0b
MD5 33dd0f288e676bb11e3a452c415f33a8
SHA1 c58d7ec96591019a9bfd1781ef05992cb6dff084
SHA512 70fa5839c25bed17e52029fb93a988c280dbdf1d7205b601ef6ac02da1863f9b1471ce19799446376dfc31ff33a7c2fa6af5c3f1821d255ea66a1de45f4a74f6
SSDEEP 12288:71XLsswWkxy2lRq2czAhSlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:BXYfDtczAhSkS/SHOp17dadVZVyv
TLSH
T17B85012973A408F9ED67813CC9A18411E673BC9547A0EBDB03E495761F332D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 ce2ec83d3b29ddf3f1a256547f7eb3b2d611aa6bd178c52fc63415a897e7db08
MD5 6691ec4d83e00b30271d5889c338c2dc
SHA1 05f2430c6a3746b3f7158770592abe5276fdd640
SHA512 136c9a56912ea12317bd85844c4559f432c51a35cc7befe08e7e784d10e7011622a3c3ea4be4feb63d1a4b11803a774ecafbd8aad499f2c4fc7ffd68cfbb0675
SSDEEP 12288:pmw5HEjsChNYBFgl0WDm+CgSlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:kwu1OW/SkS/SHOp17dadVZVyv
TLSH
T1ED75F14672A51CF9E6A791388697C132F3F2BC122B61DB1F0760C65B1F37261AD2E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 34a44900a1c31a72840cbec96f4654324ef6a763f7c095abfc9f20dd50743139
MD5 aa0948217f3eae6ae7e0d5a7ded7328a
SHA1 e1bd6a27115ecea8966d8fe77dfdacf600259807
SHA512 3c995b45bc053ec3af36934fba118cea54be55b88ade442b6911a346b5f11942c94064d557249a6a2c541b5b75e6fca0d9735cbbe509c7d8322076d9bbaab4d5
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glRSkS/Su37odjIv:Wu6JmVxd2dRSDFU1Iv
TLSH
T191D59D13F1DA01E8D05ED478974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 e0a1c82d38f046fad42f04d64c729c1e5de3a32a94c0276f3793bec4a7de38eb
MD5 e64757ad0f27d047ba4c70bcba07159b
SHA1 86ddc0d4e9ec894d3919745ecb6b751f94af53a9
SHA512 fc8fce87b250986b19159edf7a0958113c4d65472edf8e7c1f226c1e8104980b0de72771e846e3345c6af13bc37b61118ef32fa8ec4cb40bdc15a3b015788d63
SSDEEP 12288:piSlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:piSkS/SHOp17dadVZVyv
TLSH
T19B652327F22D2C4BE397643056E440316128BFA97FE099EBAD50107B2ABE5D1CC6625F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d20eb9d1567fe1dfd3d0bcabc60519fff856eb632082d862f890014c18ae182e
MD5 5b292f44e5bdab46a42aad5c6954fa33
SHA1 847438098aba50c611997f320e32fb33fb872a98
SHA512 4039e31e12000375f4ce48d9bea807b20348441669bfd5fdb6e61abd557e088ce337ff7fe07d4d2c592846af8c80de86072f92daf1b1ba81c086bb6078c2e1d2
SSDEEP 49152:da0h2GEkuAe73q3pp46zwwQ8SkS/Su37odjIv:da0hNYG4JwTSDFU1Iv
TLSH
T10B85AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 2621ea6ac2e687be3a5cedb0bbbcd98f5302c16c1ad3bf2d6d63b50d9c24535f
MD5 553d91db5c4fb7bbfa6057c264f80f37
SHA1 275c9ba796540943e92fab5f7baaf446bc8094b6
SHA512 db93b5ea0164169df31bf2b87b9f7cc4d06e0b105b819641cde36570167a3ed1ae28b99faa25da7d7e231d381f6cb546b26c9893ffacf9c871e562e25c4d3237
SSDEEP 12288:UhbHjfXnSlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:UhbHjPnSkS/SHOp17dadVZVyv
TLSH
T18765127E266C24C9F272A07C96D54506D330BC662761A7EF26D1817E0F3BAE44C36B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e0a0afb329bc2ad2027edd1651eea4daafb6e7f6de4feef60ce2155fbbb4eec5
MD5 0f018a2c2110bc858599d95a7cd12007
SHA1 acd5beeef075ecedfffa5c1c0bff494bef50e683
SHA512 04607d4014355da4945286dc8ab586ce71e57c2cd7f329c1dc9727ca1e85d4cf7d6621296a261362f1b9e4dd04ce020e4184544be468f52ad701d4c05567f125
SSDEEP 24576:y3YgnJcRTk4yti+R5dBR//SkS/SHOp17dadVZVyv:yIgnaTk46pBR//SkS/Su37odjIv
TLSH
T1D345BF2EF2B910B9D4A6D136454143B5FB71782D1F209ACB0170C538AF1AEE89E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 8262be661e9e7f3af777482f31954a68352159b9f3ff5f4bcc47bf547c1eeb92
MD5 8148f340e47b8d99715ba167c49f8f37
SHA1 762873494670c8d50ce2b1310e163670ae6d6098
SHA512 0722609075769f48bc91b1a32acb7944bdb36b0106387d372f3fbb9d8e2b155140968b1603ec249f2b5d47120389166a3f7741670ff9864ee7b9ef714fb6112a
SSDEEP 12288:fmSlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:fmSkS/SHOp17dadVZVyv
TLSH
T17D652366B11A2C8BD387643056E440616164BFD67BF02DFB6C6420772BBF4E1C8B62DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ea77c5bdd551758c092dc9d73eecce50f89c870b23fbf4ad1127ac8fa5298cbc
MD5 056b81f10cdb30f19d05ef5ccc518633
SHA1 0fe3987ed92bcf928bb90c8aa21a8971ed0eb347
SHA512 b344e4ae6b287ef1bd7685f010a520d8f07a763ebfe0f5fd3abb44627f580b14b29619bf100904748c206340ffdc31ade95f2b1972a95c34e6a48b44ed7ff37b
SSDEEP 12288:TObKA4LWOsvAYFThSlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:8SL3UThSkS/SHOp17dadVZVyv
TLSH
T1E7850215F7A404F9E967D03CC9B28512E272B89D1760E7EF07A84A661F633E18E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b27744a87546ee2ff9ad1ceb508fe3396ac8c63071eddd2a5bee98f9cbd3b4a3
MD5 841be0679e461587c066318b39734a4d
SHA1 8521f3397bb5c7f90cbc8bff48e7d50f0f8c2fce
SHA512 5ba6b360e9fabd8281d6db6d6b10aed3f12e99455dad41da4e25a73f7e6e36688417d8ae92fb1863cb2b70c1165a38b72496b125d2faa9da0aa672440ccc02ca
SSDEEP 12288:JpFt0OFSlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:UOFSkS/SHOp17dadVZVyv
TLSH
T13775022A32AD24D5E176A03C8AD24209D371BCA6176157EF06D041BF1FB7EF49C3A792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e26362efd299e35ad35a6bf7e768bc7a24e673d5b09b338940c380dcf3e87323
MD5 d575a67b85803f3803c3edc9a9a406f8
SHA1 606f036a65009c391d0a27da84a669d80643e2cf
SHA512 5ad3156b0f77c684ca89d993c75aecc67176d536212e7b7cf552c0557761a626d49ee10cfb017ddd9c52400a77d86230abaa1bdf4c997a45db14350676ea121c
SSDEEP 24576:C7NM9YqZqmWMUkPjZM48Mv6bEhsSSkS/SHOp17dadVZVyv:C7cBWMpPjN8DbEhHSkS/Su37odjIv
TLSH
T142659E2E6BAC81D5D577D13DC9E28206F2B1B4611B318ADF1162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 552a55cc20f577f06e1a7615ed8ccc673c590b9e77f3245ff671b594fc831df8
MD5 51473d6e179898a313d49d5a58fccd30
SHA1 304162bb9c97e62475f0b3305542ba666aabec79
SHA512 485b5c8efd6b1085cdd37694f99d2acb88b2795cd5e5c6e48430c4f2abb8e484b6a0a3efa79f0d31372ce0a1b5adbaa41da6a503d975776adc8bcd76bd94ae02
SSDEEP 49152:4F2YuHNETovAvNYf8kmySkS/Su37odjIv:96BCf8kFSDFU1Iv
TLSH
T1AF857E2A27ED80A4E0BBD27D45F6D246FAB2B8551B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b9cdd0578ddd25212fd8bf3409ca020396b2818034cebe6ad524440646a37004
MD5 124020f8a279f8af952369cb9884d907
SHA1 4e30c62c986d45bf09051b4e7c47a8d7a494a2ba
SHA512 cf290df6bcc2e8058c0ac8dbb334f56f968015ec5bd8abde773f50857f1f59db1be54a2f33c9b5dd92de9b9c55238d8b2a9f2dc1923024c1797325ce20f1222e
SSDEEP 24576:BAFs06+Omlf3NXEbTopSkS/SHOp17dadVZVyv:WFs060lVXucSkS/Su37odjIv
TLSH
T1AB65BF3F62AC00D5D07ED17D8A97C91AF2B1746707255ACB0260867E3F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 60ea6f4167229424eccb1dce9a5c2d60594b04e5a2d750860d3f88ec423b6829
MD5 dc9ceb5402a8bc1de06f2d7ff5127215
SHA1 7a2f0d1eee61b250280638de33fa1d523db547ef
SHA512 ac8922343b9cedccdde3c92cd4c6a99baa00d37f2ece2cdf9c013f28f3492cef482a32e82b9fda973c4cfdcae999f9dd30859fb32b2e68b7769c2b8e957a1352
SSDEEP 12288:wCJnJ5D3VkrRzxySlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:FJnJ5D3WxcSkS/SHOp17dadVZVyv
TLSH
T1BD85D02DD2A810E8D4B7C274829A1756FF71387D2F2269C728B4D5353F22EE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5762a1c9d649152ebc98f867f473d8caf9adfccdf7771455cf3a505ae86b5269
MD5 8482f32455092e88902d581e4de47aad
SHA1 1123afa11afa01d3180786fa39cffd86da8b8d0d
SHA512 0db7b90565d596f87429d80fd47bf25c5b3f4c302976048c2400b25f1ca7be66f00476c6f73d4934feb6bbd06c5a9e4b3b02a0808198d5444cdaddcc4a77a858
SSDEEP 49152:Qg06DIKdwc+eQnSt65aVOSkS/Su37odjIv:xYSDFU1Iv
TLSH
T1AB956C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 a4655d62d8951142360c003cba2a6ba2c842b9874956a4cd7ed92b1821a0fa78
MD5 1f793efed7be2ac1602f5b285e556fd5
SHA1 824aec85ee5b25b5e9387dba9f460363ee98473d
SHA512 345c72ff996feb46ff038cd4bc06340be1886eee158c6f3a614cd4b260539c589ef1431138c6840100721e84c85852d5a0b6efe06677ec8561b6a9cf8a59d44f
SSDEEP 12288:yEP3R8gSlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:x8gSkS/SHOp17dadVZVyv
TLSH
T10065126E776D30CAD266A03C86E08101D371F4B52BA12BFF1AA0817E0F7B9E55D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 75dc8d51765d05f02f4cb0ecb114b7ae0058053934b5aa617649928948d3e3b2
MD5 580262c1102aba0c9e58e8ea95e8b61f
SHA1 94767dc92205656128a2fbac52a847c1af57cbb4
SHA512 3cef66b587cf33e6032622e2f176aa03450d8f23c34dfe3281ffec3c7dc7d835c16ead0d45cec8e33f6d8702ad900467665ce34b6cfaa5953973a42e635e9eaf
SSDEEP 12288:yjky3Slms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:yIy3SkS/SHOp17dadVZVyv
TLSH
T129751209735864C9E2A644389AF241A09634FC706F6057EF6490F23F2F7BBE0AC35B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 5a27558cbc706a5790c720f1fe771da5fe49ed13047c0835eade27f86d785c62
MD5 b29f1456879fbc35d6ba1aaa848f13a7
SHA1 cba8d7d1c1f0eaa8a2febf6f0a3d233b2f564c9a
SHA512 4a2f0bbfa25791bf653edc7cae8a86b1ce62fea06956abe9763640ce6b18bfd1f9a1e8a38bd3f67095e8bc97ee6d2126b253500fe967cca5ed0fd91d9b114826
SSDEEP 12288:nRVSlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:RVSkS/SHOp17dadVZVyv
TLSH
T10D65232E722A388BE383543056F404615174BEBA7BE029FF1CE0A0771BBF5D194B65DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 1bc0ff0627bcbe98c4fc8e571b95b6c9c491fa7d41e926be41ee0975b921cc49
MD5 bdf1a43d08ff8e3e09dcdf8c08a41e17
SHA1 98984e5b6c581dac7d97a80d9b77d588f09f8da6
SHA512 52c9102139ba703468149c64d7a0083b0a07796565686f09492d715062c28f9572bb6fc8620ae2ac776e9265ea129714a70a28fb914be1af73581d84b9a958c1
SSDEEP 24576:wQ9MxZKdcz9dw3aSkS/SHOp17dadVZVyv:wVKZaSkS/Su37odjIv
TLSH
T1BB558D2DABE9198AE177D23595A240C3A673B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 6a6836f60b346f2176b11de3a16e469b4645aba2349023c99716094a94374b6d
MD5 84a52de6add413ad0c1c2a785e6eae4d
SHA1 a1ac15bdbd35c9ec33de5345ad10ab5f610fb362
SHA512 5f5cb2e03e57494c046437c10be114d9ce7434febea86575c39648cf1040006d45ad86ad334b6089adb274d8cde639406aedc76e661a84653fb0bca3888720dd
SSDEEP 12288:AyoKo2CRple9p7Slms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:AyocwAp7SkS/SHOp17dadVZVyv
TLSH
T16175F01FB76E00D2E162803C89858245E3B3B0706BA267DB6591C33E4F779E9BD35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7bf28eb4a896806eb742daed4db1bad58ce486dfbdbfe821c36dd6293d0c1c0e
MD5 066853ae146fc6e9b7b5fd3bc39aea98
SHA1 086f4d6a5b3ad48fb3361be6289582284772c8b6
SHA512 7c9d99a28841b3817075c6c0741e68323aa00b5a9af97f45817bfb3c7d99a8f2a459edc38638dd917c8c8c159d800c71a1e91e631fcaa949ce62b2b100a3a915
SSDEEP 49152:GWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK7SkS/Su37odjIv:Q0zuNIhSDFU1Iv
TLSH
T134A58C3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/388-301-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/436-294-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/436-120-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/436-126-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/688-6-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/688-0-0x0000000001FF0000-0x0000000002050000-memory.dmp

Download

memory/688-346-0x0000000140000000-0x0000000141736000-memory.dmp

Download

memory/688-8-0x0000000140000000-0x0000000141736000-memory.dmp

Download

memory/736-302-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/1364-365-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/1364-23-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1364-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1364-22-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/1364-24-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/1568-297-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2240-283-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2240-38-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2240-32-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2296-93-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/2296-98-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/2296-287-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2332-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2332-42-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2332-305-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2460-65-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2460-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2520-289-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2520-363-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2716-357-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-360-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-353-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-347-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-350-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-351-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-352-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-349-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-348-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-362-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-361-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-359-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-358-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-356-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-355-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2716-354-0x0000023CE9170000-0x0000023CE9180000-memory.dmp

Download

memory/2724-293-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2724-115-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2724-109-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3080-295-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3308-281-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/3456-364-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/3456-12-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/3824-170-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/3824-190-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/3824-154-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/3824-303-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3844-133-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4128-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4128-62-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4128-64-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4128-52-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4236-300-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4596-292-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4668-70-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4668-285-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4668-76-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/4876-80-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4876-86-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/4876-286-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/4988-288-0x0000000140000000-0x0000000140168000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads