9c91d59fdb2c0b40bd56e4306a558c4a4eec3feca07c7f137ed0b09be1199992

Analysis

user interaction
yes
max time kernel
33s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ShadeFN_Cracked.exe
Size 110.2MB
Sample260925-145ldsyv5j
SHA256 9c91d59fdb2c0b40bd56e4306a558c4a4eec3feca07c7f137ed0b09be1199992
MD5 5cc3985339b456eb2682f757a4fbc1af
SHA1 67419d448f36be5c59abb7293a219138a75ea537
SHA512 b5e89077a1c8daf633c3af50fc405299ad19a455e73ed010cfb40238031117e6242b9bafdba2b37778464f6f345474b3cea67e933be8513b94f13f1b87786909
SSDEEP 1572864:9c7hR3Ih0BCLeVfAle0YyZJgdIMKZ3HCAYd3LeJsEDQl1sa/eeUQHCBn6fIct:9c7hWeiqAlJEje3HA3AF+z/XKAR
TLSH
T1694833D43A035A0CCB6B9634F983D5A87407A4CD89668ADB5FE23A16F0CD1EB61344F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3404	alg.exe
3312	DiagnosticsHub.StandardCollector.Service.exe
4396	fxssvc.exe
1368	elevation_service.exe
1156	elevation_service.exe
1848	maintenanceservice.exe
2756	msdtc.exe
204	OSE.EXE
2932	PerceptionSimulationService.exe
3816	perfhost.exe
1448	locator.exe
4724	SensorDataService.exe
2024	snmptrap.exe
1208	spectrum.exe
2420	ssh-agent.exe
3556	TieringEngineService.exe
2404	AgentService.exe
4928	vds.exe
4700	vssvc.exe
312	wbengine.exe
2012	WmiApSrv.exe
3264	SearchIndexer.exe

Loads dropped DLL 9 IoCs

pid	Process
436	ShadeFN_Cracked.exe
436	ShadeFN_Cracked.exe
436	ShadeFN_Cracked.exe
436	ShadeFN_Cracked.exe
436	ShadeFN_Cracked.exe
436	ShadeFN_Cracked.exe
436	ShadeFN_Cracked.exe
436	ShadeFN_Cracked.exe
436	ShadeFN_Cracked.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	ShadeFN_Cracked.exe
\??\F:\	alg.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\vssvc.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\spectrum.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\dllhost.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\System32\msdtc.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\15cf66ba5ef7726b.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\AgentService.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\wbengine.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	ShadeFN_Cracked.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ShadeFN_Cracked.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ShadeFN_Cracked.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ShadeFN_Cracked.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a35f53b3b4ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000561f78363b4ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aae29b363b4ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d998b93b3b4ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047adcc3b3b4ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a49b9a3b3b4ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe
1604	ShadeFN_Cracked.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1604	ShadeFN_Cracked.exe
Token: SeAuditPrivilege	4396	fxssvc.exe
Token: SeRestorePrivilege	3556	TieringEngineService.exe
Token: SeManageVolumePrivilege	3556	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2404	AgentService.exe
Token: SeBackupPrivilege	4700	vssvc.exe
Token: SeRestorePrivilege	4700	vssvc.exe
Token: SeAuditPrivilege	4700	vssvc.exe
Token: SeBackupPrivilege	312	wbengine.exe
Token: SeRestorePrivilege	312	wbengine.exe
Token: SeSecurityPrivilege	312	wbengine.exe
Token: 33	3264	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3264	SearchIndexer.exe
Token: SeDebugPrivilege	1604	ShadeFN_Cracked.exe
Token: SeDebugPrivilege	1604	ShadeFN_Cracked.exe
Token: SeDebugPrivilege	1604	ShadeFN_Cracked.exe
Token: SeDebugPrivilege	1604	ShadeFN_Cracked.exe
Token: SeDebugPrivilege	1604	ShadeFN_Cracked.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 436	1604	ShadeFN_Cracked.exe	112
PID 3264 wrote to memory of 3720	3264	SearchIndexer.exe	117
PID 3264 wrote to memory of 3536	3264	SearchIndexer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ShadeFN_Cracked.exe
"C:\Users\Admin\AppData\Local\Temp\ShadeFN_Cracked.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Users\Admin\AppData\Local\Temp\ShadeFN_Cracked.exe
  C:\Users\Admin\AppData\Local\Temp\ShadeFN_Cracked.exe
  2⤵
  - Loads dropped DLL
  PID:436

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
PID:3404

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3312

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2988

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1156

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1848

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2756

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:204

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2932

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3816

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1448

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4724

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2024

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1208

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4572

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:312

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2012

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3720
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 63ce002016e11806d6c47b6b7a189eed3db68f7f4c9d28ec9524a614af5ff002
MD5 cc840bbd594fd2c5840b4e4ab6ffa59f
SHA1 a72f028a7801e79b961839eabc446c9252db569d
SHA512 f3eb4ffb3eab4917aea0374f5876252c6fbccdbd3a281b87248260b1688956642de7e7517095ccf9101ea763db3978dbdf3addd8d00771daace3334a77e68ad8
SSDEEP 49152:Ub+632BuPkFKRrdE6ohvstBhuXjfS4LWxnlXcsQJcsKEzQNpHj:O3q6sjB7bcstu
TLSH
T1CBD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a24d0b13e9f4f8c3aecdcd15d7262aedb9a61019666395380c05227eb6f18260
MD5 3e6573baa21b9d77244280f3d36dacfb
SHA1 58433b4a78b78061c6627450d01951c49511c0b9
SHA512 70e26cd24dcef1ef99396bde2e62ff68d9fd2a0f05e8cee9827a1c8682f71424260090b1d4cb537e96e398331bb044f51842f55ede83676659f792b79f0a7300
SSDEEP 24576:1XYfDtczAODUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:gtcvXcsQJcsKEzQNpHj
TLSH
T10D05F128A7D408F9EC6B813DC9A28811E633BC554760E6CB03E496765F337E85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 9517cf1fa58bcc920482bcd7bf85686d0238548c60094a76328733086fd4b97f
MD5 157a99a2f98ea2dcb233369c9a1618e3
SHA1 ee232f2e84ca80ea90cf45b351c6264619f2ce1b
SHA512 1eb0ee6b29bc150d468443931c812f2096a427f9f132b998ba520c22c4b24a3fe332cde7d8e7269b160b29aa600a892a9e90688888e91b0d30c43f3835281095
SSDEEP 24576:I0Le5ji0hmxxrMNDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:IPji0Aj8XcsQJcsKEzQNpHj
TLSH
T14635AE25F6748371D073C0B9C5D2A69AE97130825B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4a719f120e6b94c021805ad53353739518971647fd602b9cc75e97431ec73729
MD5 85dd8daa3849c598319b4d7fad1d838d
SHA1 ceb897a717bc9a70d03905a30d1e45f7a3940783
SHA512 c9ed44bc1ea57ffbadd3b7cbbc77678ca5f9b33c08746b4e3b1722d721d8a0a2d12fdc1398bddefae81eaa6f29b6ce2264d2890c9478d8499e1838fb3caf4eb3
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWn6q8wyuXDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:E/ezSC6vUzPveHjyAXcsQJcsKEzQNpHj
TLSH
T128755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2fa82d8f35ee268c4cf9fc11204a28c55fae71d788bd21265f96297dc6623cb1
MD5 c51959d3522f87558c131a99c0a7468a
SHA1 92f1b49300d7c3a99a4fcc66025ae5218c800ee3
SHA512 e91b158fca93ad3e0e7362adf75aef255d5280b6aa3a1561f2e12a6b303f845ef5640a8a2889a4607229e292f221e24c82bd347e956c6ed4488bed622d50ec35
SSDEEP 24576:jVbqPb88hv/l+YiDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:jVO88hXl+HXcsQJcsKEzQNpHj
TLSH
T191559E65F5748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E67BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e2eba55c9554e5cdd18a3394c952c3a8fc609da8eb86460c6dbed9f1331d6707
MD5 cd084cedc5521cb5048055ba72bdc565
SHA1 3889b7438d9cc7a4e4dbe511a5464673682ffc22
SHA512 9aa7a097f6d90222a862d53fb2be162619abb27a0942ee2e3239574330e37568ed01e65ef74cffe67416636dd373094c7180cf14430ce7ec75c84711912ba665
SSDEEP 12288:+LhDUWGyAPMxPsSwHcenP7OtT0ZRKEzpmdu0U1iN4sJWy:+LhDUWXAPMxPsSQhnTcg3KEzIdNDN4sp
TLSH
T1B6C423A4DE4430EADECE483272EF6C718159DC58EC04EC826545B77ACF3CA35D86625B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 07242401d857127b20bee32f0820af9b410f70434857af893675553e44c03a16
MD5 c066c75af6bec239ffc921f91c148aae
SHA1 1af8af6c1acac1937d94d5e86105f2e7959f8538
SHA512 bae229f12fd88f0d65b1dbeba0d60e53afdee53cb3801954e9fd68c04d2f5ad04c25921c6b1fc579ef3359d3c053e21df1239e5e6a57c3d714e5c77cf0ac8d45
SSDEEP 24576:rJIU6DUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:rJIU6XcsQJcsKEzQNpHj
TLSH
T19605CF3BEE28FCE2C67E8DB956918600D77278304F21A3CBD165821EDE235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 585592005ce58dbc0a2c5841ed7543c197ff61691dcb40b077bf7c617fda8259
MD5 6229a28aca26676b6c8539dccae2843c
SHA1 bafc7ccd3ac0211d1a9970f5430ea49a09e70705
SHA512 87d8f03603c3e4704deffb12178f83ba85ed16739776c9ed29b70381855f29a481cd36eeac097e03e922af538623d0e332004f31e28b0ec6c5caa7ee52883b08
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THs:mQvGAdlCEL8c/DRNw5C0bcstu
TLSH
T187267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 b8aa25712ca43b3ed56950849431858a42e619cf444740de44c06608e3ea5fa9
MD5 d4e44e8e65d22b2b2182e4316b4e319f
SHA1 529dd76bef87039e4eb4a6089913e6ee986f4e1a
SHA512 73c6ecd398f199943e7cafc2f67e2376bc2a1fba7291ff4d7fa9f2c1c6d4e63455b82343794a2c2141379467c57b70ddd45ded902e339b08bebf5756da08926b
SSDEEP 24576:R0ewsAjEDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:qljsXcsQJcsKEzQNpHj
TLSH
T1C315E030FE74E036C6BF0DB21B76D716542DB9204F5119C3E3E88A9E9A342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 70d8ae8ad67d52a91b30c72d4049ddbbc38bbe10c970458ea341e9ea4c31517f
MD5 7fe744749fc4d481ee31f44196dfa4a8
SHA1 ab39b27c4cd69bc6bb6ef91de770679c13ff2da3
SHA512 54f7771d7e9558f9979fa9e9105a4b48c90dde2d574e5f51ec465bf5e3517eaddfe1cea9fbe6d673424dd22c9ab2e8428b8d0ac5f9bb13adc35868fce62a3361
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHN+:+UEtQevvqc2W1cpV2tI32N
TLSH
T129474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2efffb2c0ada884b87083ca8f2a9f2a484e0aead419f4638662cbcd4c574bd5a
MD5 f0cb0fb72df55d9b90ea74103af7ce82
SHA1 847816ea549728b78da7860e25e78dd225985fdb
SHA512 bf167ead96999097d3d48da5365dc3f23b854a81d02665dc268ad77257525514a9894511599e457525033f71d82a52f730bf0adc2630a8274b500a229209f4aa
SSDEEP 49152:+CbRquA/m2yL5zifFiV+XenmE3/zMXcsQJcsKEzQNpHj:zoqHVjnmobcstu
TLSH
T103D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9e287afb18509d9b3cc86b968491a0d5c47750aa090e9e5f80f96706c9bedbbe
MD5 29111d471841b22141ad82344071b4ba
SHA1 b0480ee0708710f66aab467ff687fa6af67ea6c4
SHA512 01ff6fa2163db7c10fbef6a4d10cbfe76704976c1f15c814ef12bdf736fa24b3886db42c8099e3170013f5d89d92a0fa4d23102247a20723a347f46deccf48df
SSDEEP 24576:ZAhGL3IFoiwtA5l7S53TDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:ZAMUFoiq5TXcsQJcsKEzQNpHj
TLSH
T18635AD80EBF955D4F5B3AA7899B69570EA76BCAA5E30C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 b26e08aa6323cb35d7146d5722d3a6e1275b76a29e44371cf8fa48a9919ca15e
MD5 7c83b185ee63aa1235bed0eaf24f7131
SHA1 165a87045ee3298fcf326662323828f8b92e9f20
SHA512 43bea6ac70ff419e534f48267e688efec7d96ffc20c808ff8db530f10c952b6f17c65684119840e9d0d88974492194a13b33f27c6ed8317b7d54926394717332
SSDEEP 24576:6wu4OWwDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:6wvOXXcsQJcsKEzQNpHj
TLSH
T16105F14976A41CF9E9A78539869BC532F3F2BC012A21DB1F1760C66B5F37321AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 fab65b9c3b4a791080da82ee5561cbb6563dce84b0f6e29936a6f99085076062
MD5 5ffa72d78e2495af9493d7b4d3ae5dea
SHA1 7717b119a10d7c0501e9670492696e379a609cdc
SHA512 c64cb358cb18f19867a7192cf1455c1be9d0659b4ad62b7c0060a067983a34e34346a783e140b310cc77f8e3b16060d7605db447ad983e7c1f308c05b2fd56ab
SSDEEP 12288:oeZ1IyUDUWGyAPMxPsSwHcenP7OtT0ZRKEzpmdu0U1iN4sJWy:5ZuFDUWXAPMxPsSQhnTcg3KEzIdNDN44
TLSH
T11EE4129837E430FAD59B413CD9FA5901D372BC626B3193CF2254827A5F36AE25D39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1cbe4eb16c5258fa50b00cd2560e7f22eaabd14b2feb0b860160a02901748832
MD5 92d4b329aa1eb682c4da3d109a099708
SHA1 abc8c7389b88d808b1c3727c847705ab0ec0afb8
SHA512 661d6393ed1aa9a0ce5ebf1ca0dc3ca798a1a02d77b0cac5ab0420f252e183c7ab20f0ad31cffb492e7281724dcd0c1a3285c120201319dc725618f26e553062
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UI:qQRQyi36YOcPbLvw2gAf+PN33bcstu
TLSH
T183667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ede372f7ba77da1b8cf20dc9337463482b7595a5a58a2681d5782f72da1e9145
MD5 5076aaa13f686a9ce39795f47900cdb3
SHA1 5c157c06b39668c95cab3ea707bbc2d2a5bcc312
SHA512 5fdb2068f262e1ce5ab7e31eb99e0f96eb2fb34dff1cf2d2787199397919fb1c1f1cf559b608257cb9abf1146e0d704572a5bc86d7e6769c446cd63f19b3cb5e
SSDEEP 49152:D68Qg55nhceWu7PNU3/8XcsQJcsKEzQNpHj:9thLRc/Vbcstu
TLSH
T153B54933B2F600A9C44DE1769F4A973196D27C758FE0E3DB850172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7c39b32fd76ade2566bef171ab8eee02b48a548d285e806050bdeb3368dcfa9d
MD5 603cea6f99f08eaf41fa4ad3261b5b62
SHA1 97f3865da25c5fccbcd580adbfb47d45486ab46c
SHA512 8c6d0e4245988f03671d794b5466d30f7e8789e94c2e5fce108ffc3f821a6a70e05bdccc0b0173ce57903ec235a0041dcc9a17d3eb618187c87286a3b22b41af
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99S:py5112gYy5azzVvt69nLKnhZmbcstu
TLSH
T143167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 97073550412f2ad8165f405ac1154600ecff7d2352664c2773a9b5ea76268942
MD5 bd49ba6ec7db909bbb3fcc5b92e254a8
SHA1 dc0db9e8053a0f375ca345f54650de3d57c13c40
SHA512 a40a6d9f2b0fa95562b40f2a8ae03db922179013ecbb010766357a0dd5d2cf7779fdd7cea36542fe0d0133e6be1cdcedea69bfb2d53e32c71b2a1cb12392f502
SSDEEP 49152:tB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glWXcsQJcsKEzQNpHj:zu6Jmdxd2dPbcstu
TLSH
T1F5D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 dbba467a0244bdc389229b1725b247f5a86a30fb7dd2b395bdc4ac251077368b
MD5 af2f414e41b98a47bf8b4713d641cf85
SHA1 5245d81cccde1fbb6d5a5ef151d432f9a0de2bbb
SHA512 91881ac2ba7ef9bd4132990b4eb490001cf66c38e995fba3b19b1f7569b21372572d5735b6b6639aab96e2cbefb9721c02234ae9100eac0ccab29186ffb44aa8
SSDEEP 24576:qcP4mcvIjkGOxhKP2l71SNKbrh/8KB9DUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:1P4m4IpOO67N8KPXcsQJcsKEzQNpHj
TLSH
T11365BE2DABDC0096D0BB913885658A49FAB1742A2F3286CB1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 a3aa49d35bba32557c8641a1d77a392154988c3c172221e29d8112258578001b
MD5 1a57d75cbeeefe6ac855ccd7dfacdb9b
SHA1 52e742647473e617ebb72dbd7892cd9693cceecc
SHA512 3a7aadcb349d5aaf9216f7199e6e810534a0634267aae932ebd7e55228187d8ed53a811a311a7e89b8065b10e467ec415132a17adaa2b4029b478be419e51775
SSDEEP 12288:hbsfFDUWGyAPMxPsSwHcenP7OtT0ZRKEzpmdu0U1iN4sJWy:8FDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj
TLSH
T151E40119D29812E8C0AE5135C79A5A41F3377C259BE1E3CB62C0F53E1F396A09DEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1604_488473_Th7RL2OIcjQ\_bz2.pyd
Size 84KB
SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
MD5 cf64abae18a5ce2c95b8e894fa5cfdc3
SHA1 76d87bef339e31af803a1a930b33a3e5dbc1c0cf
SHA512 7c4787b7cda291f49ce1bf9e1716ec5d50ae42a84425136c75c155c6fddbea00bc2900c6779f88f8d4cc47c0ed61f5f6c1caa433e660f0b8e5cb78e449ef35cf
SSDEEP 1536:NeFNPz7faNtxDCkrp43zOB2YHClj9l8sEsHiuP5IFLVAy1Ni9lfIL0qAO:4FVzzaww2DOsl9KsXCK5IFLV9dAO
TLSH
T1A4836D43B77461F6F9AF81B496810353F730BE960710A3AFB25482993F13B91EE68359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1604_488473_Th7RL2OIcjQ\_ctypes.pyd
Size 131KB
SHA256 75687620596877b0dde462e74ae12140d695b3c78df3c6c099d55717768dde42
MD5 744a8886e7187cb632da61e2d48ebafa
SHA1 e105fe498617813f2d34e578d48b82e23e56a972
SHA512 a362fc3eee1a7f71d9b82dc3b6b268e1d3115d20733b40e3891ab04469f9f8fbb1f6ee07d6a92a78cba82c7c53101bfde13c99f9a3feffa5430b94791ecae30c
SSDEEP 3072:/uZHKSoKYGYzZkdf/F2zy4PK8fUSlIFyPAT0:moZAf/F2zyIK+USC0
TLSH
T10DD37D0B736800AADAA79178C533AF47EFB1B453161057CF02A4C59A2F63B926E7F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1604_488473_Th7RL2OIcjQ\_hashlib.pyd
Size 67KB
SHA256 5eb4a2aa9e28b49cb2a4f6ecee21f3c2b629b43a0709bad1d7e6204bac74eac2
MD5 648a300c9deda89218f23faacd7b0d17
SHA1 fd5fda7807cbfbaa23d052fcd8140d7ff4e98ff6
SHA512 27a8dc1dc1dad7aeed93912b9544760a984e5e3da0014fce1b66170079992cfea36c18212024982336d415ddb17db114ca0c45c85dabf7218b9467bed2d3fe6d
SSDEEP 1536:XMqXn1yAu1lEAXfXhfcV5TaSZ6CAxIFvIdy1Ni9/kfIbH5OnM:B1w1uAJfcySZ6CAxIFvIFNT5Z
TLSH
T152637C95A6494092E92382B5C4A34F83F9B1F3521711ABDFA2A8C18D2F237C38777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1604_488473_Th7RL2OIcjQ\_lzma.pyd
Size 155KB
SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
MD5 a6bd469ef44eb08284a417fd5aaa4096
SHA1 ca65c9e0ee9bfdd3e8abbe46eb78b6bba1d657a4
SHA512 85198fbfcf517a3da03e897333dc5af4deb3c8eceee61e172a3effe7e6f79de9c76e029049bd727aa782ac018feebcabef73804df9270c49a1b6e411f149cd59
SSDEEP 3072:vK1fxTOfpRnifp5/eNRFAznf59mNomURj5IF01SL5E:v6JTOjKsHWhYOXjQFE
TLSH
T17CF35B86B794F0E5F3328C38D6624F57E6F5795A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1604_488473_Th7RL2OIcjQ\libcrypto-3.dll
Size 5.0MB
SHA256 09499e186cf0e434ffa17ad153aa9a66d6048c54a2c03b823e2a06c49d9affe4
MD5 6d0a1af0e9a539a749dd50add9c4c27b
SHA1 e484df936d4c1072f6aaa287ef41fe8ed238e87b
SHA512 485c01182e838488c93cdc6d526d5f568b52101ac49a5739461fb3480ec490110a50695f53f60079431c940880a3c049fdac8e562bb00e0930578b2cb947d5e4
SSDEEP 98304:uAH+4va7N1rRtynkJj2uSFPzy1CPwDvt3uFlDC/R:uuVv+1rRkMj2uSF21CPwDvt3uFlDC/R
TLSH
T111367B6AA7A80189E4BAC13CC9534617D2B1F85A57B097CF18A156BD0F37FCA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1604_488473_Th7RL2OIcjQ\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1604_488473_Th7RL2OIcjQ\python313.dll
Size 5.8MB
SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
MD5 b0f3aa8a9fc7462f25b1f48f3174dfa5
SHA1 63243edfcf789b5fb9370e5baa27e9a07ba3ebaa
SHA512 07b83bd20ff501f4753273684e4e539a5722dd0eb2689c045665da12e5a1b0950c70ba9c8e4dd99be72057b9311ed4199b643639b8f49f1cba8c41c8c29bc57e
SSDEEP 49152:kYxOb4yPiEMqTGnJwYE2M8SMW+IC1f37M2nGyN7yd5va4ifhSBqVX0Yy13KR/x1n:gPzKWIHosdoBcqbei8I0CSvNHDMiEnsj
TLSH
T15D567C16729E40ACD97B8078CA17864BFBB27C013E60534B61E6BB5D2FB3362476E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1604_488473_Th7RL2OIcjQ\vcruntime140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 b93f073e262a20f23bae10ed7b8bc86c9b5b739a3fad9c812b0559877c81f718
MD5 f22029eee93fada145000a1bd9ffe801
SHA1 dfdfbd2a48008388db2208f46ee689c9aa76a154
SHA512 c0e469014cd63566229ab2012ab9829f512895f8020d49c7b358beb0174fa329b1f085e076d99b0af3a62a0d0cce2277a8dec4e54a99e2f7d800949a207455bd
SSDEEP 12288:elDUWGyAPMxPsSwHcenP7OtT0ZRKEzpmdu0U1iN4sJWy:elDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj
TLSH
T1CDD42364DE5871DBD9AE483162EEAC30511EFC68ED00E8C3B545A27ADB38A719C3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 07dafb41cfac60e032113fdcddb27787ca97a08ca455b5259690a299d650c24a
MD5 568cbfd43f9db0722cc34d162e92909a
SHA1 769efc4e1533bb1165f59160bf87bd54a291750d
SHA512 8956a09c264074409230f1943a2e5482d3c2005eef26a4ab8bc31242ed47d9119daf96d19dea2b530ca0a3932d6b9cf4937190452cdc139133a7f32d96530765
SSDEEP 49152:6a0h2GEkuAe73q3pp46zwwQLXcsQJcsKEzQNpHj:6a0hNYG4JwNbcstu
TLSH
T13085AF1E67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 e60ec95d8208c782d356ad480acbe02e15ba8a815549b4e26bf479c0fed7a18e
MD5 a01afa5280decfde8197b6058d3367d6
SHA1 b4ed6db687b5b7dcbd36830ed08c5ceae6e5a0e9
SHA512 2c81b18db643bea4cc8c3e1dd319af69eff03f428f0418403db288c872f7dcb06a16430f04341de57c8a843f2dfb714e1aa5b0aa02efdbaed2cdc22f9c7f5d1b
SSDEEP 12288:GhbHjfXIDUWGyAPMxPsSwHcenP7OtT0ZRKEzpmdu0U1iN4sJWy:GhbHjPIDUWXAPMxPsSQhnTcg3KEzIdNp
TLSH
T16CE4127D1AAC20D9E576917D96968906C331FC252B11A3EF22C1827E4F3BEF45C35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 e5457305d2dacdaee15eb0b63445fc77219278c30139e930698bafe1af2080a7
MD5 c01a1b1fbc7d81e85a37e475973b97b0
SHA1 7afd0492ecc5d12e3b1abdae2642d52f2cedcf59
SHA512 21478e67093580b106ad10f5213f3c7bc38e1bd3ac7f20d219f9fe783214fa08a5b30b2083e9dc665111d189bb65ff40b2517c5d31757fb70ad83d300edb6a01
SSDEEP 24576:Z3YgnJcRTk4yti+R5dpR/wDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:ZIgnaTk46ppR/gXcsQJcsKEzQNpHj
TLSH
T1FD45BF2DF2B910F9C8AAD136454147B5FB71782D1F209ACB0170C538AF1AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 bf79f8d96a4df990087f7026a42a59e7802da34d1ff1c6674b61ee1a55da0c4e
MD5 0648dbc522164894b6cadca204dabe9c
SHA1 a1b3390848607a47aba8918662ffacb87e003f87
SHA512 7347b3fd056c14654132631c3b0092496125354ea65005a003be5dc3825b2c15129d60a242ebdd193c8490e6da4efdb984dd9b9dbc702078c15459ba9972118a
SSDEEP 12288:PBDUWGyAPMxPsSwHcenP7OtT0ZRKEzpmdu0U1iN4sJWy:PBDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj
TLSH
T1CCC423A4DE4871DEC98E487562EF6C314119EC14FF11A8C37489E27ADF38AF69C3125A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 6e4981afd96533979033128225e2aa249045d5d15281cbda2f1edf773943ae34
MD5 25f934982b709891f23ccfb83c14d184
SHA1 5b43afc45f0b870fd4414a95dde56d42de524551
SHA512 41ad790e8e865d7c516d56f2a451156579d2c3130de9d88c710916ea14d65b4ea5754e9132930d387ee5277d25dd119c6687e2179185c2c86d0c844d928ce541
SSDEEP 24576:+bL3UTODUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:+bL3U6XcsQJcsKEzQNpHj
TLSH
T115250154FB9410F9E96B813CC9A69912D272B85D0724E7DF03A88B661F237F24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 e4dda24ce84837957b54c0bcd9827dabf4edb28d3a045eba07109d564f29e70d
MD5 3e4be5863e1dc2dfb2090e6dfa961286
SHA1 dd5d336ded2f6b594ddddedf1f64c22bbe0a596e
SHA512 1f9d583e78b9cf273fe0e9ff7d83ad35cf2648ff9764943191aa30c722be61d2343dfc61f00c4c86aebf59b00542bf8191f4bffe195ca1a91d568a77ccb7cfc8
SSDEEP 12288:rpFtIOaDUWGyAPMxPsSwHcenP7OtT0ZRKEzpmdu0U1iN4sJWy:+OaDUWXAPMxPsSQhnTcg3KEzIdNDN4sp
TLSH
T12AE412283AEC20E9D47AA13D86974609D371B8651B2267DF02D0817E4F77FF86C3A752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bc7c0b3bff50c347d87af5ca3eda347391147076349e415a146db1ca801deafb
MD5 69a4b571e6436090db79aad1dcc1de72
SHA1 c874836ddc5533d7b48fdcf4c47f3654a9ef757a
SHA512 69ba77f3a162c9845ece0934335ad15dffa3b51f90916bd1266ffb897fb3c7249cb9fd7ae270179b792a6bf1217edbb4f85e4b7d18e8d1219267c1e3aa921df7
SSDEEP 24576:N7NM9YmZqmWMUkPjZM48Mv6bEhsVDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:N7cBWMpPjN8DbEh4XcsQJcsKEzQNpHj
TLSH
T181659E2E6BAC81E5D577D13DC9E28606F2B2B4611B318ACB1152833E6F37AF44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 09c06174c3824232bda432c840b68622a4097c2dbf3d1773d0c0507799a8ea55
MD5 07c705c7236a55b57cc622e4424df578
SHA1 a34a4182748a0c59bf0455b8e11b6d2780c1dd8e
SHA512 ae95669116b5ca2c930325e33854002dc5bd8e160d52d20a296db96fa43f56190e0753c79c1c274d417b731ec3a990874532adc0d6c47f7edba2688f798945a4
SSDEEP 49152:FF2YuHNETovcvNYf8kmlXcsQJcsKEzQNpHjW:g6tCf8kDbcstu
TLSH
T14F858E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1de8b067e9f37fc8214e61c0bf7b9d2fae69f83f51adab21d9a057cf502f818c
MD5 b8fc0dfd04db7c083ac06165bc6f1ba4
SHA1 e593171938a244e7d506862ba49f145e718c1183
SHA512 d979cc99715a6c4a4f1ce9ad6e70057c2a7f094755e859bd298239018520c13f48fcf1270072edbe01bb38406c1cacbffe56d91fe59ce8bf940ac74b00858705
SSDEEP 24576:eAFs06+OmlfkNXEbToGDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:XFs060lwXurXcsQJcsKEzQNpHj
TLSH
T1BD65AF2F66AC00D5D07ED17D8A97C91AF2B1746307256ACB0160863E7F6BEF85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 952c0ff8c4fa8185f614315c7028f4a86cd975b3e1261c83ffa9b8c6c17dec60
MD5 92bb9b28fb7c51bc6541d5ad3a5f0b52
SHA1 96dc678b3183ea79545cd5e8e7ee9ef9f7cf4c70
SHA512 a205dc846406d62f670aea4cf77694d0b5886b60c377a970b43e5571b5cdb708de29c03cf8413b5eff10595d07c2b39c5b0c2b8ddeb5a8a65b3e74d48e20b8de
SSDEEP 24576:hJnJ5D3WtbDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:hJnJ5DGtrXcsQJcsKEzQNpHj
TLSH
T14D15D02CD2A810E8D4B7C274819A1B56FE72387D2F2269C724B4D5357F22FE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0bce1a83bc993729c8915d671f2ca4d443411287e68337c8af948698e3cccdf3
MD5 3c57aca58dcb4cb2162acb676d8f0b4a
SHA1 5135d22e2f0eb124399477bd926be6f774df1f44
SHA512 3751bb2f10d21377d10f6a7339c2e4d07e908e53fb5ddf83263033bbb89cbecb050b09ad48590d5fb6593ac2a59352d7e3280e45b640aef3148ac96e6eb562ab
SSDEEP 49152:7o06DIKdwc+eQnSt65aVhXcsQJcsKEzQNpHj:UMbcstu
TLSH
T19D956C15B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 991c40e50907a55999dc70df394a2aa3fee58891e28bf4847bf42b52b2d3cad0
MD5 11e0ebfa7dc981585f2b5055abf426fd
SHA1 5736111c861ae062da31ac52593eb5a4cee6e753
SHA512 f9ee46caccd8d2e005e129744ef8ed29f32ac68302e20968e6c867f3be91a84c2bcdafe200b61b6e0610a64379830f6b3e0d59d0087b741158d3c1ef9b5c47d7
SSDEEP 12288:5EP3Rr3DUWGyAPMxPsSwHcenP7OtT0ZRKEzpmdu0U1iN4sJWy:Kr3DUWXAPMxPsSQhnTcg3KEzIdNDN4sp
TLSH
T116E4126C6B9C70E9C56A903D91A68905C372F4746F1267EF2291C23E8F37AF91D39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 5a18d99fbd752d0ada408c1c8fa67ad02b960c61da10cf5e7ffdacf69825dc60
MD5 a2c318cdb8a0b60e312efe9cdb4633d5
SHA1 3415f9783ca42bdcd7bc2e550990ff50049eadcc
SHA512 b29c8e77f683b6e1407e5ff67655a37f2d679d3fce9d361b9fdb79fc14a26f47e039e4e7cf95ea8a56ae6624192a02d0992e76f6afc9dd3d523319df7915a56e
SSDEEP 12288:3jkyYDUWGyAPMxPsSwHcenP7OtT0ZRKEzpmdu0U1iN4sJWy:3IyYDUWXAPMxPsSQhnTcg3KEzIdNDN44
TLSH
T1F4F41204679870D9D9BA453896B745A08635FC20AF21A6DF6080F33FAF36BF4AC31716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 18c8067619c89f9b4d9b4980c505c96572a9e3e48b4138865f0321dca4528c7c
MD5 4d5f86e97f673238d55c28e374c0c364
SHA1 61af93bc3db2b94c25935b3c2a0ef29399f2fac8
SHA512 6c2753cc03895817b091b957e7d1d559754d34451898fe2f5fafcbdd81a8d0dd96f1e6aaccf230ccc224c3e400099673176610c18aaa9bfa7a9bd11385e5de1a
SSDEEP 12288:TFqDUWGyAPMxPsSwHcenP7OtT0ZRKEzpmdu0U1iN4sJWy:hqDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj
TLSH
T1A6D4236C9A5430DECD4A487562EF6C618165FC38BF1078E734C4E276CF38AF6583268A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 b53b76d86b5e7b6ed19b434a458345267c666cef7855f9491fff67285701b34d
MD5 11aceb629d348e2f5b816d6d39ebf6ea
SHA1 63d0a27efc7d4fcc92b8fe8810439c50442f066d
SHA512 370124021d16ef426d33ba090889649e651be10ba762ccb8957c83af87683859ae88a6a3abc3b0be671a690ea6019c4b7e130fe53c5bc24b1fb5a31b4011594d
SSDEEP 24576:YQ9MxZKdcz97w3tDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:YVKX9XcsQJcsKEzQNpHj
TLSH
T160558D2DABE915DAE177D23595A250C3A633B4301B31D6CF2448D03D4E7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 9e7423ccfe7af4f07ab1eefdb10aada43c69130f330c080c5d4bab6d370404fc
MD5 76305a107cb7e4d45ca8cb86d0328c06
SHA1 feea65c4ea3715051ffca12dba7971913c38945a
SHA512 d91b8d3a41b0535d68593c333c025c1259ae108f9bd5d34831f7876070934ca5b28c0ea7ba3464914fa7b8943c7280bc0197c0a659b247e19d17ae2ee417b85f
SSDEEP 24576:ZyocxApEDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:0ocxApsXcsQJcsKEzQNpHj
TLSH
T118F4E01FBB6940E2E166813C89858645E373B4305F2267CB6591C33E8F37AE9BD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e1dfeb698c5429c5287bf598eec94c07d1dfc6576ff5df12b5206b7818cfb6cc
MD5 5beab0c595b36cc528a4c16393978368
SHA1 947168afbe9142eaddb0d40f8ac7512b1ce371e6
SHA512 a7089f537f1f217314c52117bb3844e973cea6c5385746e37f6443392c350a5fd49a78a1c642d118e0386c2582b01ad90115b9c152e5890e22e2bce65fc87582
SSDEEP 49152:zWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKsXcsQJcsKEzQNpHj:z0zuNI5bcstu
TLSH
T179A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bd7773874c2908af9c0bde1339e15af8a900ad9225dfe214fab0a8c25b559625
MD5 f5cc292453e071cf41f009f167b9a6ae
SHA1 397deab1d000549ab2c307fa21b6d613372088ee
SHA512 2e3c98a389a4cc90225f9f3208fbcdbcf6640b391c89a3e77f7b4c000a6eff4ce8ca8473d720ca2f73b1b3980747709d3e2f80c06a019440e523862d0c8341c5
SSDEEP 24576:11QT7EcpfxR+N5AWAz3ooiYujMqb3DUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:wTDxR+N5YzT4jM6XcsQJcsKEzQNpHj
TLSH
T1D855B02EA7F815E9D17E85799A23C512FA727821073193CB42A0C17E1F3B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 54db62bc81b79281249dfd5ea6ccd954eab55a361192fb68ed04bb9b0adc71bc
MD5 8bba7f98afd9d92ac30de44279926d56
SHA1 dde15efe14e5bad523c2d4eaa7b9397fac5e7409
SHA512 14a3c415ae5f4f5cda520caa8f3866e4cc4155fc979b563bece7d57f16c4bbb2c1d3317fb689270a36cfcdea071988b6fa393eeb380ab4adc70771535a1f4561
SSDEEP 24576:bTMdOz0FFS+bmSLzDUWXAPMxPsSQhnTcg3KEzIdNDN4sJj:J0K+bmSLjXcsQJcsKEzQNpHj
TLSH
T1DA15F13EA76D14E5E47BC17CD6538D06E67278610322AADB06D0C17A2F6BFE43939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 b33caee9d8360d666767c034ecf755bae77bc7cd233b0bf195a30e44cea9b527
MD5 9716915008f29e95416ac6141cf65880
SHA1 6f687089f7e3054db65926f513668e7bc52e4a1f
SHA512 0d87b3a66962c2de9a524aa74c32a146ca79d1d6a35a61a3bca64462a9d36992e5eb1e0f39be6e50a85fbd230ffe1a3e34227b5786da11ff18f0eccf8cb1f17b
SSDEEP 12288:z47ODUWGyAPMxPsSwHcenP7OtT0ZRKEzpmdu0U1iN4sJWy:WODUWXAPMxPsSQhnTcg3KEzIdNDN4sJj
TLSH
T1ACD4121C67E830D9E8A6953597BB15218230FC356B206AFF35D0C67E8F36AF49839712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-89-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/204-95-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/312-215-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/312-221-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/436-532-0x00000000014C0000-0x0000000001520000-memory.dmp

Download

memory/436-470-0x00000000014C0000-0x0000000001520000-memory.dmp

Download

memory/436-464-0x00000000014C0000-0x0000000001520000-memory.dmp

Download

memory/1156-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1156-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1208-152-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1208-158-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1368-43-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1368-49-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1448-121-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1448-127-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1604-590-0x0000000004D30000-0x0000000004D90000-memory.dmp

Download

memory/1604-0-0x0000000004D30000-0x0000000004D90000-memory.dmp

Download

memory/1604-6-0x0000000004D30000-0x0000000004D90000-memory.dmp

Download

memory/1848-71-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1848-75-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/1848-65-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2012-231-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2012-225-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2024-148-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2024-142-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/2404-192-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/2404-189-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/2404-183-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/2420-163-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/2420-169-0x0000000000DD0000-0x0000000000E30000-memory.dmp

Download

memory/2756-84-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2932-108-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/2932-102-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3264-268-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/3264-525-0x000000000D230000-0x000000000D238000-memory.dmp

Download

memory/3264-242-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3264-285-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/3264-252-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/3312-29-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3312-23-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/3404-11-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3404-17-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3536-623-0x00000188A9610000-0x00000188A9620000-memory.dmp

Download

memory/3536-622-0x00000188A9610000-0x00000188A9620000-memory.dmp

Download

memory/3536-619-0x00000188A9610000-0x00000188A9620000-memory.dmp

Download

memory/3536-620-0x00000188A9610000-0x00000188A9620000-memory.dmp

Download

memory/3536-621-0x00000188A9610000-0x00000188A9620000-memory.dmp

Download

memory/3536-618-0x00000188A9610000-0x00000188A9620000-memory.dmp

Download

memory/3536-617-0x00000188A9610000-0x00000188A9620000-memory.dmp

Download

memory/3536-616-0x00000188A9610000-0x00000188A9620000-memory.dmp

Download

memory/3536-610-0x00000188A5D90000-0x00000188A7C67000-memory.dmp

Download

memory/3556-173-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3556-179-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3816-112-0x0000000000570000-0x00000000005D7000-memory.dmp

Download

memory/3816-117-0x0000000000570000-0x00000000005D7000-memory.dmp

Download

memory/4396-33-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/4396-39-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/4396-61-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/4700-211-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4724-523-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4724-131-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4724-137-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4928-201-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4928-195-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download