2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
Size 5.9MB
Sample260924-e6542sywhv
SHA256 2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce
MD5 2749fdef382c396a615705b5c6bc7bc1
SHA1 113771be22a0b94f52502f847dcf1d2e6ad62ff2
SHA512 54b1016e81683f9d4454718284a331321ce751d9961c2aa1150209da29fef43f8fc8bb285e3fe55b80c63c999eadbff5fa5633eab57136b1681f57a9a3d81a3b
SSDEEP 98304:f6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwU:Vw1DY/rPvw/0Lt4XQis+A2/bC6w0
TLSH
T1CC56B052B711207CC84B6872643C6B7B4C291D63972286DB89E83CF25B749C26E3D76F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
4924	alg.exe
864	DiagnosticsHub.StandardCollector.Service.exe
960	fxssvc.exe
3728	elevation_service.exe
5676	elevation_service.exe
5180	maintenanceservice.exe
632	OSE.EXE
1544	PerceptionSimulationService.exe
1224	perfhost.exe
2924	locator.exe
1628	SensorDataService.exe
1032	snmptrap.exe
2192	spectrum.exe
3548	ssh-agent.exe
2744	TieringEngineService.exe
2196	AgentService.exe
4392	vds.exe
680	vssvc.exe
1016	wbengine.exe
2240	WmiApSrv.exe
5768	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\locator.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\System32\vds.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f08de14e4bb6346b.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c36ec809de4bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af7a760ade4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078e69f09de4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008967bd08de4bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7f0c608de4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000538e6a0ade4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dca39908de4bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5c41c09de4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd2bc208de4bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000316ed08de4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090e3dd09de4bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4540	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
Token: SeAuditPrivilege	960	fxssvc.exe
Token: SeTakeOwnershipPrivilege	2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
Token: SeRestorePrivilege	2744	TieringEngineService.exe
Token: SeManageVolumePrivilege	2744	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2196	AgentService.exe
Token: SeBackupPrivilege	680	vssvc.exe
Token: SeRestorePrivilege	680	vssvc.exe
Token: SeAuditPrivilege	680	vssvc.exe
Token: SeBackupPrivilege	1016	wbengine.exe
Token: SeRestorePrivilege	1016	wbengine.exe
Token: SeSecurityPrivilege	1016	wbengine.exe
Token: 33	5768	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5768	SearchIndexer.exe
Token: SeDebugPrivilege	2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
Token: SeDebugPrivilege	2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
Token: SeDebugPrivilege	2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
Token: SeDebugPrivilege	2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
Token: SeDebugPrivilege	2444	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
Token: SeDebugPrivilege	4924	alg.exe
Token: SeDebugPrivilege	4924	alg.exe
Token: SeDebugPrivilege	4924	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 2444	4540	2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe	85
PID 5768 wrote to memory of 4700	5768	SearchIndexer.exe	125
PID 5768 wrote to memory of 4768	5768	SearchIndexer.exe	126

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
"C:\Users\Admin\AppData\Local\Temp\2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Users\Admin\AppData\Local\Temp\2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe
  C:\Users\Admin\AppData\Local\Temp\2e0f1c4d0d4ee81e27ed1ee8d25ec4ed5af121ec994b4b3b1eda27412db9d6ce.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=136.0.6008.22 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x927324,0x927330,0x92733c
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2444

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2740

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5676

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5180

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:632

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1544

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1224

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2924

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1628

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1032

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2192

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3548

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4392

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:680

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2240

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5768
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4700
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d4122cc003ec635225a28fe0fd4c638ac8697a71204775713c302080b300a01b
MD5 74a60545de5dc122d9c0d32ab4ec7251
SHA1 36916cf5d944032bc48ea4aa563ca0a7cf610b45
SHA512 7d76bc475be5dfb230fbe1404763ce56827892fb6bec5abcf1a67b72cb23b5c1b2a15d9f8016ba7e206433e55e41b8314d9a7a2568ff1086a47e0d057ed34d32
SSDEEP 49152:xb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnSlcUrhhU:33q60jBKShh
TLSH
T1D4D58C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 3127bb6ca802a6a3fa3796cff125b9c5be8909250c150f594cc2169a2267480d
MD5 cdc06d870f8d053ef2f39ed58c36573c
SHA1 59f6ed8451ae471b0fe86e213ffdb62d619ecf6d
SHA512 349ffa805267c700a4e0cb77124a4b6d75bfb05160c29cafe2576e8b4cbc661d19d327d837ec5168a2c060570e051315a2cba1abbc11d406ffa3fdd0e44b05f0
SSDEEP 12288:a1XLsswWkxy2lRq2czAw2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoA1:wXYfDtczAzvDyiLdeKD0GFxRLzXhUH1
TLSH
T16285F128B3D008F9DD6B827CC9A28511EA737C944350E79B03A4DA665F737C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 ebf699960459beaf03e8f972bbde89619c414baef7935aad0c9950932c6b3b2a
MD5 dd5310627f8d704292e123b273beffa7
SHA1 0c54c2295558ae0e67b1cf6b71e03df6473f5d3e
SHA512 954efb19bdd48ab4a87687860d1c3fd6d3e635f3edb3d8f3b4ee19462f228fb174733701490350cb9c9d6ff992ea270d65debc34c70d2187bc43818065f8834e
SSDEEP 24576:G0Le5ji0hmxqrMmvDyiLdeKD0GFxRLzXhUHo:GPji0AcDlcUrhhU
TLSH
T130959E26F6B48331D073C0B9C5D2A69AED71308557308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3fd5c6757bd9988ff7caf30e0e59972b3fcdd053af85128207ebc79ab341af6a
MD5 620653ca74d363e58fee1ceac13ec61d
SHA1 b89797653ca0cb9c056b92de98940902d353657c
SHA512 0a3fbdac17c7a75f5cfde1cffb6adf88da366575d69bf15ef7da4061132893428e912b6af190012e2cca185ff33a18d8c2ef8a791069831d94b7f41aed4aa944
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWr6q8wyuQvDyiLdeKD0GFxRLzXhUH4:M/ezSC6vUzPviHjynlcUrhhU
TLSH
T19C756C25F5788323D0B2D0BAC5D6BA99FE723086573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 145bd6950a0e2bedef2a71e3ed2f2cdf84e8447938e9006069b55c4532ff4319
MD5 47cc423f5963ae49219dcc5c718c6bfc
SHA1 86e15b90eecbbd5fe52d593699cc07d30b0367c0
SHA512 138d4689d6614c4e5a659e686f03abe0c6cebf2049c65adcd7093f864e50631248a2131b6b22e44488b68736452e51ec570645a1fb8a325303dfd956d93d220e
SSDEEP 24576:QVbqPb88hv/l+bBvDyiLdeKD0GFxRLzXhUHJ:QVO88hXl+tlcUrhhU
TLSH
T1D555AE66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 d020c03c4dd9f804400d04050b5f06b0f7941350f387fb0f9aaf9cd31fb38ca8
MD5 dae4286c46c90660f559351524620164
SHA1 aa1fb273d94f2de543dfee9f614085d21a2844f8
SHA512 95253a177d51f1ba9256944dc1c373ceac00ec334126ee9af6d344cb2c3730d309e5bb12fa90d3965af18886cbbe6277f5d5820d8e1d960fc203c0f06b1daa36
SSDEEP 12288:lMr2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAP:lMKvDyiLdeKD0GFxRLzXhUHP
TLSH
T1966523B1D1C02442DB1E46B8C2DD54A18CB46DF8E141B822D734FB96D6F76C1E97A0FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 e5b0e440c05c05d2ff17f6f932cebc7b9d4bd2c9f0ca72a0fd5166002155a6a0
MD5 b5d799cd802f021db52790a71b802b53
SHA1 632fb9dad8cf891c46daac78b0903bbe51a965ea
SHA512 d0a81ad1970b8bbee3648d1a58013f9010ef55ff9cc011c85db4e9000921c0628dd5d5887222243d3db4174f5a14ecaa77030f1169b5632fc21bafb29db6c45c
SSDEEP 12288:keBNUbTVO86U62v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAl:kJIU5vDyiLdeKD0GFxRLzXhUHl
TLSH
T1F485CF7BEE28FCD2C27A8DB856918600D7B278704B52A3CBD165C30EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 63c8d3e422c71a77984160dd960736d98de51d5a610c46fd200dfe1f1ba04078
MD5 486bbdcd2b0ddf26d5f22b9d30d596ae
SHA1 09ec4a308f1f99539cf771f771867fc34b7aeff6
SHA512 4b058f82ef5a962035e1ad56cca19d5984efac087304c9807940ba40d775c2ecafd6c97366dfb2941bb55992672bfbbcedf8d1e438cc5ef01eb1a32aafee537d
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THU:kQvGAdlCEL8c/RRNw5C7Shh
TLSH
T134267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 f4510835bcec75071b14fd4237e3485e2434bdf405fa3b99f82cb8f68e8edeef
MD5 7feb6c738da2624785850270f2d50860
SHA1 f9b239f23dc6d7b81aa0f39cfda2a78a3074dd9a
SHA512 b0fb7bd0b39dded8bdf929214e230f4302bb2fe9bef47c9bf212c25232ef7a8976144257a8d98ce4d5eb719373c6950c65e9848b6443964d0a814cfb57a940b4
SSDEEP 12288:ZAwSfxL/2Dc3+DLLmt0LDQewsAjw2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27x:KrewsAjzvDyiLdeKD0GFxRLzXhUHf
TLSH
T15B85E031FA74E032C77F0DB61B66C716587C79604B5129C3E3B88E9E99702C22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b3dcb68e9b5310dc73dcd350bbcc5f944f013904db81c3fc82ad25d9331feeee
MD5 cf4b5d9beab6f59aabde8ef35ed2192e
SHA1 8fa77b8de54661426deff3dfa588bb2430c20e71
SHA512 eb247e7fd91f3e3744977791bf24803fbdad0e02177a87ea370d4b5ab991cf255079482062736f50ea59cb747ad3ebb2ee2fb75a4aaf221708142067b71ccb85
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHl:pUEtQevvqc2W1cpV2RI32
TLSH
T1C6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7d0decd467c0189d852a711e99b5688ad69084f8eac881f3a64a69df0baad708
MD5 b78dd838d957f3977145419f30e42165
SHA1 788856b7a9dea0bfb170b5dcb02e4136bdafc515
SHA512 95678d45af74c1ebaf271c96e2bd42f0cd6d477bd249a5b6350bcd385f039c01b4aef0dfdada3daad62660ee848695fe1542e989f032fab9ec6a189a78ad6e53
SSDEEP 49152:VCbRquA/m2yL5zTfFiV+XenmE3/zzlcUrhhU:CoquVjnm3Shh
TLSH
T1A3D58D1976B8C2E4D1F6C37886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 82ed7a2c3fc6975d9634add4961a137788a574d3c54affb5facde20a7f82350d
MD5 e00d560241f97ab74a849d2f8e61c20f
SHA1 f71d96bbb766706d86cdc1437528c638ab505d33
SHA512 a3a0783e7dd08df9136718236da6940a947789a675abf40051f109d534c1e2654db49ad52e7711923544c13b6a2acef17cd1f05d2177b49a843c96b85499a64e
SSDEEP 24576:wAhGL2IFoiwtA5l7S53svDyiLdeKD0GFxRLzXhUHd:wAM1Foiq5alcUrhhU
TLSH
T16E35AE80E7F955D4F5B3AAB899B68171E976BCA95E31D20F2160D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 5841241cc8b60c910f04da907d817d4e7129f8a9a7c027b963ea53e1f01f0a21
MD5 0ad5a82db1afea03cbd44c63977af035
SHA1 172ed667a40f273482b000e7d3a3a77bf7cff1ad
SHA512 bd92fc5fd403edd62f52113c9cc5ac3a4739cb57dab5a9d151e6721d64949f0927acccef986aed178d2fc459e2cc46a04e0165cddcb84eacd2f1f48428f134de
SSDEEP 12288:Rmw5HEjsChNDBFgl0WDm+Cl2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUo1:Mwu2OW/vDyiLdeKD0GFxRLzXhUHm
TLSH
T1B275F14572E41CF9EA678238C697C132EBF2BC512621DB1B4360C75B6F73251AD2E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 cd0960acb5bb19d8cd4da8644895cddc1a57b59f7c8ae403eb17e089e3f0ea51
MD5 d09221f005424956d53c1183cf5f01ea
SHA1 84fbbd507bcf78998bd72a13cce9dc885f8bf802
SHA512 8af0e40753aa4ff1aa24aff0a281316c9197ec65e921d81223d07f29136a76081b07dedb574a917ad48c4103c1c5f5d26217a4f11a9fb7c5f1fb54c2c1d616e3
SSDEEP 12288:pMZ1IyA2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoA+:GZuevDyiLdeKD0GFxRLzXhUH+
TLSH
T13B6512A932D430F5D257427CC9E94541CBB178E5A32253CF523487A6AFB3AC26D3A372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1f5a48b8e9a98625e02c6f5b82acc049e53df4bdc15f3c99635b502fbb8d8e23
MD5 dac91a9306bf7e679fe700557406efb5
SHA1 2bdb02eadc54aa4cde34dad269fa19e2ba130430
SHA512 4c4c960929c3c1fc940cf97b8b3bfe5f95ccf5a37586419dbc85e5f22902034ce8ade2aba466bfc30bf4ec97c2dbe1985c3c43c8aa3f374335d606bc444860f7
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UI:5QRQyi36YOcPhLvw2gAf+PN38Shh
TLSH
T16A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 89095c1a2a639e7beefb1a0fb6ab6bb303fbefcdbaa62f3924fb99bfb56cfa31
MD5 4b4756bc661be6e14bf4d687065bf3e5
SHA1 4e606e97586f0d81b19d5f3f19cb13eaa4e5dad5
SHA512 02d340529a6d5d8f7b345bffbb0007e0f5bbef93bf4020d95327dd9741e2f3643d84ec41d1732890747a6e255f8ca191175f7eff8121bdd9751f61ce00b43af6
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UI:MQRQyi36YOcPhLvw2gAf+PN38Shh
TLSH
T120667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 23ab4458c7dac826be04c4a18f493fb4446ec2c3af1cf3970ab25e4e86b50621
MD5 225ea450d8e48404a237e60364d7930d
SHA1 f53e9d7054ecccacb43d7c162e807c04c73744e6
SHA512 d64cd3900e31e9742b982f7dbf17cd9c007830dece0ec177d5a1370982cb023948722678991dc8b48319a85fffe60329ec30a4af26afc7acb1d28f08f4177a20
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0OvDyiLdeKD0GFxq:J68Qg55nhceWu7PNU3/DlcUrhhU
TLSH
T14BB54933B2F200A9C44DE1769F4A873196E17C758FE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 15b5c513a72bc169ff5d4257aecc0e5f20a268c773cce2f603b59f63828ed94c
MD5 ffa7f17235b54fa709b22f36845d1b54
SHA1 cb3bd2d46ec2525d8e9fc0326f118139dc710155
SHA512 22d79ee44923ecbbbd549cb99c7a07efe6f345662d50ca67e5cf93a0e8d6cfc334dbad4409fdb48d670ebe9a122fbd15665faa2360d437c1dce4e4ddeec9d47f
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99i:uy5112gYy5azzVva69nLKnhZJShh
TLSH
T10A167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bdd18aecae584feab8f20b8f22b0a2b81746767590c38c2bb062a76a02377f44
MD5 f43b1925fa8ed1e52665c2731b2e09c5
SHA1 00aeaa84217a5525cfe66e3bf287bb82d65eef95
SHA512 f262b4019ac69c7f22525c70d62ead6b3a9fd44d0fc1eee59dddaafda67e51deac777a2a3e428cedfb7430fc96fedc4590e115a548ab369c0225cd08895c5f8c
SSDEEP 49152:VB+taZ3usBWOBr4tEG20bqx0z+n217aau1glDlcUrhhU:bu6JmUxd2d2Shh
TLSH
T195D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6cae2160fd1e94ac5b039692b3e3dfedf85e85a5d78675f7f4491471c97d1148
MD5 194f441b1ba1905c56843abc4ea8b458
SHA1 40c13bbff307ab4f7b47b6cfec22e7a5fa3e0811
SHA512 158215cff0ff47848901507ef82064e0c8e876ba74ebd6849199ed3497335a15d4af82c27cd9da67a5789fb65a2966a25b8888c8712609146a30c685768a2991
SSDEEP 49152:O1hpsNoJpF1A6BU44CwH7R4xJlcUrhhU:OmifPkR3Shh
TLSH
T1B4B5AE13F2D901E8D05ED178875A9232EA72BC450B24B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fd59a9a8883da810ffad0cd361b78803a8da5608602efb0e89bc448a5c747546
MD5 86cfa373e8e06838dad8c33141f8cb21
SHA1 3cf5dc59d900078db57534ce96d7b01ac0593581
SHA512 b3dc167d71b539934fa3957b57292ee1689268b2fc7beded6d5e31880aa7677327a6652d6e6d6f0c4b4a8f64db74ea172161e26afa2622ae0c365dd36177d45b
SSDEEP 49152:4SuZQIY0Be2KNRVtOnks6NMHqclcUrhhU:i5dKvi61NShh
TLSH
T19FC5BE13F2E940E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f628cf019cb52c8e18c79e48c7071d076025e82f95127df302401152b8e41a9e
MD5 aa6a17fe3835acde0194fee9af339b3b
SHA1 b76ad150ff1defa4b4378bb5fd9bd4fb1f24f2bb
SHA512 f428a3ef1da47ba6acde94a99217e9c3a527aa9032e4ff9d5b438a1aebb9c401c21c554e14f9edae54f92a768c9559e6cf03c9717dd94d9c674398dcc6662248
SSDEEP 49152:WhtSn8EApI0figXgiDn0AP5wFlcUrhhU:3X2iyphTShh
TLSH
T19E95BE13F2D900E8D05ED178C7468632E962BC550B25BAEF0A90B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 6f65becedacd62da906cd1b753e42c2ab65a1004fcc82b3b21d1fa15c3d7a615
MD5 20a31af6223943f4a9334ade99266693
SHA1 0fcf701780a6aae0c4570313978dd155bf17f7b0
SHA512 c7ce3360899df423459eb1cb8fb2a7d2fd4dce073f43b75d96823aab42dda185acb9398bc644b5d5ed7b0ae5df91b40f6ec26488bf4440b97adcd55cb4be863c
SSDEEP 12288:tT2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAQx:tCvDyiLdeKD0GFxRLzXhUHG
TLSH
T1246523A4E4C12542D70A82F8C2DD51A18CB42DF8F2417823E728E652E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 b25ee0bdd58bbebd9849677e71316f5186695b9ef97ddf639f1dff6d62ab6deb
MD5 02f055d81dd2b8ad8ac01a665ba0d47a
SHA1 354c321b6e6b8d73ba551a0a99dc4638db288d27
SHA512 5c25ccca4a384fada65c71f0933000f2c70e820039c9c6fcf67f4fac4600763ed2dedd03150fab6e463bfb1bce2715fee156447b61559cea930d1b469df96d44
SSDEEP 12288:Kk2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAh:KHvDyiLdeKD0GFxRLzXhUHh
TLSH
T1FF6523A4E4C12542C70A82F8C2DD50A1CCB42DF8F2417923E728E652E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 8b2e8b14a2e3cedcc44d5f3a847518abcfc45f3d3c2d059a17bd6f64d373a7fb
MD5 3d24d730909ee4a1c22cf0fb54071966
SHA1 d2d24703778560c38654e7d9b7edde54cce6dd63
SHA512 318744ac1b0858f16dd6daa04993d5600ee58fbe8cc7e7f283b21f596dc1b4f2f17f3180df3fec00052851dab6164efec94dcf4736485337e94c0b88427775c3
SSDEEP 12288:VC2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAC:VxvDyiLdeKD0GFxRLzXhUHC
TLSH
T1FC6523A4E4C12542C70A82F8C2DD51A1CCB42DF8F2417923E729E652E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 53752786e8493b8cb3f366f598408086522b28ffbbd6a16b1d8d7200f49ff8cd
MD5 4c577c3fda312b7b7a40ac4f12e445e9
SHA1 fab01eec1c7aecb875af3f2327f8891a2367f1b7
SHA512 45e25e23a4bd5417a3936bf6dff1ed3a3c414e6cacc9fa6f18f9594853ceb9fb1e84b74a7ddffef0af58cfd3a05f0e8a8427e43e0eec8b317f5f139347374d27
SSDEEP 12288:9Vh2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAW:kvDyiLdeKD0GFxRLzXhUHW
TLSH
T1C36523A1A5D510C2CA1AC2B8C6E94061C8F47DF8F3017627D720D6569EF37C1793AAF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 3a1f02f43fd0bd5a0280ed02d75d4db22da82f3e8a02fe972e878d56246e476a
MD5 d6578ca9b87939eb21ec9d0c7ade3b47
SHA1 089ec295a178b76b71cc464c7512691ea17c91f9
SHA512 6cc144320e89c71c8ab5e74e9ab5587c9daafa1542094255a2a92f70461f6ebc086727e3601b3d27adc1d49aa94a65888a5b36fe7c9d9f389c103ef3019e1733
SSDEEP 12288:nZ2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAo:n0vDyiLdeKD0GFxRLzXhUHo
TLSH
T10F6523A4E4C12542C70A82F8C2DD51A1CCB42DF8F2417923E729E652E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 345e9c0072db98aa7d420133a5d05c9a2f40b57f75dc261a50967f3ebf7bfbae
MD5 e462cd355b4228022f760d82ff36b815
SHA1 256cbd23302801a560e2f249ef7b70d66d1d632b
SHA512 cf41d04829761e327bec51b2b8a27966edeb9293448fbccf394a36e6163799272d6d67780c74974f100322c5828a276d53453b270ea799c004980a53a2b63ecb
SSDEEP 12288:B42v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAO:BrvDyiLdeKD0GFxRLzXhUHO
TLSH
T13E6523A4E4C12542C70A82F8C6DD50A1CCB42EF8F2417523E729E652E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 30aa1b676e31a82a6f53569387281f0dde00e331a5bb0730fb50846fb111454b
MD5 84fa74155d427727e168f44c9556ad31
SHA1 529a40018959da603cc742effaeb002fec83606a
SHA512 c52c04ded01bc7549f52f1286caee0f41e2683f9b678b469421c042c9e1324ba6a0b73ba1b32a8cc8b50ef6acd199b096cedfed72896a175edd58b37dec8ce6a
SSDEEP 12288:hc2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAR:hvvDyiLdeKD0GFxRLzXhUHR
TLSH
T10A6523B4E4C12542C70A82F8C2DD54A18CB42DF8F2417923E729E652E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 cafb050fd9f6099abc905e77664e541006fb6e2a0af8c16ce390640be5159f0b
MD5 f37ec0cf3b906dc9b2861a4a2f4c59d1
SHA1 e69f52d54501e9ecb9a0ecd3a7f397b285d05fab
SHA512 a393c6c843e13ccc038e2baf919d76282871fd6e3313f56a1e65d26626af5840e7fb454a2682d0a639990330f0770a795d97010fc282d2ee5436ac6b2dae13b7
SSDEEP 12288:0iZwbrzzFEoS2cPvyE2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAb:XZM/zFVSOnvDyiLdeKD0GFxRLzXhUHb
TLSH
T1D18501A4B39018F4ED67823EC9598912D5F27CA94760CA1F03B436675F733911C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 cb274c5f35ab59cb8165546c354d3c54b719b06efdef364bf72a93eacac51d33
MD5 7c6b65c2c2fbdfec156f4d9fc03e3343
SHA1 4242f62f74cb37292f127683d42f100b3cef6dd7
SHA512 e8a939960acd283b341126070550d5d1010102394b3533854a7907c2d13505655d8e335ac8b36134c2156ea62209236f32d84b27598b6c3cacac7e4383266554
SSDEEP 12288:HP2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoA7:HuvDyiLdeKD0GFxRLzXhUH7
TLSH
T1266523A4E4C12542C70A42F8C2DD51A1CCB42DF8F2427923E729E652E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 9aab41fab50361ee5c3903cc1c33832d4065bf53bbe15adace5c7c37395f11cc
MD5 51f2e4f53cf257fd6248e021c7fea7df
SHA1 d3bb35e144a2826bb71edc64b4b44e2538d2d2c3
SHA512 4c325d099c455b5385f320334aa5c61c825277ce56583d7c0054b8e592f16edb6b9837c3a733c3397c75372bec58272092d478e1c10bb957b46cbdd13c06396a
SSDEEP 12288:q72v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAx:qavDyiLdeKD0GFxRLzXhUHx
TLSH
T1AE6523A5E4C12542C70A42F8C2DD50A18CB42EF8F2427523E729E752E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 55b991a5049a74f1ff2be46e120571de5edc868999484817d7e4521d8c47aace
MD5 3b0c4a3f90e46284fbba51041d7e8d67
SHA1 740c3f2413faf1d7a006169c0a5a76efa2ad85b0
SHA512 571d7d50bce9805d25cb32635a0f6df4c9fb90fcbb607cbdef1c1f06f1d039e589db2f94f2df0fb026b5d368987ec046286d3c532ab0cefe31059ea9a9c78169
SSDEEP 12288:5yPz5L8A2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAt:4zyDvDyiLdeKD0GFxRLzXhUHt
TLSH
T113751257B2E130F5C22B8278C9A60912E7B17CB553109A6F536087766F736D0AD3EBB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 469d76dcf1f040b7a47d9c006bf70c47868beeed119807ba1ef8d45d6ed963f1
MD5 c1d380ed7d4684f8e645b09528e3a1ef
SHA1 5a5a83052363ae21124b1f822c13ed6be58c4a6d
SHA512 7a7a563bb381295cb7362069a8aa31d5d936e15f58a23b4342ee584f2aa2536093e03794e45f53c0c9a9f76db5c210b9348f2ac8b0bd161d92655ae69c9ac698
SSDEEP 12288:iP2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAb:iuvDyiLdeKD0GFxRLzXhUHb
TLSH
T1D66523A4E4C12542C70A42F8C2DD51A1CCB42DF8F2427923E729E652E6F7AC5793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 98478f8bf3042e652f65f784d1edfc6080d84138fe3a54dae7e67b91941b6da3
MD5 4652ce474af17997fbd82ea08d24bcf4
SHA1 b5a12e620caf999c99eabc4e5f8ad9225644346f
SHA512 084edf5e528fbb51343df87ad5d5d99303cb889d2fa18840bfa49b72b94df5578b9cda1a1fdf16cba2c77848fd60919c946df9f51829cf50d4cfa4f6e558dea1
SSDEEP 12288:hP2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAK:huvDyiLdeKD0GFxRLzXhUHK
TLSH
T1B56523A4E4C12542C70A42F8C2DD51A1CCB42DF8F2417923E729E652E6F7AC6793E4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 68af360f68110df3af28ebc41c379b06e7be31ac47dd5e1bfbf7c593d382de1c
MD5 2f81376882860ae67a84ca7a32117e91
SHA1 e7e4d075aa48c10ad9136d380f03f27ffb7464bc
SHA512 a3c62d737737bf72fe624b66cbad5a978a2e7cc604ce1d5252420b6348dd116b166232a452361951f42ba3e6b5741f669fb8db6ae50158f278c379749ee5787a
SSDEEP 24576:NcP4mcvIjkGOxhKP2l71SNKbrh/8KBWvDyiLdeKD0GFxRLzXhUHO:yP4m4IpOO67N8K2lcUrhhU
TLSH
T18E65BE2DABDC0096D0BB917885658A49FAB1742A2F3286CB1160933D7F77EE14F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 95920708f42eec654f4b671e550686968c1f622a2ebbc76d14db84e3ace4cf20
MD5 ef0de65d0b9f41a6bbb8be4ac5662df0
SHA1 0776c452aceaf073c11e3f7fa76a55b1e57730a6
SHA512 1af5e3427c80717f34798efeafc366a3b830428b507e89ea88fe8e287a0c01c3fe3da7571301fc3e328ef591cb455ff2b6a151f06d34fb881d197c5fd3f21cb1
SSDEEP 12288:Z1sf/2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAo:KevDyiLdeKD0GFxRLzXhUHo
TLSH
T18075F059D28402D4C12E52B9C79A4641F7733CA493E1E3CB93D0F63E1FB6680ADEA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f08de14e4bb6346b.bin

Path C:\Users\Admin\AppData\Roaming\f08de14e4bb6346b.bin
Size 12KB
SHA256 2ba485e2282945d5aef27e169e3b2278ecbd185eb7702ac94408944b27af2b7d
MD5 4e3e55a73cc23fe74c5e60b2ea85df72
SHA1 17d82cff3b13bbe5d1cf9919e563ece803723034
SHA512 76b9ad2bbcbd45f87b6dd573828e11902be934f890ed2fd656f4a5d8547ba5a62b2067a9d0a7a954c34a27dc0a4d1b2ce48b0bdfe677851e3412a1fe8c92f02d
SSDEEP 384:E/uvlgusKKdIM5RhH2McFekAETzU+YF47MbYnECH:EW+w+3qn2a4KEa
TLSH
T10E42D019C1E604EA3D02EB93A8C0D5304320F4EB38779DF295B0D2A07877BA6638752E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 356bb60b7657c31bdb5e749d2c67720e06d93f50ce94032038a4c2ccb55ea255
MD5 c271555a50264195a8b97d9a3075bd2f
SHA1 5f320190d3eef139bb3fedfe70f4efc12197ebc4
SHA512 a8088e58016a4dbc889b43a8cc46446213b14731638a4ee91481f0cc8de299b998c15e433c7d08b0848038536ca521cdcbb3b7730627cc1d37f4e8342bac2cdb
SSDEEP 12288:hf2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoA7:h+vDyiLdeKD0GFxRLzXhUH7
TLSH
T1936523B1E1C42542D71E46B4C2DD80718CB93EF8E701A423F624E756D6F7AC1AC3A5BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b76f737347370bbb9ec57b686755c74fb915b371af923463fd7c229c119cc7a2
MD5 aa12d5c673527ae71e22bd3afcc60a3a
SHA1 55193546485d288c5a7dc2aa1bea0d5986b0d39a
SHA512 55f43c31eb4c437234c6d197ad00ba00735600d38be0493a9fc07414d08b1d8b6767d1c12e30c2889fdd04c9b7806522435bb67fea49558a578cb623261cff66
SSDEEP 24576:poiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBq9EzwwXg/bQvDyir:pa0h2GEkuAe73q3pp46zwwQylcUrhhU
TLSH
T1DF85AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 adae576cc3ef04e01a40996ea91f5b585e05800e0e29ff9cf147b3dfb5bc02c9
MD5 e40d0009ef4916d6fb031bb8e8636c46
SHA1 f18fce4b0b4eb57f7003fd0a746b87e6a34db553
SHA512 9cfac08f161f7864880b38d8a3bb9f2bea69c6354778e606f5af19a288e8c923b75791f7d495994a7c3fcc9c04ff966f4dc4f31a935057fd4da90f16afa9681d
SSDEEP 12288:zhbHjfXK2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoA/:zhbHjPJvDyiLdeKD0GFxRLzXhUH/
TLSH
T1D16502BD62DC20C5E636D2BCC6958506C670BCB82301A7EF6391C27A8F77ED45C39A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 87bc09774aec5e5a5edea79362bf88291f17a077a3ec94df76ccdb9e7b1392ab
MD5 220ae3d95fa3f4a93e5aa72148674fe6
SHA1 be05a289dc1a3c5b1c7fe967986181004bb1ff42
SHA512 b59d981fde2f7c47a397b4b909a80f0e5e3d7d56d6520e09decdf06df4b98e96994d3ac398344da13e19a01b2318b2ea25610891ff2ccbb6f622f982d7a33514
SSDEEP 24576:Y3YgnJcRTk4yti+R5dpR/BvDyiLdeKD0GFxRLzXhUH+:YIgnaTk46ppR/RlcUrhhU
TLSH
T12045BF2DF2B910B9C8AAD236854147B5FB71782D1F209AC70170C638AF1AED85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 c3179445ad7d6eca278ce142be0c86500c38c4ba9c13ab742dd49081854a0def
MD5 d9d063a9b7120b52ddc22e3480504cc9
SHA1 3c7af32e9d52adf60784edc3f8d8431f60787005
SHA512 99e5bb53b281c51792ac57c06d37bb34a88c9ec0f723314d2c90c008df9c0277cfc810dca646dac64ae0042fffa2e22a5b1860d2588a03585fe24a8fa6b1dd97
SSDEEP 12288:qL2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAo:qqvDyiLdeKD0GFxRLzXhUHo
TLSH
T1FB6523A4E0C12542CB1A82F8C6DD40618CB42EF8E3017963E634E752D7F7AC6793A4F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 d3cb99b729d3479f9809c800721084c0aae6dac8b0040360c7badb9ae835ddf7
MD5 9a0f1b7f9c97da537e8aea4d45fbcc2c
SHA1 47ab5ff3a17323ea2bb7ad1fbfbfcc09e1f79dce
SHA512 1f70300117ac423b095c336ba562b896469d0804daf182cf0fd8cd268a64713aff8b29538a2f03141e0bdd4a95ed1cbecf6c2d70e785bbfbb18466a737731cdc
SSDEEP 12288:SObQA4LWOsvAYFTO2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoA1:DIL3UTtvDyiLdeKD0GFxRLzXhUH1
TLSH
T1C9850155F7D400F5E92BC23CC9A68512D6B278AC1360E7DB43688B661F637E24E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 89a29e92ed6243bdfc4f97d8e9732f5ed4c5c8de5600bd2bbe73078287f89593
MD5 fde195715283b030320a93b3eb58ffdc
SHA1 f0b692e3965b6a2ac73fa0f6406e8dbc6698ac0a
SHA512 bf1fea0c921a60ac8f35b471365179fe8d30dbe5452e906885f4e203fcc148a28784f45e1b38d855be810b4bb6deb7066c712526023af7f7d58e28cd2bc1dbd3
SSDEEP 12288:lpFtVOa2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoA5:xOZvDyiLdeKD0GFxRLzXhUH5
TLSH
T12F75026932DC10D1D53A927CC6964209C7B178B5531267EF43A0C27E5FB3FE86C3AAA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 abd27db176555333128bdd512acd81246efa968d504bc4df67a02d933e6e9618
MD5 bc49f39f66d1b0c7121edd68d234b489
SHA1 1f6c38974df8eead7fd519e915af87ede46af279
SHA512 7e9a52b98c1c8a021e4852f59c2a0d0dcd6bb661c6a263c8a3c9edce1bf06c931cb48f5a8f30248e082c74f9ce7a24dc12c0393b91eaed2f3c1e94d0030cf2ad
SSDEEP 24576:B7NM9YmZqmWMUkPjZM48Mv6bEhsuvDyiLdeKD0GFxRLzXhUHS:B7cBWMpPjN8DbEhflcUrhhU
TLSH
T12A659E2E6BEC81D5D577C13DC9E28205F6B1B4611B318ACB5162833E6F37AE44E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 8ebc3d22b8cd9aa2d47c130909b6abff71267da997d33ce5ece6708249cf87bd
MD5 e37cb4cd195a4ee7a37e20bccc1d6001
SHA1 60cea4bf5d662179c91694fd2cde579a0fe8a2dc
SHA512 b36cdf46f0178e3a2828e775122cd7bc466ab69defc7ba14f1d4e9c9b32a5a086f472bbad1ee98ce89db9dca6b56b5e5d50ec87db301ccd0acb73f233bed57b3
SSDEEP 24576:UW6BApg2YuyuNDYTabvcRvNYf8km1YvDyiLdeKD0GFxRLzXhUHN:UF2YuHNETovcvNYf8kmMlcUrhhU
TLSH
T172858E2927ED80A4E0BBD2BD85B6D246F9B2B8511B3055CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 d60f4a6c0b7bf01539981f4ec3c992a1f90afc1a5eab4a1984ceb6179ea8f1f6
MD5 31e6579bf456175c8863468252fe7412
SHA1 84f5150279aebb5a4ceaae7f031f32582d6149c6
SHA512 9bf634c7a9234d73a10343c188641c44a1bd2946d8b3ee2790707c0b214ddbe473357f4313eaa92a6c4a7cbab181816a1b61ffa37e62a5064dd459b7fad93879
SSDEEP 24576:4AFs06+OmlfQNXEbTolvDyiLdeKD0GFxRLzXhUHD:9Fs060lcXuSlcUrhhU
TLSH
T13365AF2F62EC00D5D07ED17D8A96C91AF6B1746707215ACB0260C67E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 00587037007aa66fd4ab08fe08b40d55c9177b7ad7756be27bc7b2f9847edb57
MD5 f6e84c600bc565e6ea202fb86d1c8b9c
SHA1 fde41294732f417cb8cf1bd36740d377192ba1fd
SHA512 a0130233d1c432989fb334402e202c0b3f6b63fbb75bee531b94083ddb090406a296746d26662c94c741ab5c72fdbaf4ebc39c8339adc39e19b668bf9464da6a
SSDEEP 12288:9CJnJ5D3Vkr/zxv2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAw:UJnJ5D3WbUvDyiLdeKD0GFxRLzXhUHw
TLSH
T15785E03CD2A810E4D4B7C2B4829A1756FE72387C2B2269C76474D5357F22FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 586b7f6a30d5d3c7d50872aaa68e8fa13b375ac5dd3d0bb5cf8895e660331e69
MD5 3caeffcdfbad18bfa79cecf926d2e91c
SHA1 b941cdf411d653a11d5f35072bcf5898bc569c03
SHA512 57313d81c370ff71a3ae2763fd12d05eb0fc073f6b5ab73f1045d0a33c434919710e65e980c6464d23b260b7daf74c48884b83facb714ccc46233c5b9dbbe94e
SSDEEP 24576:NEPohm6/7IIXdwcXrif7qQncjlP65i3Vu/vDyiLdeKD0GFxRLzXhUHr:6o06DIKdwc+eQnSt65aVolcUrhhU
TLSH
T11A956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 743fad5b80277c8a3cd47cd460ed3fc65e72b4eaa153a4493c8982bf17bcee3e
MD5 a11cb3612eb4f6b15cfc83986b052b4c
SHA1 da6df71d78a84424b7137f3f199e43b94f41b14b
SHA512 34a61716a6bb8445f2b203b0551577c9fec0d57d93888f33659195b1664d0487aeaeb46696dd61c0faff7da12d8dc215a1989e0897410f6cb235cfa95da8ce85
SSDEEP 12288:CEP3RmD2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAi:BmyvDyiLdeKD0GFxRLzXhUHi
TLSH
T1CE6512AD66DC30D1C22A917CC1958145C7B1F4B4670237EF92A0C23E8FB7AE52D3DAA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 fa43862566d71ea1a5e1f1ecae923d832134f7670018224dae7632dd2cdbea12
MD5 adaf14da8ba9b3a7623344f2a7016260
SHA1 9dd2cc6cfe81b7cb3524e05a3eb7eab99d844694
SHA512 7a9b230394c68ae801052b929fa52f041ec4c856fc52fbf139aeedef9b80db16a09fcee59c025bb4940993f6b11afe3b3448601582ec53788169b06de67bc420
SSDEEP 12288:Pjkya2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAv:PIyZvDyiLdeKD0GFxRLzXhUHv
TLSH
T1EE751354A3C42081D67A4278C6A741A08D747CB0AB1166EFA150F73FAF77BC0BC35B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 292e7167d918bc7ec3c77ba9c70e8826581447ece35f4ab90865552bf38d2f5e
MD5 7c182733336fd933a76f427b30934675
SHA1 d92f54ac6b7f0e88a1363b840cffd216371c96ee
SHA512 cd8161805fcf98f238afe0d7906d0eb3840520fdf88b107444235fcb76c16793336dd93804767d27d63bbb2a3a7b25fbc3903666f3fa68b63706de6777eeda4d
SSDEEP 12288:auq2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAg:TpvDyiLdeKD0GFxRLzXhUHg
TLSH
T1936523A8A1C13442DB1A42F8C2DD556188B03DF8A3017877E274E772DBF76C2753A8E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 f271f7735e56a6afce225db76fc782e053a1386d0ea1bef645f6f037879cd7b7
MD5 d6c15a8ae244427247c5aa70a51c4e7d
SHA1 875e26f2d13f8bdf5374bb5c44619a1eee338e03
SHA512 0fe794ed6032f04b563e6ebe351f9f16ff4c916fbb6761b68f9f688f89ca1d0e74224e5d08ed3b8777e8ecb484eb6ba1a6f6d9739776fe0c0090f6dcfc838a03
SSDEEP 24576:0Q9MxZKdcz97w3GvDyiLdeKD0GFxRLzXhUHt:0VKXElcUrhhU
TLSH
T1E7557C2DABE9058AE177D27595A250C3A673B4301B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 fd05ca0465ecc2ad425b74631516dfc6cf347e96887e153b7722324cd7b1af43
MD5 3ec6250f7fa0b117b7844c0abb4b214b
SHA1 54cb69e693aa48c8d2a2854fd9181fd261c1425f
SHA512 ca702092c4e0eb7736b4cc7174acfb7b8444742471dfc136aa0f1c8185741b936e5a3f5de5dcb8395a27da3bc965994e11d3ecc18a56d0b60454bf581b64bb6e
SSDEEP 12288:myoKo2yRple9pw2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoA0:myocAApzvDyiLdeKD0GFxRLzXhUH0
TLSH
T14775F11FB7A900A2D126813CC9858345E7B3B4705B5267DBA291C33D8F73AE9BD38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6f9b860046c0480a8edb360ccbe58fe90f08f1bed36b7418446e18ccebe6c894
MD5 3e59087e0dc67ef8ee8e1682e5d0dbb7
SHA1 d67eb8b5ba2572c7d6fb988bdb759ee60d35fbfd
SHA512 3070c2c4540ac7cd3de880c3c3e3ca8973dd9aaa01c8dc6b61b3a21a5d5f2e7595323ba5e5c4085feb5e206851f052961294f31346b477b4dbe0f4c5e52f9d68
SSDEEP 49152:JWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKTlcUrhhU:x0zuNIiShh
TLSH
T166A57C3DA2E800A8D9AAC375C54513A5EE71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f0c8958c7a921840b554c8c2f5f0f7977ef284a6fb70159695d6833f797e32fc
MD5 836f3caa88c61296fc38861955ab8a65
SHA1 5d6a3ee1741ec83f93e61cde3a55093fa49355b2
SHA512 aceb6d67ba2dc3d8a7054b9da5494d215a668a5f1a85fc4854b40cb3bb3c8905bb8149f781a6e2bb5bccb3b50d1de8423b9a43cdae2ef3019942cb494ac0070e
SSDEEP 24576:X1QT7EcpfxR+N5AWAz3ooiYsjMqbyvDyiLdeKD0GFxRLzXhUHR:qTDxR+N5YzTujMHlcUrhhU
TLSH
T1AE55B02EA7F815E9D17EC5798A23C512FA727861033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 19b4194152bf5a77575b4083fbe1afbd6272fa8a4ae1f89d9e894515d16ee9f7
MD5 2d64e04aaabdfea9b32a2ab9191f0e40
SHA1 e6c590cc489e074fd284ded646302026c0c0c78f
SHA512 d592a4f57a7956823287d6c383951ab2b369dacc3cf318ed0368702f806f6b1e36e42a920b978ed07cc9cbb856e0560ae7fbe6dc479ed4683e9dd80690f2c7d9
SSDEEP 24576:hTMdOz0FFS+AmSLMvDyiLdeKD0GFxRLzXhUHX:L0K+AmSLKlcUrhhU
TLSH
T10D85E17EA3AD14E5E53BC27CC6438906E97238B5031266DB06A0C1796FA7FD4393EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 957ce5f65af92af18a5836952f6693c16771da7b010cb506da88e15c384108b2
MD5 8c51fff1b3eca04b3ff48897a29084d6
SHA1 9830c2b1922d09504a8c919e204793ad5dbc9c2d
SHA512 c024941dbf24282a040a96564ea22e65f873d993193848e60deeee5b168124cd6d471848a7da220f8a7fe1fa772e98897001a65169190ce45e05080395216249
SSDEEP 12288:L4QO2v2CyiL8ieKDeAGBG2q06e+xkiLzRBRFh27BaZUoAy:ltvDyiLdeKD0GFxRLzXhUHy
TLSH
T11B65136C63D430C1E52692B8C7AA4151C9707CB463017AFF76E0D67A8F77AC4A83DB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/632-126-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/632-238-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/632-129-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/632-120-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/680-251-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/680-481-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/680-242-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/680-248-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/864-37-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/864-45-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/864-46-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/960-52-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/960-51-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/960-62-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/960-58-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/960-60-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/1016-263-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1016-482-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1016-254-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1016-260-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/1032-178-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1032-175-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1032-169-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1032-431-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1224-143-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1224-262-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1544-132-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1544-138-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/1544-139-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1544-250-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/1628-157-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1628-287-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1628-163-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1628-165-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1628-477-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1628-479-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2192-190-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2192-448-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2192-181-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2192-187-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2196-224-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2196-228-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2196-226-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2196-222-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2196-216-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2240-272-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2240-483-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2240-266-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2240-275-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/2444-30-0x0000000000400000-0x0000000000A15000-memory.dmp

Download

memory/2444-9-0x0000000002690000-0x00000000026F7000-memory.dmp

Download

memory/2444-111-0x0000000000400000-0x0000000000A15000-memory.dmp

Download

memory/2444-14-0x0000000002690000-0x00000000026F7000-memory.dmp

Download

memory/2744-476-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2744-213-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/2744-205-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2744-211-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2924-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2924-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2924-274-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2924-154-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3548-200-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3548-194-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3548-462-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3548-202-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3728-69-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3728-75-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3728-177-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3728-65-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4392-480-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4392-239-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4392-230-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4392-236-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4540-110-0x0000000000400000-0x0000000000A15000-memory.dmp

Download

memory/4540-115-0x0000000000400000-0x0000000000A15000-memory.dmp

Download

memory/4540-5-0x0000000002890000-0x00000000028F7000-memory.dmp

Download

memory/4540-0-0x0000000002890000-0x00000000028F7000-memory.dmp

Download

memory/4540-33-0x0000000000400000-0x0000000000A15000-memory.dmp

Download

memory/4540-8-0x0000000000400000-0x0000000000A15000-memory.dmp

Download

memory/4768-496-0x0000014F0BFB0000-0x0000014F0BFC0000-memory.dmp

Download

memory/4768-497-0x0000014F0BFB0000-0x0000014F0BFC0000-memory.dmp

Download

memory/4768-491-0x0000014F0BFB0000-0x0000014F0BFC0000-memory.dmp

Download

memory/4768-492-0x0000014F0BFB0000-0x0000014F0BFC0000-memory.dmp

Download

memory/4768-493-0x0000014F0BFB0000-0x0000014F0BFC0000-memory.dmp

Download

memory/4768-495-0x0000014F0BFB0000-0x0000014F0BFC0000-memory.dmp

Download

memory/4768-494-0x0000014F0BFB0000-0x0000014F0BFC0000-memory.dmp

Download

memory/4768-489-0x0000014F0BFB0000-0x0000014F0BFC0000-memory.dmp

Download

memory/4768-502-0x0000014F0BFB0000-0x0000014F0BFC0000-memory.dmp

Download

memory/4768-490-0x0000014F0BFB0000-0x0000014F0BFC0000-memory.dmp

Download

memory/4768-501-0x0000014F0BFB0000-0x0000014F0BFC0000-memory.dmp

Download

memory/4768-498-0x0000014F0BFB0000-0x0000014F0BFC0000-memory.dmp

Download

memory/4768-499-0x0000014F0BFB0000-0x0000014F0BFC0000-memory.dmp

Download

memory/4768-500-0x0000014F0BFB0000-0x0000014F0BFC0000-memory.dmp

Download

memory/4924-20-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4924-128-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/4924-28-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4924-34-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/5180-98-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/5180-102-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/5180-105-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5180-92-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/5180-100-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/5676-85-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5676-87-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5676-79-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5676-189-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5768-487-0x000000000CEC0000-0x000000000CEC8000-memory.dmp

Download

memory/5768-484-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5768-288-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5768-285-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5768-313-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/5768-297-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/5768-330-0x000000000A200000-0x000000000A208000-memory.dmp

Download