Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/09/2026, 15:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe
- Size 8.9MB
- Sample260905-tcsdesvthx
- SHA256 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a
- MD5 554ddf0a7b0af3a4a423008e0b60aa67
- SHA1 308b901858bb10ab09f4a25bc44d0ab1822b84c2
- SHA512 c566317f9d1ac02cd816c9bd3a72211d8632e1df30b8f358b010c4b0dd48ace940d5328d87b21ed609db6d268ac2771b85aa8a2416e95cf4312e489d1d866977
- SSDEEP 98304:PIBNooU1GgK+rvwkieXjg2g8Y1r3DFG4Acgmgx7aS9:PIkoUYv+7wkiEjpg8kr2cZgtaM
- TLSH T1EA964C24E601850AFCB700F79AFED95D305CB6605B2C50D361892FFEAE696E23D32593
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 2516 alg.exe 1516 DiagnosticsHub.StandardCollector.Service.exe 464 fxssvc.exe 4568 elevation_service.exe 1324 elevation_service.exe 1764 maintenanceservice.exe 1640 msdtc.exe 3976 OSE.EXE 1612 PerceptionSimulationService.exe 3000 perfhost.exe 2432 locator.exe 2612 SensorDataService.exe 4120 snmptrap.exe 1148 spectrum.exe 628 ssh-agent.exe 2232 TieringEngineService.exe 3788 AgentService.exe 1040 vds.exe 4980 vssvc.exe 1568 wbengine.exe 2672 WmiApSrv.exe 1672 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\msdtc.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\SysWow64\perfhost.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\System32\SensorDataService.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\system32\TieringEngineService.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\System32\vds.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AppVClient.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\spectrum.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\system32\wbengine.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\System32\alg.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\system32\msiexec.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\system32\SgrmBroker.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\System32\snmptrap.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\fxssvc.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\70064ad768b29bb.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\locator.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\system32\AgentService.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\system32\vssvc.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe DiagnosticsHub.StandardCollector.Service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046569ffe4e3ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d8935ff4e3ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000926b74fe4e3ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f18249fe4e3ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000383df7f94e3ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ced18ff4e3ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe - Modifies registry class 33 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Set value (data) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 1516 DiagnosticsHub.StandardCollector.Service.exe 1516 DiagnosticsHub.StandardCollector.Service.exe 1516 DiagnosticsHub.StandardCollector.Service.exe 1516 DiagnosticsHub.StandardCollector.Service.exe 1516 DiagnosticsHub.StandardCollector.Service.exe 1516 DiagnosticsHub.StandardCollector.Service.exe 1516 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Token: SeAuditPrivilege 464 fxssvc.exe Token: SeRestorePrivilege 2232 TieringEngineService.exe Token: SeManageVolumePrivilege 2232 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3788 AgentService.exe Token: SeBackupPrivilege 4980 vssvc.exe Token: SeRestorePrivilege 4980 vssvc.exe Token: SeAuditPrivilege 4980 vssvc.exe Token: SeBackupPrivilege 1568 wbengine.exe Token: SeRestorePrivilege 1568 wbengine.exe Token: SeSecurityPrivilege 1568 wbengine.exe Token: 33 1672 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1672 SearchIndexer.exe Token: SeDebugPrivilege 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Token: SeDebugPrivilege 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Token: SeDebugPrivilege 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Token: SeDebugPrivilege 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Token: SeDebugPrivilege 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe Token: SeDebugPrivilege 1516 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe 456 d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1672 wrote to memory of 3376 1672 SearchIndexer.exe 111 PID 1672 wrote to memory of 4948 1672 SearchIndexer.exe 112 PID 1672 wrote to memory of 3420 1672 SearchIndexer.exe 126 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe"C:\Users\Admin\AppData\Local\Temp\d9db2231e414d4967d5b497f4de2aec2742a5895e23cb3e1ea4c347e0e715a2a.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:456
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:2516
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4704
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:464
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4568
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1324
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1764
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1640
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3976
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1612
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3000
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2432
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2612
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:4120
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1148
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3028
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:628
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3788
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1040
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2672
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3376
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:4948
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵PID:3420
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 8d1f431eb887d757ac8e642663137b6bd5388fb4a8ea965ac9f601458094a6f0
- MD5 0cb2ac92161e8a645c977ec23b5b350a
- SHA1 951b17a8ba3911f4178f8069cc8d6900bf6faa22
- SHA512 6d7828e768628d38e6c30f5c4698c79ad2ceffab8ea2b036397025f4527742270a674648c9c6f00745e089b10aa6b655de782e3df082d64691539c5d41bbda8e
- SSDEEP 49152:+b+632BuPkFKRrdE6ohrstBhuXjfS4LWxn/gx7akmndO9Q5q:A3q60jBUgx7aS9
- TLSH T142D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 24875d0feb50d31034d0504d393d74309727958577f8f68836ea50ab94209448
- MD5 140be17c537103ca1c6e3c72f2c642cf
- SHA1 c5484dfc57557bc5eace48fc8a14d1ed95edc90e
- SHA512 1bcb87edfa358b7bf8552910dc2e9791c3000c9acfe4d4902e665a88cb6a1df6d05163ef024a431c70b729b0956d924a8816a13b034044edd88223b297cb84a1
- SSDEEP 24576:aXYfDtczA+0wgLBv7atTeuDMYdOtfQ5qlXk:Btc5gx7akmndO9Q5q
- TLSH T1C505F12877E504FAED67813DC9A2C511E632B8854774EBDB03E4992A1F332C85D3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 823ae8f2c83e919a6dd745c7b606c7d3829f4715022deb599b7c4b2b8234f349
- MD5 b3a990372217f6a74af5c1567636a122
- SHA1 0ce408ab480654957062c27717d4189867c98802
- SHA512 b7be3e8574df9f7c65163f27d7f031c5de53b82556675ef26818c0d790d3411b5db705128a08acaa785e647df9779003bf3209ff967a91b969f71731f9b19297
- SSDEEP 24576:V0Le5ji0hmxNrMZ0wgLBv7atTeuDMYdOtfQ5qlX5:VPji0A7Wgx7akmndO9Q5q
- TLSH T181359E16F5748332D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 527f44216bd77f5c52756487e411996da8db90628240f27d9418c50eaf2d7f42
- MD5 9bfc80b3b3405b8f75f92910e98d4ef5
- SHA1 fd0b422b61af74918b919cc9c3a8dea5dd0009e2
- SHA512 a4060ed0c074ae5cc7e955604b8506a0ec78f294f22523f75721a337d6bbd4daf6c594ee46d4c9a4302e9ff40c591d5d2ffa306b45d8552c57157327537a887a
- SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWr6q8wyu30wgLBv7atTeuDMYdOtfQ5qlXH:k/ezSC6vUzPviHjySgx7akmndO9Q5q
- TLSH T1B1755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 04a2ef2e4e6e648972b484a3f3fd9104846f11842cc8e60213211e61de30f834
- MD5 613aa6c5385c3f3b777939e3fd37e091
- SHA1 8383d07ab094941fcf77d600bca383e812d03bc9
- SHA512 dea462448bdbeed237364f73a03021cf2b38c5d7bda2863ee8ed2a6b970445d30ce942482bae2167f40dba081d0ed92a543ff7d23d439fddf30c9215254df0b0
- SSDEEP 24576:5VbqPb88hv/l+ba0wgLBv7atTeuDMYdOtfQ5qlXT:5VO88hXl+ogx7akmndO9Q5q
- TLSH T1AB559E66F5B48331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677D6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 7b139c685d0d7e918d386d5247db246606b8173e77da11abb36688051dceb353
- MD5 dd50368fe918296144bb9b370b61a1e0
- SHA1 d57c7f3bf96440d7033278bf9d0e7fc8414ebd48
- SHA512 fe026b2197c05b5e72b1ff64001baedc616ea8b8ccef003002956eed023da33cb0a9de83ea3deb901c938a6b8f1d4dede17d0527ad44637f292824d38b267194
- SSDEEP 12288:4j1zjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXut:4j10wgLBv7atTeuDMYdOtfQ5qlXE
- TLSH T122C4238069EAC093EF574636F29AE2E5C5149EC54F3C6F6B68447D0E6C7848AF473223
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 43f70d9798bcb8d6ed6e9befd27e88a371e5555866c07e3188843b9b261f0c88
- MD5 779766619796f4ba17f6ccec743c3e66
- SHA1 7c7693320621f8adc99c99051f6ea2da956f3c20
- SHA512 ac9afc1299d08ea2a7724d99eb5c5a5ed7ce2ee836842fb0656433dde477903a72a0cd8cd70ae2fcfba81c93c202854f2d260e1f513efb874ded3abb401b8f10
- SSDEEP 12288:veBNUbTVO86UCzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXuB:vJIUC0wgLBv7atTeuDMYdOtfQ5qlXc
- TLSH T1E305CF3BEE28FCD2C67A8D795691C240D77278704F22A3CBE164820EDE235E55D7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 02dbc3ebb74ea4a99029edd20bca193e6a7b1f78a12b650661bd3e8c8d2ba826
- MD5 edd425f392ca67ef97b1ab3ecd737dde
- SHA1 95724224bb88d047d9589c8519e856869dec5aee
- SHA512 0ab361d9f5b13254aca5445096b02cb014c5402d1c51080c34c1ee3c0538c537ab88ac579e597ddd56c18aa72429060f10ee5db4ec531768c4528016a4c89953
- SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THJ:kQvGAdlCEL8c/RRNw5CZgx7aS9
- TLSH T11D266C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 382c436de723590f18d71221f9dd89ce9e9f28458ac52df17e588bd5a2cd9f7c
- MD5 1d834cf50c3ec1177b1c74b031865c40
- SHA1 0dc4f95c8b288c825f046e62e062d9c3665957bd
- SHA512 a1b8600991491480e33611cc647a5ed6828bea313bd78a1bbc143e212a5efdeb31487e7d0793424757baec0579962c8eb49477a3f6be8292497b22a121a8ca6f
- SSDEEP 24576:hSewsAjw0wgLBv7atTeuDMYdOtfQ5qlXF:MljGgx7akmndO9Q5q
- TLSH T14315E031FE75D033C77B0DB61B26C716542CBA604F612AC3E3A89E8E59342D26376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 09372db5bdade5713e744f83a758ea918fae8ee128be6bf2557308dfe6e1ba2b
- MD5 bd8ad34871fac7f28a8e7b916665bb22
- SHA1 62b5c0a3e132af390d68b91722393e71e1a73d58
- SHA512 01d301b845ebf67e2bf9d3cc855622e6e1b23060b27f8f63c5ad1c3a3165f09729ec07022c73ca7ddfdadd01b57f47a5da23c6b9dff46c6ff26129d35ee33929
- SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHOgtaM:0UEtQevvqc2W1cpV2RI32Og
- TLSH T146474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 4396fdddd52274388d1cf3ae60b372572da653d64bb4a77b7f04784fdc9412ee
- MD5 67471f219a0a94eb51c33625279096c5
- SHA1 f36a53301e9f48c8ab70cb6eb4b945e9797795bb
- SHA512 05b3a6e42c85774addaf40f53dbd89c86105d00813626e5168ec38f10f9c0db6c5395bde96c2a1f02049b21e1dc2fcc5fc3ce2d9057e6cf25a423d624a3c16b2
- SSDEEP 49152:fCbRquA/m2yL5zLfFiV+XenmE3/zmgx7akmndO9Q5q:4oq2Vjnmlgx7aS9
- TLSH T180D58D0976B8C1E4D1F6C77886A2C647F37178154B34ABEF4266461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 a8ef0fa9db0590b3d7eb64105e472642f0dc7453095e4096b81f56052069c35e
- MD5 4c366e10df6c7c00a6b0b59023c6ee60
- SHA1 862b58ba9ab0182f8d357bb56af45f670b6acaa9
- SHA512 412b160765abb1d74a39f5364bf0a6b1478432cea8fa8747a3a59bcb6ecafc4b3cf1a6a8d73c3b5ec0ec817f902058f965e561de88eb6ffc6958059d30925f18
- SSDEEP 24576:GAhGL2IFoiwtA5l7S5370wgLBv7atTeuDMYdOtfQ5qlXx:GAM1Foiq5Vgx7akmndO9Q5q
- TLSH T15E35AD80EBF941D4F5B3AA78A9B69171EA76BCA65E31D20F2150D11F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 3a9f663de70f47633283b13e6563bd206dedf60aa9b365f6bacb1ef73fcc07e4
- MD5 96b5b5f94119ede75cacbe3f289b299a
- SHA1 cc73e8532f671a42ef6e9c1f54c0cb288898b6c8
- SHA512 699d596ef9d20b63f0e4f3574d1d232856babd721711396bb9e0e51d88a2aff7734e9f2a75da9b72e8a1efc71c3b9d9c748a1ae4345d260e71912d735910d472
- SSDEEP 24576:XwuXOWk0wgLBv7atTeuDMYdOtfQ5qlXn:XwsOBgx7akmndO9Q5q
- TLSH T16F05F14536E508FAEA678239C597C136E7B2BC022B35DB1F1760C61B6F37251AD3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 5978803192059b2a0a948534eb9e6ce0b60920f2464aa3650fecacba4e363092
- MD5 bf149b220c344cb9bf6cd95dab0c1091
- SHA1 ee8f71a09cc7e4bea5023a4eedc1c6eefefd61d7
- SHA512 a4e6e46e6d86eac90a8784836d08a58840eff7f812ffa5d101f7e87e8c3bb08c84e9f7ea6fc8a2f1cb2cf6383444fb70cfbc536ddff89b4fd905e4d17ae33950
- SSDEEP 12288:b/Z1IyAzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXuk:DZuh0wgLBv7atTeuDMYdOtfQ5qlXd
- TLSH T1C8E4238932E460F7E6A3823DD9E69285C37178921B3557CF2554561E2F33AC6AC3A333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 3d18ba776aeb5be88501ff08ec9d73710806901d5514709d387d50f9969cc59b
- MD5 03201ba2259756651a57046dd7c1be43
- SHA1 b011fc549fb2b3d8bbaea50c0d20449c2594df6a
- SHA512 db966f6152f8182335ec8074eb6ef445a238a82131f3abfff654f00a934ea83acd09229b47445714bf5be9b477f624f9ba20a6836d3d03d85034b380bd033d8f
- SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ul:nQRQyi36YOcPhLvw2gAf+PN3Ygx7aS9
- TLSH T1B7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 2acf426b33be85adccf944fccefb157937e91c3c3627d1aa0c27a7e9d6451d83
- MD5 20e6d8e1fe3eee78e0f0874c6c3aa54f
- SHA1 7410bf3e182070a4cf2780665eb238e381ae558f
- SHA512 de105328a29073c5419683325c9b6804a20a7a823c6897f06117a956f35fdc765874f9ecc07470fb8b89896e2fb4fb1935c016593835147aeab3fd64e11cf910
- SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Ul:yQRQyi36YOcPhLvw2gAf+PN3Ygx7aS9
- TLSH T1FD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 ab3550e5a22c35a273f59b2bdb2aa505ed4e313f99303bb2544863296fa2d392
- MD5 efed87f487013b1babd8e182cb10333a
- SHA1 9f238317753ec316344e1eda66c2cacace28532d
- SHA512 98252fb8cf4805773c6a501779bf11ee517fc205784f7f3a954f812151d844193ecdce71d542414834232e3040e9294b696175c77ef78d5b072585ff97dbe885
- SSDEEP 49152:a68Qg55nhceWu7PNU3/Wgx7akmndO9Q5q:IthLRc/Wgx7aS9
- TLSH T133B54933B2F600A9C44DE1769F4A873196D17C758FE0E7DB8511720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 70b54b5fae089d5c7a9db05764a54cef40ae8f29231d27cee6a1e494a63e70a6
- MD5 e04a12ca8fb33af98ea88e1dc9789fe0
- SHA1 0e6cf9dfa62b17b8572f011d94e2c3363095cf32
- SHA512 2659c763232ed194ac7eff9814a71e9cd67efaca9167580d35923108c1997f819085c052b630363a0fb6fea5ee30120ef12409cc71067b08002fa503a3ee75b5
- SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk997:ry5112gYy5azzVva69nLKnhZLgx7aS9
- TLSH T19F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 a9bf7cf710dca11a984560a79d5eef3ebfd91d44f2daf8120249ba2a73ce3db5
- MD5 c6b0e027d3103d84ed94f3fdc25a156b
- SHA1 b1795c80fabf51dbbb4a3b843ca0b5156776ffe4
- SHA512 aef9de6e4877d1118aa14f37f2017552e1ff264c79f6358849790f024a5240b7b27351770baa269db3ec67083281ad42dc5cd2c1e65ebefcf5854e1f81b0d6c9
- SSDEEP 49152:yB+taZ3usBWOBr4tEG20bqx0z+n217aau1glwgx7akmndO9Q5q:Au6JmUxd2dwgx7aS9
- TLSH T1C1D59E13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 7516216480a86d5ca4d5e97476af0345f684374be0922b289dfda164a54ae99c
- MD5 1de1f9b354646a716cb9bbb8497428de
- SHA1 0426bdfd6971debbb60901250e8e89ad3c8a1321
- SHA512 219216f4b39213b897476a7751bca45a86382f1c62615fec22433543fc1038b3888f8d7f4053689eadd387153b4dfa50894784ea349d704e92f9421d9c201456
- SSDEEP 49152:n1hpsNoJpF1A6BU44CwH7R4xcgx7akmndO9Q5q:nmifPkRlgx7aS9
- TLSH T1C4B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 d9db8f2cca2f1436b0ba47f9e2cc727db18da1a03d3ab39f27053a9391b8787f
- MD5 b281387a0da3b49b97931ae69b480cfb
- SHA1 bfc9386e9829fde53c78056c5ee3e213e303e960
- SHA512 b31ee57fc88e8c525fe4781f8718e77172f1698f5c700e022a8b1d94b4e1960542c50c9f05d21f735d999c39c8b6788e27812a7a160093a6e2b959741fea82d7
- SSDEEP 49152:7SuZQIY0Be2KNRVtOnks6NMHqvgx7akmndO9Q5q:p5dKvi61vgx7aS9
- TLSH T183C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 54f80b3ff30ce0b3f7a383f30f56f9d92db4f04ca7736b87e30135d597adcde1
- MD5 559c2ab221d47c17c8e98f00abee4b7e
- SHA1 68ce62391016eb299946eba86ee918ab920aa311
- SHA512 d2ee8dd0b0861397056e674fec739e6e27d504f6c2051abaf471a21f71a08c302d126ce2d12c10dbaa2ab93d4d7f33847ff5bdc55abbdc21206c1cb0185c21ca
- SSDEEP 49152:8htSn8EApI0figXgiDn0AP5wggx7akmndO9Q5q:9X2iyphhgx7aS9
- TLSH T10A95BE13F2D900E8D05ED179C7468632E962BC150B39BAEF0A90B7561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 17d9646e7af05d301e799807b6d01efb59fad01feced4eb50736ba5fcf875c3c
- MD5 83e531e12f1b1c7eca888c2043fdd57f
- SHA1 4d32f0136fa73f33c02dd6882a02673809d4a490
- SHA512 0682503396b43e589f67f263c68ef0117e6a6e10531866f49ed033da98d8b9206a996bdb7f67afb289c9672c6a13d2fea302d7749a202f3a0b9b181356109895
- SSDEEP 12288:hdzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXu1:hd0wgLBv7atTeuDMYdOtfQ5qlXY
- TLSH T1E9C4238478EBC093EF038536E296D2E5C5445EC65F3D2BBB7849780E6D7858EB077222
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 0fc1b6553016b34c8ab06345f441481dd6b8edd861b625eef9b64e0a8444bf0a
- MD5 ce1fe7f632c922d07584bfc3437a39d6
- SHA1 f788c2e4d6d8acdbec9d56b9ae0a0de80cdd2a0c
- SHA512 a742c0f1e2f16299c4b2626078696cd772270230d44c782e73e672edfb4309e7af75004edc834a94af3f2bcf0f213b7825ff11a50465430241bfe0b28b22eb65
- SSDEEP 12288:H8zjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXu1:H80wgLBv7atTeuDMYdOtfQ5qlXY
- TLSH T1E4C4238478EB8093EF038536E296D2E5C5045EC65F392FBB7849780E6D7858EB477222
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 2cb9558640522ac8299adb4d1d94af97a40d05226f82700a95536a75cfb1b49f
- MD5 8159033bbf26fe0af020fbc0aa84c3f2
- SHA1 471346f1c535069199b3195a747b0daf43a00a9b
- SHA512 be6342c91582f386911acc3c3b3225457ee30a45b9d592f2be3a149f96ce62c4c0551e28b417589251dcef135698bf9113e09809f919b6b149d0cb178847d8f5
- SSDEEP 12288:BKzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXuA:BK0wgLBv7atTeuDMYdOtfQ5qlXV
- TLSH T116C4238478EB8053EF038536E296D2E5C4045AC65F392FAB7849780E6D7858EB077262
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 35f5e32403063119d4e1c253ddf98ccb24c1f66fa02faf8a64b7e4f64673ff2f
- MD5 865be7012521d62c3293b5d4eb727367
- SHA1 f691472010af07afb2d85eaf155c441e6a861029
- SHA512 3a4dea8f07df3faf47c4e0256dcefdf7db427ab07c4edf1b2c90b52bc803942ca7ec81d1ac6b8cdb783aa796ef63024dfc67b4d41fa2bf874f8ceec0b9ab7358
- SSDEEP 12288:yVbzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXut:k0wgLBv7atTeuDMYdOtfQ5qlX4
- TLSH T179D4234539EA80D3EE53C236E5A6D1E5C264BDC59F396FAF78002D0E1D75289F836322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 6c20840152391aa5ccd8c02cab1cfc5ceb8a969bb868c41afce6dd8584f7cf32
- MD5 85d2be4f92e891fb3791c07b27de9f6f
- SHA1 c2393b98dafdac0b9423a7af6bb644418ed84751
- SHA512 9f64baaf957d6fd5ad6055015199f85b005b8e17c8520c10abb3761ce0d890e3c7187503de2025ea29e9b4a572e73d88bc39ca46427a88a808c9e9ca5daca6aa
- SSDEEP 24576:wcP4mcvIjkGOxhKP2l71nNKbrh/8KBJ0wgLBv7atTeuDMYdOtfQ5qlXD:bP4m4IpOO67W8KZgx7akmndO9Q5q
- TLSH T1A865AE2DABDC0096D0BB913885658A4AFAB1742A1F3286CF1160933D7F77EE54E35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 9571e628f9d68a446e96390fa23508793852c94deb767c7823561947aeff456a
- MD5 ca321714b2efe95dd1882784fb28cce8
- SHA1 799c914f445f6c5cba83aa519cff909a7d621033
- SHA512 99cbe4922e98da9938ad7b36b1a12551a4a4911423926193c7caee1d943372e95a9c1a883dd3f429ecdec0c5c4f95189a08256aea4382ef35d55e87557b2bc60
- SSDEEP 12288:sGsfhzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXua:Eh0wgLBv7atTeuDMYdOtfQ5qlXj
- TLSH T167E4F009E29841E6C56E5239C7568680F3237C558BF1A3CB66C0F93E1F76684ACFA713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\Config.ini
- Size 397B
- SHA256 09c174d57ea9b357c2c169bebba20e1f7f160f891e0ab59da828ba9c7a48f9b8
- MD5 d64bd8cc67481411926f101f6e67ed44
- SHA1 622518f4d732e194037ad938c66ca51ac2818e31
- SHA512 d5b6a0386228ef5e8703d3fab2daee7edf6d692b675e2eb8caa47d71e2b3f53a944f635c140c5c982b40114353cbd7987bc870f24d933c09a69aaa7d225007cc
- TLSH T18DE00236087FED4CCF48742B073D230022CEDC434070007507744C45003516D7000803
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\Config.ini
- Size 395B
- SHA256 ed2675d20201e1cd4a925fd9c61a43bd6d5b0a6672d09faf23ce06a057310f66
- MD5 349d1ae03663957668d7b1e0326dc5a8
- SHA1 7608ce000579c01283f3bff3d10c54f4569da091
- SHA512 e1622a1810e9db5bd7dbca2bf48a889ce8b8b059a5a476589213d4b2d5f623de4e82bbb9c732bc2f11dba264449d73d8febcae1c92603b2d5230dc030605453d
- TLSH T1E3E00236083FED48CF4C742B073C230021CEEC07003040750F744C41003512D7000803
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 7b93ea7b30818ad5781fab182f677affec6685473a02a9fa78c4ee1da395787d
- MD5 d69691f5c5c55c83198c59434a23e7b3
- SHA1 d50b522c0d9f9b4c350df32dc81afa095a30bcfd
- SHA512 056d100f970dbe0d87705e996e5c6cf8679d9b06aaaf91dcef61334f30991211704f948de9b92cc1050d6788033ed6ba483a83b02a6652091937963489914c7d
- SSDEEP 12288:eBzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXu/:eB0wgLBv7atTeuDMYdOtfQ5qlXu
- TLSH T109D42345A5EEC053EF679631A15AD1B4C1187AC54F38AFAFB804790E6C7458AFC72323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 671a2841493754f7e6dc0ce02a4f291c3057bf6ffdca94b1f8659bcb8102a15f
- MD5 12163c0141a48593b3fc9dbea5de91e2
- SHA1 201dc155c56a6bb8c950d232a22beeb30ced9e7b
- SHA512 9b97c610ef557cb998d367960c17580f5c8c0e45cf1db01fed6e102f0db5b12763e19367d118ab6c2fe2a655530fb7993fea61861b33192bde654024fa867309
- SSDEEP 49152:ma0h2GEkuAe73q3pp46zwwQtgx7akmndO9Q5q:ma0hNYG4JwOgx7aS9
- TLSH T15E859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 334f4596b8e237216cb3d1cc70b8df0091f2b972f1b3aafb02bd3b496515db77
- MD5 4a54ab37072ad3eedcdbbb09c4ebf2ab
- SHA1 82de2385e91abb8e612784eba9ac927c95382cae
- SHA512 d314c88a61f55404efb74720c4c1641f8146b5317ee2a67edab09a023ccce2925de004b4ce3b2267d665e6f477abff991f67e2223e71fce8be06fbc0c828ada4
- SSDEEP 12288:shbHjfXszjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXu6:shbHjPs0wgLBv7atTeuDMYdOtfQ5qlXT
- TLSH T16EE4127D26ED10D7E672D23D9196824AC330B8550B21A7EF26C1823E4F3BED95C36B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 6613e05867190658eeb4800b6dcba4b94c4d41499fc9127738da046f922a92e9
- MD5 fcccbb6e1e89b1abbbe763b4ee98990d
- SHA1 f28d254f190cba4994f2e737234be68b9fc7d5c9
- SHA512 d2e19a6c68a6c1351238b79d18560be11ea6e24d91ba7d8dd69edcbdd6b86d383e98b0208177f1c70f7456b81a09bd57cb90c16e579cfd00a7b0a4768a11bb32
- SSDEEP 24576:53YgnJcRTk4yti+R5dBR/k0wgLBv7atTeuDMYdOtfQ5qlX3:5IgnaTk46pBR/ygx7akmndO9Q5q
- TLSH T16E45BF2DF2B910B9D8A6D136850147B5FB71782D1F209BCB0170C538AF1AEE89E35F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 2d69f80b067460def4a6fd24eee94d552e5d76ec81fd79f4ccc626949f4c0119
- MD5 fad176e8b6ded2318f5dbbdb7d9ae0de
- SHA1 a67b9e464d71275779a12132414cad8dd541f861
- SHA512 e7b3c591e38bcfa22e97583fdc3bb635c0938fa671bdcc5c9318a9e7e3c81115d4d16f5944543d191a75af298222835a616ece332442faa916076bf817fef784
- SSDEEP 12288:8Vzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXuF:8V0wgLBv7atTeuDMYdOtfQ5qlXc
- TLSH T12FC4238474DAC053EF578636E29AD2E5C1046BC14F392FFB7849B90E6D785CEB472222
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 5fc9abde592b745edf162a66c89086b2b8b5c10a3e767397723587efc4aa2a16
- MD5 ab3744062cb09bbda3c528ca0b9c237f
- SHA1 2029dc57a84bbc8e05e85cabf13cb397c94017a5
- SHA512 615e7825187934d2815744e316b0ee255a1e7f44a93efdfd126fceeff1f805e3f3281466906d0449ca16e912dfcb27ab91f7a1a5aabfe390fe96b8a578e7de87
- SSDEEP 24576:PrL3UT+0wgLBv7atTeuDMYdOtfQ5qlXn:PrL3U8gx7akmndO9Q5q
- TLSH T1F1250154F6E500F6ED67C13CC9A68616D271B89D0724EBDF03A84A1A1F237E68E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 c5fa6e46b4197833da7cd0a14f36ae52b605e7015e3f6a437cbc4064c438728f
- MD5 e5f68eb54a29dd3c22ede684a3cd8f00
- SHA1 759d86f5c5a38c2f7dabbc0bb79e232674d2153c
- SHA512 339aa4d04341d9aeed1e53727e9edff0debbed7f12f40d8bd87f681701f264c5e8c6156a3bf710481c573c3e2b015d3db1b358173364062d5eca1683c2c3ec5b
- SSDEEP 12288:XpFtYOizjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXuk:COi0wgLBv7atTeuDMYdOtfQ5qlXB
- TLSH T177E4021936ED00E6E576913DD693834DC370B8920B2267EF0590817E5F77EE8AC3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 591639bdbbf814d444a773baafd3febad9b98d977c04b50fb2cd0e42974635e9
- MD5 8c9174c44c8a42d6312f254f719d0aa4
- SHA1 11cfe68e397dd9b9f6284f80a6ba581dd54cbc18
- SHA512 c99bf06cb5af0b1af421465c29804e4dd1fcb0cf3aa5e7a83bea52a49b5a31c63db6f102f5275454c8ab21c56e9ec933287013c6843385d18bd5d5f93251690d
- SSDEEP 24576:j7NM9YqZqmWMUkPjZM48Mv6bEhsx0wgLBv7atTeuDMYdOtfQ5qlXE:j7cBWMpPjN8DbEhqgx7akmndO9Q5q
- TLSH T14F65AE2E6BEC81E6D577D13DC9A28245F2B1B4611B318ACF1152833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 eaf6c380b59e049536891993accc96f1b9da47ba76556df723493ec9e64bb39d
- MD5 9337c1c0d715cfe71eaa0b033893ddc2
- SHA1 5ff297553be868bdfa2156fadf0deaa149acacfe
- SHA512 009a92ff8a394bafcb4a1a3336d3e1d7f7b047bd3e938def17767ffd9a5de4566641b3c0e1f32001b17404e2ed0a68e1fa13b3fe9c8f84b6a07ab069890ebbaf
- SSDEEP 49152:QF2YuHNETovAvNYf8km/gx7akmndO9Q5q:l6BCf8kcgx7aS9
- TLSH T1D3857E6927ED80A4E0BBD27D45B7D286FAB2B8511B3056CF0255862E1F33AF44D3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 f33af94f3f8e2a26131d19ee4fc0ed8187e76962d18193b5d7c0d9824700e7ce
- MD5 56596102164c078519005b9f6dae94a7
- SHA1 5d465d9c4deddb412aabae79bca300db6cbda481
- SHA512 b5b5b73d672d8ba5bb05610d0c77219d3eee497859b60fdecd5f66e0b9d6a963e74e455aada7000e435eb3cfbab50eac372f47e49c462b2ee38828b0917a6692
- SSDEEP 24576:mAFs06+OmlfQNXEbTom0wgLBv7atTeuDMYdOtfQ5qlXF:PFs060lcXuNgx7akmndO9Q5q
- TLSH T14965BF2F62EC00D5D07ED17E8A97C91AF6B1746307255ACB0160863E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 de7558e9b3a00db681dc02e4d96902b14aaf7dba450a9f61c2628b42cddbb896
- MD5 9d460ff5b906ffd90b460969db8b858f
- SHA1 20db80ffdde87668cf486a523bd638f70c2e0869
- SHA512 56245eabd7e69db92134a72980e730e33b04b011e118098c0190891dc240a19358dea8b2cb5c9f61b23256b034661cf88ee502b451842b9ab7cc8fd99d74bd9b
- SSDEEP 24576:1JnJ5D3WXT0wgLBv7atTeuDMYdOtfQ5qlXf:1JnJ5DGXNgx7akmndO9Q5q
- TLSH T1D815E02CD2A810E5D4B7C274819A1795FF71386D2F226ECB28B4D5393F12EE0A979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 5fe80c4023cbeb6bcd7b838e4eb3e364f4133933b3c63954146e7dec785d6e43
- MD5 40b90e6904c4c0147c44c489567c249b
- SHA1 4319ec73efd13034617d8e692d2cccf0770c8167
- SHA512 1fe7597e81ee045275e02d4dc0c503fc1348b8281865af5ccf4d09118a48280c0d0e502ebc5feccd04723d130d01940f4b5efb9c53742994bfb7bb4e97f69150
- SSDEEP 49152:ng06DIKdwc+eQnSt65aVjgx7akmndO9Q5q:gRgx7aS9
- TLSH T15A956C05B7EA5295E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 4a476144eecd2561e0f3e03d2a927c2cd2d788633517330a649a96bad78a3a3f
- MD5 96962501fcaeb42e2250dc9c136a62d9
- SHA1 3540a728f6a82e6de2e88dec10d70b45fead625f
- SHA512 8d7cefd6481849d6363ebc7eb44bf38345e641f4657160f0cf7d0211d2517c840d544e9d075506b62754da600fe8d71428b4965ee47b4f29c8caea3e38cfb0a2
- SSDEEP 12288:+EP3RnXzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXua:dnX0wgLBv7atTeuDMYdOtfQ5qlXT
- TLSH T1D1E4125D36ADA0E7D627913DD191C285C371F0A11F222BEF2590C23E4E77AEA6C39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 4818a02e4612593b327d48b9db7fcd69e251002f8f3db65dba90a4342194bf82
- MD5 d883d5f6e4e870c9e50d9c7f11ee4e55
- SHA1 b4edc3f15350cfbbbda80624b225daeaeb8b2ee8
- SHA512 b6b8cb486af35e1c77103610e185a3748abbc0ffe182a6d11057af1bcc789719de425191a757854d40d99d563f8a27357b7896e429a6c9c5ebaaa8fc243f65ae
- SSDEEP 12288:yjky8zjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXuJ:yIy80wgLBv7atTeuDMYdOtfQ5qlX8
- TLSH T1B9F4120463D89093EA764639D6A382E4CA34BC505F3567EF6480FA3F6E36BD5B831712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 925d42e49c2b8653907c943adb017e8f5d6fb311ca2f3ad90c8a186bd7c7620d
- MD5 117482a651b8cfb48129b273aefb57af
- SHA1 45f89a29eda6f30e5d232e6b6d349e31a1dd442a
- SHA512 6131073426daa43f966f8118bce49b181273e30a547c2ac24e45ab61f3f2c5a6df7b1c3964da94f9adeabf1bfb510bb2d83eeb3efc36530c1f252f65b51fa029
- SSDEEP 12288:Eyyzjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXuP:Ry0wgLBv7atTeuDMYdOtfQ5qlXi
- TLSH T19DD4234835EA9093EF138635E256D2E5C1147A950F383EFF3884B93E9E795CAB073612
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 51114bb3b53565dc0d8421bc5d46f86ca55e16921ce9177fa34558dbab3d6c9d
- MD5 7ed8242be1084b1124ed1b492045d01b
- SHA1 f32d0082a9c4cc3bb652a7aaba7b3d5ddb5759b1
- SHA512 599d840821e7c78a680b0c9189dcb6716c33707795913b773fc3d34b6617ed041cb26bf2781cbf144d1b38a8936649731e17a5ef7df2c92bea77fc82f93df113
- SSDEEP 24576:qQ9MxZKdcz9dw350wgLBv7atTeuDMYdOtfQ5qlXv:qVKZXgx7akmndO9Q5q
- TLSH T123558C2DABE9058AE177D239D5A250C3A633B4311B35D6CF2448D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 038a998da7037f9aafc43b9d6826762dedaa7aa071d45978422773b221e480d2
- MD5 9d841b7e5315bc050b7120a4063b7e1a
- SHA1 f960f32d12222ba03e76a48735760aadf2a5832b
- SHA512 d3979fa907b196bcb8462a57675e45361df724a9fd3463619151dcf67c604ba91850a1bd599ee56fd5090434b46c31c97a5a33306103aca15e3846041c3ba002
- SSDEEP 24576:0yocDApw0wgLBv7atTeuDMYdOtfQ5qlXc:pocDApGgx7akmndO9Q5q
- TLSH T125F4E01FBBAE40A2E166813C89858345E773B0701F6267DB6581C73E4E379E9BC35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 f6a043b26cded75be82ee1cb29b26f17e497fcfc5b4a770f0abd9950ec768105
- MD5 96b3f24bcc0c794cb1288ad5db34f11c
- SHA1 958cb35397706ebfb0e76a8b59c5231ab8341011
- SHA512 c463a749f02e829c70e787590e44e0e83c19ac37574c58b2370977c692854b04b65bd0d294f24bbd38902af1e31c06488c931e01cbe1d3049b23601c90b13ba5
- SSDEEP 49152:LWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKGgx7akmndO9Q5q:70zuNIggx7aS9
- TLSH T1A3A57B3DA2F800A9D9AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 96168f6e98a0a8b0853a8611749f478ee0144216b7a6bf210e4bc864e8e25e82
- MD5 e9edeacac9cd20cb7f3c6a089f7c9a00
- SHA1 58642d5edc8f6f15e086820341981c133f357b0c
- SHA512 6883808e3fa144bd84941ce196a3fdaaa7b5a31d2b5ef27cf54974382bd70929a4451530193891cd1d4e499423095407b8d0e6057df121a7a6d00359c54a3fcf
- SSDEEP 24576:q1QT7EcpfxR+N5AWAz3ooiYsjMqbX0wgLBv7atTeuDMYdOtfQ5qlX6:XTDxR+N5YzTujM8gx7akmndO9Q5q
- TLSH T1CF55B02EA7F905E9D17EC5799A23C512FA727821073193CB42A0C13E1E7B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 16410ae8564697aff3981595dfd161c05aa60dc8809154a3df393589c3468fc9
- MD5 1a93f73f05dea0ecdffa30d9a354e3b6
- SHA1 4ed049651d458424985abff6f8d97bcad7cd4e40
- SHA512 38059b437e1cfd31c691b6428586ac2a2026ae9a8c77776fd7db862a29f03cee5b4fb0a30ee0d3ad07f0e10a43e346a609eb858b086b0a346a2576c8263b90be
- SSDEEP 24576:gTMdOz0FFS+hmSLb0wgLBv7atTeuDMYdOtfQ5qlX4:I0K+hmSLlgx7akmndO9Q5q
- TLSH T1F815E17E63AD04E6E57BC27DD643C906E672346203216ADB0690C17E3F6BED4793AB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 ac557da5028738ce18aef2ea02e0246d4d333e4792a4a004bf368f6c7b1646a1
- MD5 cd06e50194e3e3e1a28e317748d28842
- SHA1 fd13234d77eb65549d039fb3714369bb38e2cb19
- SHA512 76c7e96147935a11ac3fdae3bcf839a5cb561a236106d7ed723e4aac83bbb1924dd67475f037d9712d5f0574db7077253c1c3fb17495c7488dc78ee150778230
- SSDEEP 12288:64K+zjz4waJO623jcBvdTVatY5wOlCsA/LAewLkdzytfZC5qlXuM:A+0wgLBv7atTeuDMYdOtfQ5qlXJ
- TLSH T1D3D4124C22E960D3F9739235D6668295C230B8661B382BFF38D4D93E5F36AC9E435712
- MD5 SHA1 SHA512 SSDEEP TLSH