0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
Size 6.5MB
Sample261003-p4ymasyfpc
SHA256 0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a
MD5 830d4e7b20ba24709f4ccdf2742bf918
SHA1 389bf0def43624f61b6aef52870e27ece40b48c4
SHA512 d534a2577dea1d610e995bdb0df75e555345a993e1218dea687a1fcde67894171fdc6b94ae9f9e6730fa2e6fb12649a348d7defee68c4cdc2da1fcdf74fc8045
SSDEEP 49152:QlThQZ+7sQMkN5AMYT6sWYXb/ShLeLU1J59mmCmpePUQAJMXQbLjw+aNJSDC2KKD:3nDc9sWvmQJsJNZxms226kYRIgwkqBS
TLSH
T16F666A03F29A01D9D059D178DB5A9232EB71BC494BB162EF2A5077D12E76EE0BB3C710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1336	alg.exe
4364	DiagnosticsHub.StandardCollector.Service.exe
1600	fxssvc.exe
4308	elevation_service.exe
3028	elevation_service.exe
4304	maintenanceservice.exe
2304	msdtc.exe
3048	OSE.EXE
796	PerceptionSimulationService.exe
3432	perfhost.exe
2932	locator.exe
5056	SensorDataService.exe
1048	snmptrap.exe
4100	spectrum.exe
2012	ssh-agent.exe
1564	TieringEngineService.exe
1828	AgentService.exe
2076	vds.exe
3500	vssvc.exe
4356	wbengine.exe
4636	WmiApSrv.exe
4796	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
\??\F:\	alg.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\System32\vds.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\System32\msdtc.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\vssvc.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\msiexec.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\spectrum.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8245512b5ef7726b.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\AgentService.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c510843d3653dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1bfb33d3653dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000048d5883d3653dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000992e0a403653dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af8f853e3653dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a7fda3f3653dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f591ed3f3653dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3740d3f3653dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000058a3c3d3653dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005059b3e3653dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0d6693d3653dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068e97c3d3653dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4380	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
Token: SeTakeOwnershipPrivilege	2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
Token: SeAuditPrivilege	1600	fxssvc.exe
Token: SeRestorePrivilege	1564	TieringEngineService.exe
Token: SeManageVolumePrivilege	1564	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1828	AgentService.exe
Token: SeBackupPrivilege	3500	vssvc.exe
Token: SeRestorePrivilege	3500	vssvc.exe
Token: SeAuditPrivilege	3500	vssvc.exe
Token: SeBackupPrivilege	4356	wbengine.exe
Token: SeRestorePrivilege	4356	wbengine.exe
Token: SeSecurityPrivilege	4356	wbengine.exe
Token: 33	4796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4796	SearchIndexer.exe
Token: SeDebugPrivilege	2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
Token: SeDebugPrivilege	2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
Token: SeDebugPrivilege	2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
Token: SeDebugPrivilege	2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
Token: SeDebugPrivilege	2528	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
Token: SeDebugPrivilege	1336	alg.exe
Token: SeDebugPrivilege	1336	alg.exe
Token: SeDebugPrivilege	1336	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2528	4380	0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe	87
PID 4796 wrote to memory of 880	4796	SearchIndexer.exe	113
PID 4796 wrote to memory of 448	4796	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
"C:\Users\Admin\AppData\Local\Temp\0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe"
1⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe
  C:\Users\Admin\AppData\Local\Temp\0a0aaf6368f6b73f0e17f23f61bd987ad2849917fdc9e28b998742b4d3957a0a.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=124.0.5705.89 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x1405b0e38,0x1405b0e44,0x1405b0e50
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2528

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3728

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3028

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4304

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2304

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:796

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3432

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2932

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5056

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1048

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4100

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2012

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2752

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2076

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4636

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:880
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 81b41c05efcd83e2d79bdbbc938129b18349b28af714f7b9c4d3549c9f96ea98
MD5 5545e7a113f664e8ad789b1ba11350ab
SHA1 a84a2a4f44c14cd536fe5d6d0f4cd39802cd624a
SHA512 933c7895618476ff46c2b19a7ea8673eedc7b53984615cf33519fb1b84d2811da3aa29f86e87524231ba6c7ba072fd1fbd1a2cfd6eed393e18c83ab771011ee6
SSDEEP 49152:wb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnJkf4GtqhBS:a3q6mjBkkqBS
TLSH
T1CDD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 0e394cad7975c3ddfaed775cb2052e60ef1a2e1a1fb5afe49ac0cb3b6d15bb21
MD5 f5842689d61bd2b6601a0dc4826ccc6c
SHA1 d531c6b2b3894154c54377705a3cf2096e8371da
SHA512 70b629e7211b46c91072ee8e284740c7b6d6f9770aa53e3c230492862608d7d31d2d76fe35efadaf5dfe07a7391743bd219137a1352fc0d8bbb6677be7f55190
SSDEEP 24576:QXYfDtczAT4qgQhL9lZ30Yf4Dytqh/vRSNXGWQ:ntcDkf4GtqhBS
TLSH
T1F105022877E009F9ED67813CC8A28511E6737C918760EBDB03A4AA651F337D85E3DB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 3edc7ae3e3e31d61fb2b3cddb329a37e323ed9358d7491c49802b905db647180
MD5 8ee9ae79f42b9817f3bcfa2e2856ba94
SHA1 d37a7e6f94b846ffcf0fd7ed573dc7cbd5ad269d
SHA512 e1dd2ad7abe3132eb3835c8e546b2584b8b6c4e6269c025e4c7eb42f43ce024d6f7d4ef5a785603d195a2ea60da9bf8811ca288fdb2ef617dcf282e652c1f995
SSDEEP 24576:R0Le5ji0hmxhrMq4qgQhL9lZ30Yf4Dytqh/vRSNXGWS:RPji0Azekf4GtqhBS
TLSH
T100359E16F6748331D073C0B9C5D2A69EE97134825B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c56487a74c1df2f5dfcf54ea5158f4cff4fb52a13492acce64119072d8334dc5
MD5 8ce073c92e11e2c53d488e826b368e67
SHA1 d0c8d4d8321820bb7a0108cf1b7fac7508152d7f
SHA512 a0121d3f7c7ce15b5d9bf5c6e69705540b4acb06235c37ffd7105a4838ba66e5c41d5425805c1de04174e3c6bc2090a9bb54b31067f2d3317665233826dada11
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWj6q8wyuw4qgQhL9lZ30Yf4Dytqh/vRSNXGWG:H/ezSC6vUzPv+HjySkf4GtqhBS
TLSH
T16A755C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6856e00f739fd8125f6a8deb519ff3ac05316a0493ab056893c5634d31908c0b
MD5 0e833e12014921b62fdcb11370b34ecb
SHA1 7b7da1a91864d29e54501e946b52bc5089922c30
SHA512 6b24a834719fed2452ffe3d77d3f5c24f6c610bffb63d0efa2085d727eb0ecfdd9ca9c36e26e533368fc53944b0a4719062061418249a87654bdda9a623115e3
SSDEEP 24576:/VbqPb88hv/l+BH4qgQhL9lZ30Yf4Dytqh/vRSNXGWO:/VO88hXl++kf4GtqhBS
TLSH
T14E559E66F5B48321D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E777D5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 b79b9d1ee66a54aec07d4d4824c3d55f7440704edd109d396eadcd178b0d26f0
MD5 fc1fb72db83eef4ada19f1b7408a5bc3
SHA1 4cabb81bab5098bcdecd4a2af45542af4e2462e6
SHA512 988d0081493dc0a6ba4d7fe15a773d08f47cd8e36aeb3610e6e36e8ac2dccae3f7207f672f42a4d039fdd6b822d42853f6503bc165554195a65cc738d25dbd65
SSDEEP 12288:UGu4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAa4:UGu4qgQhL9lZ30Yf4Dytqh/vRSNXGWT
TLSH
T159C4230A9EF10542FA7B5235B0D9759570E47DD3D9A01EE32111FBC8693CA98EF2C82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 92f83d9f63828faad98c906b0556b4a1e99cec70ad2e54545e7ab54943c015d0
MD5 92b86d53cf511591432a2e94cd56d69b
SHA1 ddb111462443da3efa1cac41e9a89fdc66841a6d
SHA512 03cd331878f058a34e8d5c58027e789ea986ec4e1631e3c2673a2793f58e955c8b739a2f07c082020429ac3471abb0e398471dd97c92fa2e39db6bf29f396add
SSDEEP 24576:TJIU/4qgQhL9lZ30Yf4Dytqh/vRSNXGW4:TJIUMkf4GtqhBS
TLSH
T1CA05CF3BAE68FCD2C27A8D7856918200E7B278718F6197CBD165830EDE335E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 402fb4e0a407657b6dee988e05e35300b0a49b24439413e336632f8520b92234
MD5 24b992b684799e95a6fa52d8ccedd446
SHA1 8c56b85ebfa90baee50e1c79d163daa4ca262354
SHA512 639e40d9973b327b4415c2d90ee66b0c653de3618df27e31564ec0294b6afdb8303a77dad1efc48d54bf91b810bcf3f5246cf651434c37c45dc85d9f786b5cc6
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THV:bQvGAdlCEL8c/WRNw5CjkqBS
TLSH
T166266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 99032b37459f16230f509974607fc5211195da59ab5f22f9e06d81e85d6a757d
MD5 ef607890e8e655b32ac7479874b82113
SHA1 e5b0089fc1190a319ea455807ac8b5f8d6cf1027
SHA512 1f92f586d2ac1a6560321d045492c5597c2b565f19ff76300cf8380df0048b4074d432cb5ff8fd99a5fe3aeecd3b32b977eef0229a7ef7dfb72f5dd2e85d1f99
SSDEEP 24576:nfewsAjt4qgQhL9lZ30Yf4Dytqh/vRSNXGWA:fljukf4GtqhBS
TLSH
T13015E031FEB0D032C67B0DB62B26D716247C7D604B611AC3E3A89E8D59342D2677AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 69ea83e670d221579ab6979a8f823b554ef965c23b03cc9c9369ef3e9a41dfd8
MD5 9285ce02a92b0e12ac211068d5a7f393
SHA1 5ed019efd3dbd9558bf18bd01d59c22adf783cce
SHA512 aebdc4a798d126ff21cdfee4aeb9b96d3b0f79bdddce5b6a1e4420888c9646bc297c73e9538323110e322ab8e49c1936e6042620aabde2ea37c59d060513c903
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHwS:AUEtQevvqc2W1cpV20I32wS
TLSH
T1EC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1e578ff392c88786a3d511a44179b42df5f6a2a617d33b742b5154a7ca539862
MD5 00b76d233f0db2c1b4c47a6b4d0a6070
SHA1 05bebdebca0396ad8b6e1c955cbd714053bf15e0
SHA512 35b122a9e7e8cc130b498918f8f2713dbd8cbfc1730815478277328f047463b5d1bcdb8043f0513fcb017e411aa39381edc26598625e5bd5d4a458555406d244
SSDEEP 49152:cCbRquA/m2yL5zTfFiV+XenmE3/zOkf4GtqhBS:VoquVjnm3kqBS
TLSH
T1F4D58D0976B8C1E4D1F6C77896A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 23e7c9aadcaa0444bedcc467c48bec5cb8caa1a99d2c19249920d101e30843ef
MD5 921e74adfa2e9e3f032d543b5e17392d
SHA1 f101e0a0239b4156583b2afffbc99d202a92af0a
SHA512 e0526fca87481b32cdf4eed9b6b6fe2c927aef0d40304962b49807043c21d2a04d2298b49672258f68649cfab200daef5c1b6d7b194d54e8816a5892a09ee381
SSDEEP 24576:sAhGL6IFoiwtA5l7S53c4qgQhL9lZ30Yf4Dytqh/vRSNXGWR:sAM5Foiq5Hkf4GtqhBS
TLSH
T129359D81EBF955D4F5B3AA78A9B69170EA76BCA65E30C20F2150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 5dd88f2ea4d461cbe37dd2c42483855cb56cbdd69990fc1697baba6afdc48903
MD5 ee630f4d14ea085ae51b12ea8a486f2a
SHA1 2d70b5356f50b1fa0567ba9fd39a91bcbde21e28
SHA512 8a0cb33115df6b0634126bfdcd058da2f1fb0d6b7270c8ed071ecb01bd4e5c1e96870a5af24ff13ee473bb783df2f70e153430017248e2bf3dfaaadfd3181bb5
SSDEEP 24576:nwuROWp4qgQhL9lZ30Yf4Dytqh/vRSNXGW9:nwSOLkf4GtqhBS
TLSH
T10805F14A76E40CF9E967413885979136F7F2BC422A21DB1F1360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 bbc53dc534e3d8eb6a401da939274e031f068a6334e13a7cd5c50ec931c51c94
MD5 6526d8c0a824116f187ed5891b0cb13c
SHA1 1a62c31a5f1b9357e847f764f959967e2f6be918
SHA512 ffd6184f9a898475c59824fac34a2971c82116094e62df47d23d1d95419aa50300d3d2a11896669c228b909e9e86abd0c5eb45ccbc12b7410256da3b656e92ca
SSDEEP 12288:GyZ1Iyd4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAa0:/Zui4qgQhL9lZ30Yf4Dytqh/vRSNXGWF
TLSH
T141E4124A27E020F5E567523CE8E56645E3B13C93A7710BCF1220A7992F36AD59E3C723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0dbdcedf36004b773efd2061fbb3c97d7c0c6a66bfb4f3c7f068d1c87d171fb6
MD5 76329e8ec77229e63738bf045c7fdcdb
SHA1 ef19a27fe85cb0e974d63f71f2947d50c460b09d
SHA512 e3101460495e07ea2e4a89960c8196b9cc63c8546a39a9cf5c26c508b88804a3f6bc68bbff954b94ea61d47debd3f42cf15b6bc61d1c845e07f0ba9de8ab4d8a
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Up:cQRQyi36YOcPDLvw2gAf+PN3AkqBS
TLSH
T155667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3fa8eb408c3b73b1b69e4beb9b4481e4deaa55ea23480795b925b839c71fdd65
MD5 79f70a35c61c5e995bba826bd23e5afb
SHA1 4ac6bd7fe64c536cfc104d20e87b865c021925ed
SHA512 87aaa88f7bba0d913dc4636b4239c4f28bf3e219677a3703a2099fe13d6963fd7d568396d2318ced6abec82ad9202ce441b99f6202636bdb4bdc69bfe55814a0
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Up:cQRQyi36YOcPDLvw2gAf+PN3AkqBS
TLSH
T19D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 eca9057cb6d5c7373446fbb2159a7d3e2a8cb3a0becfb34af75d701b5259b197
MD5 8cb6f190c68bb14de7b97c00a18e4d7d
SHA1 8324c5d7aed98b65d1978cf1247bbeda5cc00806
SHA512 09df29f74ba0e0e2d14b9f117a92982b69aa91486c43f34571c5b69596e223390585e46160ec5417d5be7513cec24e52e348e33af9323b4cdadc5d7f9c6753b0
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0y4qgQhL9lZ30YfM:F68Qg55nhkeWu7PNU3/ekf4GtqhBS
TLSH
T1BBB54933B2F20099C44DE1769F4A972196D27C75CFE0E7DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8a5c4ed752298409d92101f134f8220498ed3d6083f83318cf92c07e3937d577
MD5 ba0e9f7bfe018c19770b5e9b18714830
SHA1 3b296252cd44e3b43facc246b8a7455cde8243f5
SHA512 5ff9a1a78e87d3eaf5b9b90a23335bc52e87e8a614a30d20fd386971053030826ded0cba7b7cef5501e54394d53e84ebb5c458fbf4c301f3aa7e43b71ff54289
SSDEEP 49152:J3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99P:Yy5112gYy5azzVvU69nLKnhZtkqBS
TLSH
T169167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ad0a8d7ff485830f530f90272e1173e29905af1bd8281c4e114ad02e1331faa9
MD5 88fd42b5d281531e4aa3f43e1f2b6ba9
SHA1 d67f4ac0e89d0867b29db6112f80610440d20199
SHA512 0db7f11fb1a8d23f0b5a02c744b531982043f332dc2ad7876d3c2f0196b42b83c17f70fca424f597b1253b5fb260eeda922015b7565999d463023d3780454f95
SSDEEP 49152:dB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glYkf4GtqhBS:Du6JmIxd2dYkqBS
TLSH
T183D59D13F1DA01E8D06ED178974A9233F962BC490B34B6EF0A9073552A77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f777b319f9ebb3cb25a70533d7bb63fbc49f516aec8f1c162ea45be4c6677056
MD5 65db7060a5693dce2b099dd3d088c613
SHA1 f150caea5a391fb763d3ef6fe66da2f702564da6
SHA512 89d2e469fd534b1eb1beebdee8c2ab108dd3c2de114a414d39e07ee8a8eeff10ff3f89999528d2837c585a7d10dea28b0b3dff1181d3c8257b3cc75e4d3df360
SSDEEP 49152:J1hpsNoJpF1A67U44CwH7R4xskf4GtqhBS:JmifPqR3kqBS
TLSH
T1BBB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a2958d02ce6b783f1bff4ca47adefbec1fcfb0b7529f54901ad42a896bd4c040
MD5 a6b11ddb58c10c4c6e094b63895f12df
SHA1 248bc3d641ea12f2474b1cc8da4c40e2e325a46a
SHA512 ce566558f8488bbaae2e6326fbe4b8bb52e4e56a9ffa850191a4c8da0a6af6f3670350944a3c5d97b680d0305bdfac97c108069bbd0157ed0e7736d9662c62cb
SSDEEP 49152:tSuZQIY0Be2KkRVtOnks6NMHqZkf4GtqhBS:j5dKqi61ZkqBS
TLSH
T181C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 78da67e702c108b4f7e4f642037d34d853d1c00ac0ba9bd3a12a043ba223dde8
MD5 6346f70abf5ba33f1fdb899b3df0a70c
SHA1 965d3c55b81491852a5c5764799dbf21af2ac4a3
SHA512 60139b1c254275bbd9e95a346d2bdd20fd9d7bec712c4df50fd0aa6ec28da4066f4043848a7ebb9fba93c4923f81989a29133e7b225ee8b90a1917d394ef20d5
SSDEEP 49152:ChtSn8EApI0figjgiDn0AP5wokf4GtqhBS:jX2iWphrkqBS
TLSH
T10395BE13F2D901E8D06ED178C7468632E962BC160B34AAEF0A90B7561F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 2ea5293373f6c1c0167001926abaffc3e9540e6de7555801f85635ca207d1a3b
MD5 38693815718772df238c2d9ba3dad5a8
SHA1 063fe324301fe46e85b6ee177f89aa0deb5a8f69
SHA512 670b2ce40fe951e91dd08e8b59807b29a6d38694cedbb74b2e92b0e5cc6f2ef1c04f13ea0c8b1c2b4ab42bfe74ac8b9bd26a3dcd030f4566f699bcc9506502b6
SSDEEP 12288:rm4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaD:rm4qgQhL9lZ30Yf4Dytqh/vRSNXGWy
TLSH
T16AC4230D9DF20642F9275275B0D97295B0E43DD7EAA01DE33215F6847A3CA98EF2C81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 b38356d910143756effb66a23a1160f284708d05e27557070e24596eb42f8500
MD5 bc1dbdab675e3a7b5c37615aa6bf68a4
SHA1 c67020956964b91c955af52549f7031d8a593444
SHA512 b7060229b16b8cfafcfc2c51fb917560d5fb2090ad3dc4e68ae54dc694ef52cfe708ed9cf9b9a18bdc79ac72e09aec8256d34b5f8fae8e7163df9385d26de5ef
SSDEEP 12288:mx4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaD:mx4qgQhL9lZ30Yf4Dytqh/vRSNXGWy
TLSH
T154C4230D5DF20642F52B5275B0D97195B0E43DD7EAA01EE33215F6847A3CA98EF2C82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 1afeb86b288eea208141bfc4fa58c5e52558282e5711bb8d6b2c65a301841ef9
MD5 c00c99a097a33fe97db04245a5eee8f9
SHA1 4a9d2ea71cea57ec50aceb402c2b61258b010425
SHA512 cfbc81075719b5539d9fa5a1ed3c37bae28983ff7d05a5569d64cd24a35e5d7cb29a27bb8437e61320ed9690865b0906459d0e9a2bb18346dab1f19447bf8cf4
SSDEEP 12288:wX4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaD:wX4qgQhL9lZ30Yf4Dytqh/vRSNXGWy
TLSH
T148C4230D5DF20642F52B5275B0D93295B0E43DD7EAA01DE37105F6847A3CA98EF2C85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 25076e9c235bf8300fdbb5469f37b7b75503fa330797ccad4da4456b24044c7f
MD5 2a6e3ac1b0f4593f8fb794f133aa31cb
SHA1 8d38a53f315464d54526a6aa10d8e600d9c00278
SHA512 0dd890fe7ea39d14a132a8980f81fbe576af83897c5be2c9146bb6dee61579f0fc6b31c77023a41e787393955eadf769d3987b4901cbb629aa542f703be4c3b9
SSDEEP 12288:3V84mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaQ:m4qgQhL9lZ30Yf4Dytqh/vRSNXGWN
TLSH
T107D423096AF101C1E8379238E4966155F1F47CD7EB701EEB66007A852E38794EF3CE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 2c3e44234a1dd4ed18395c2b2d514937b533e8c7edf67d2fc81f61ebab38d1b9
MD5 29bc0ba9d383804e99cc07cf7f0dd40e
SHA1 f8460ab723c0b6f58b0af2900d3057d92d9b0d3b
SHA512 303d1818c7ce871c7945da698adc6bc8ceaa336bdf4e2b48c68f74a52188225145c56e3f471b4e146d10f9e2c6caa2afb35e48b9aa61bc195b262d6792089a49
SSDEEP 12288:OE4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaJ:OE4qgQhL9lZ30Yf4Dytqh/vRSNXGWU
TLSH
T180C4230D5DF20642F52B5275B0DA3295B0E43DD7EAA01DE37105F6847A3CA98EF2C86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e92779f3eddd65603bfec88bb6a87e38992674943a321589d60cea5a529c2dde
MD5 b1ac042520ce1aa9b3f9f8832fb696b2
SHA1 5e5786daea7568e65d5eecd6533fd64349bdbc45
SHA512 cb449f668a5e74c1ec59f0edd58af1f3dac1719e733e5aae70930edd7f3f5ea51dfe20f8ba5a395ba5bddbe093328e8abdbc57d05cc894468b8a05aac4d3bc48
SSDEEP 12288:PF4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaJ:PF4qgQhL9lZ30Yf4Dytqh/vRSNXGWU
TLSH
T118C4230D5DF20642F52B5275B0D97195B0E43DD7EAA01EE33215F6847A3CA98EF2C82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 556002e70a82db1e8a6e85163afba521ff63f4357fbe019c12558bb0d1b8c627
MD5 d993900f2957f1dc232618acf12b3b7f
SHA1 4a172aef9aff33ad7d368cd1a1a1c9179fb94232
SHA512 868b74c17aa7c6439aecddfacd0f251ee07843a206c62d5f703e5ddd7647cdc7c0eb9a83f9f5ad360e9159402a6b008d30ee04f6a80941ce9c52917a58d3d4b6
SSDEEP 12288:M54mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaR:M54qgQhL9lZ30Yf4Dytqh/vRSNXGWs
TLSH
T189C4230D5DF20642F52B5275B0C97194B0E43DD7EAA01EE37215F6847A3CA98EF2C86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1b13ba13e5ae3beb0a99351629f64dad7b30fe0a2ca28f7f69d145b50cb17a03
MD5 d922729f75be10352592d4ecc3e5aebc
SHA1 6447f589334de08b371dcf8fc57eec9300157f95
SHA512 6053c9bb5d9209749e6aa70713211938b88112a5057142798186c230caa0cc7a2821f64f7e59eed741bc06b0263a975c965150e320b7cb943ccb389bb8712b25
SSDEEP 24576:zZM3zFVSOR4qgQhL9lZ30Yf4Dytqh/vRSNXGWv:zZM3zf2kf4GtqhBS
TLSH
T1FE050295B3A008F4EC67823EC8559906E2F27C5A4B70CA5F13A436665F333A05D3DF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 3a2c821b8c6f54d39b45bc51cb8a46b6d2d59017883e6bb9552b26c794a0c8db
MD5 eef35f55200a9228bcd0fe71b971f30d
SHA1 f6a98017223314b862630fe204c47ff1e99fd8cc
SHA512 9fa460b30802fc317d8ac237446f1b591772c5790dbdafd45b81884cafad490abfeee75d54be94784a44dac55add3e2e209cbbaa8ed9b12cfc68e70208218de0
SSDEEP 12288:CS4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaa:CS4qgQhL9lZ30Yf4Dytqh/vRSNXGW/
TLSH
T14DC4230D5DF20542F92B5275B0C97295B0E43DD7EAA01EE37105F6847A3CA98EF2C86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 1311f358f3227f0bc91ed358dae4861c9c9a1e1e61a418744fddb3136989e860
MD5 b7ca014107ef97cebd647842e74a2aa4
SHA1 a3f187c55c961b8f684778119a6cef47bd4c3d8b
SHA512 95af55c7c1070bdc47077d4eaeecb9a804915a3f72bfb54313544830edf66f8a0b2535af1b38e6b685081be09982d5a836933cf44338ae77048ade8fed4ffe53
SSDEEP 12288:Fe4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaa:Fe4qgQhL9lZ30Yf4Dytqh/vRSNXGW/
TLSH
T19CC4230D5DF20642F92B5275B0C97195B0E43DD7EAA01EE37115F6847A3CA98EF2C82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 bc694831b9ce22d8ce7b58957dfc7a8a08f9c4ea83d4778d694a260a0768491c
MD5 a47005acb51b3a6b10613c61e1e16e11
SHA1 57509e06887e3d42170b98556abb75af560ab19e
SHA512 dd1b4db27a8ea535ad862028a7c66913336aaf675c566fd77b77a333a4d4b24dda6f9e8db503e5e2af31e7f41600e552b7a2a5d2c7cb6e32bedc8a5c6f09a664
SSDEEP 12288:2yPz5L8d4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAag:Lzyd4qgQhL9lZ30Yf4Dytqh/vRSNXGWN
TLSH
T126F4010B76E120E9E5379238D8961A41F3B17C729B604EEF136067762F376909E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 a97af769dae55667db565b8568882e32040818621e30afc35d7d7fca26f214b3
MD5 47499dec796abbc23f7bc522c23fd66a
SHA1 18da2c0d3b49a160748c22d894c762ef5d4498c6
SHA512 98a3dc2066972be4ded747bb3e15763b5c169e5ce73e81a2ce5b7b6da67345ebe635ddeccaa392448d6810ba75b2595b0508931ac1c36ac57d803d718b6d5ca5
SSDEEP 12288:WS4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaV:WS4qgQhL9lZ30Yf4Dytqh/vRSNXGWc
TLSH
T11DC4230D5DF20542F52B5235B0C97295B0E43DD7EAA01EE37105F6847A3CA98EF2C86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 567990b0c8e5ff3de0694fed44d5b232c44e6bf225e5111550604050088db379
MD5 dd91dc5cc60f719a37520a300b9d531c
SHA1 7e1455af4e832488602f65625513e0502c40a9b3
SHA512 1bd77f33e42f6879c961af6e5d5181bec48e2ac9e88c0d57971e8215491841b16f3a08dc359b76dba3cd3274c410a0cb1e0a81026fee9c0c0ba6ef7687c33050
SSDEEP 12288:tS4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaV:tS4qgQhL9lZ30Yf4Dytqh/vRSNXGWc
TLSH
T162C4230D5DF20542F52B5235B0C93295B0E43DD7EAA01EE37105F6847A3CA98EF2C86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 3279d7e5dd23ccaee3dd1d684b3de5fcf77fcf9ca3f295fac203d63339ba59e2
MD5 ce4dacc7490cd6d44829677e08e35dd4
SHA1 5472ba7f08d35fe01a9eaf84c5cab019761997cb
SHA512 32a4a782d698f6ab486c10e3919a4a9da34eebbcf9cddae15e6016ad4ea42763a9c3de2cd342efe7c351acb311077829361ad602204dad1541651629a7851381
SSDEEP 24576:8cP4mcvIjkGOxhKP2l71SNKbrh/8KB64qgQhL9lZ30Yf4Dytqh/vRSNXGWR:3P4m4IpOO67N8Kjkf4GtqhBS
TLSH
T17065BE2DABDC0096D0BB917885658A49FAB1782A1F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 45f4e4a81df19f8d68b0ae4cf66e0c2bbce3d032e19c66599f784e66ff78cb92
MD5 c05815a85cb5ecd0e50e728043f3c556
SHA1 a6a9b95d626a9eb40726aa93e8a95f1bd12bac6c
SHA512 a7170780fe36be85d2084f7904a174277376dca1f41821b3b4b6b2a6bbad8c80b329057e6f700630d9a9d78022ebd17fc06b48046dd824e90db5e529e739cc2f
SSDEEP 12288:rpsfi4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaN:ci4qgQhL9lZ30Yf4Dytqh/vRSNXGW8
TLSH
T14CE4010AD2A402D8D06F6239D7965641F3733C6697E197CB22C0F67E1F396909EEDA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8245512b5ef7726b.bin

Path C:\Users\Admin\AppData\Roaming\8245512b5ef7726b.bin
Size 12KB
SHA256 981b91c289ab315ccff68317850d6cf3fb372963dcce09e610780e9c718b0ff5
MD5 be9ddf8f99da9131089b4af4e99bbd52
SHA1 bbee711180647360ffeacad6906a0bd65b6c86d9
SHA512 c949f76b262921262130cd04712df50d792ba018aad3c3b7c6ea87b85e470ed5dcd0bdfe880313f6b71fd80b188ce27e941b10a834ac5867729b1736c062a891
SSDEEP 192:BXJygv7n0VCWQ3cwuxYX4LdjJIH74ty+78BNDjFPfMmqsoTLd5TGaLe:B8KnOQxu+oLAb4sF1PfMmqX5Tc
TLSH
T19C42C0AF20BB35E086950657BA51EAE91DC4CDA687C4C74177FB0C12324B9037806EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 71b16e39ec576ae3a2f7d9e6de914248a5a1332eda42e279c402dc24fc124c65
MD5 a04c5e8c027500bef879e93440e8765d
SHA1 ccc127dd80d06f3faa2f96104383ba9aabe4605a
SHA512 484ce28d59500c2a9881628fb179bc6c9124996754df458fe9dc29ef4f07d185bef4ce8f3d4a57556430f98d22bd07c1c482efe3da818274ab4feaa01d1d8411
SSDEEP 12288:UC4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAa1:UC4qgQhL9lZ30Yf4Dytqh/vRSNXGWa
TLSH
T11BD4231A9BF50602F97B62347099A16470A93DE7DFA00DD77101B7847A3CA94EF3C91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 abe3b2bfe1948d1ec635eb9432b1980d92fb8ef440a247a504bcd080f07e3be2
MD5 e758f32cc0c4ba9ebafbb89b0b785256
SHA1 de0199672708eff6e8dee75643d756ba5e6fac9c
SHA512 55fa1bff82ecc96a37b4469196e813b9a7736cbeb453b74a6fa2778e69f4c3ff185d83960aeab0513adf0a265b5834f6af6e41fe1e6e47599490d09273ba0c1d
SSDEEP 49152:qa0h2GEkuAe73q3pp46zwwQ/kf4GtqhBS:qa0hNYG4JwWkqBS
TLSH
T12E859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 4c62564d6456d7dd779e193cb19b1c3a8e348f366391b79a467b09eeeb092c6b
MD5 681b713f8fa74423ab06cf3f2b5658f1
SHA1 5b1d08bec634e47523f72370973d3e7a73c9a9e3
SHA512 658610e7c374d5bcc850581fcf6cf70f74142bd951bff8003ec2f0988db5ff3d22e74f8bda406699cb440e6b4f1f48b1aef06f993f386467f423117c035d65bd
SSDEEP 12288:yhbHjfXB4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAag:yhbHjPB4qgQhL9lZ30Yf4Dytqh/vRSNh
TLSH
T1B3E4123E16FC10C5F532A27CA0965146E370BC6657205BEF2281A2795F3BEE49E38F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 251f801f6a2e981e2e9adc29b40e68301b998d3cd5b81bfe9b9e35b881ec74d8
MD5 d2aa3c9e73f452afd0005fb76221d961
SHA1 3a1758515bff2f0c1b94449a2e715aa6731b1e00
SHA512 391b940510c83d48059634253ab4e4bdd2ced8a0375dd2d78db0d363ff9b5a33e31fcc4b46e867beb3629e7c6abea4e3d134f3f90803e7a0e0d02505989116b7
SSDEEP 24576:43YgnJcRTk4yti+R5dpR/p4qgQhL9lZ30Yf4Dytqh/vRSNXGW6:4IgnaTk46ppR/ykf4GtqhBS
TLSH
T1F645BF2DF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 95341989677d311f6f78474dcf33ae228c5bdbd36441088554dfb03549f0fe9e
MD5 3e5aa59fee2878841ab1ef763af8412e
SHA1 29182ae0c4992439d66945c6e69999b3c0140133
SHA512 85fc710a559d66a8af29baa6030bfe377bed1422d0a3c783b7b5a586ca8d3c75eb12257e130571df94c564c951b191f8aac77a6c8bc01ab23b0bff6d2176390b
SSDEEP 12288:1O4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaN:1O4qgQhL9lZ30Yf4Dytqh/vRSNXGWs
TLSH
T1AEC4230D5AF10542F93B5275B09A625970E43ED3DBA01EE32051F6857A3CAE9EF3C81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 36e4f92919845ea664d3a049e37764a3a207b4019b998618230cbb3bbbd7bc28
MD5 9e078ae81ebaf94d5b7994f3efa2e915
SHA1 8e3d2284c66e995b7666642b2964cb9075b71c0e
SHA512 4d0713b29ab6b569a2f8cfddb2d356b7d9ef94de37c5d527ce0802ae8d6d836317b9bff70693bd9e92992bd57e50e6fd87005ab3b78e40efd6b111e4dff2bcf7
SSDEEP 24576:SAL3UTT4qgQhL9lZ30Yf4Dytqh/vRSNXGWu:SAL3UMkf4GtqhBS
TLSH
T1BA25F115E7E400F5E97B913CC4A69616E2B2789D0760EBDB03A88B551F337E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 dfd44d83aa9ee3db7f1479ebc6d1d6b280af1ea45bfe3dea5f297504790530dd
MD5 b4a289085b423f7acf94732b8a815c44
SHA1 bcfd0e94dba72d7f5ab04ad48b5111b523d840d4
SHA512 aa693f674048b73eb60f8d6a8fc4913fa61a1f8cdd8efa85db6681e00cbc70f64af4dc02f3bbb6388ef94ceb984f59faa38ecc870cab8649feedb9fc005252f3
SSDEEP 12288:NpFtvOf4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAal:zOf4qgQhL9lZ30Yf4Dytqh/vRSNXGWk
TLSH
T138E4121E36ED10D5E536A13C9586520DE3B17CA24B211BEF029091AE1F77FF8AD3DA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 93c794e5e55770eec6ed2056a49d3a0f3392fd0de9358552e03b1f20085c74a9
MD5 f5b037b831fa1783dfb3cb2ebb712a48
SHA1 cdbcad21e69ce3fd1db59a39160e0149b3d55d56
SHA512 e426ee0947a306f76457a605154dfd19eeafb16930cc2b62ca9169a33cde2b48bed0aeefc46d99e15bb0a61b247f89822535038e4a251167ba806ba64f513467
SSDEEP 24576:K7NM9YmZqmWMUkPjZM48Mv6bEhsS4qgQhL9lZ30Yf4Dytqh/vRSNXGWx:K7cBWMpPjN8DbEhqkf4GtqhBS
TLSH
T148659E2E6BEC81D5D577D13DC9A28205F2F1B8611B318ACB1162833E6F37AE45E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 59ba7bac6cdb42c1f5e28321dce98de965a16cd2647e4865f3b854fa06d8356c
MD5 b5767235f82f1a1edd8333b171ac9597
SHA1 2e673ee5e846b18d36467d900a53fc8dca180c41
SHA512 51821353fdc4b6ed202b7c1d5411fbd2d24e9069989b66d1262a1d7583aa1b29d2ed1b40989458ff951ef00e1be93fbcee9cc2fa0af4142edb4620dc130a23d7
SSDEEP 24576:DW6BApg2YuyuNDYTabvcRvNYf8km1Y4qgQhL9lZ30Yf4Dytqh/vRSNXGWF:DF2YuHNETovcvNYf8kmJkf4GtqhBS
TLSH
T12C857E6927ED80A4E0BBD27D45B6D246FAB2BC511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 0e89b26b522b3ff797cbaba0d0427a205c6f7971d510f5ec7091997084ebc869
MD5 1f10a519ecf8eabc384e505c7efc4248
SHA1 5f1ae3a18ffdf0f9483eaffeaa735781ec664602
SHA512 b603a13fcc2da5179bd97e48a2fa7ac39793e1a86a37471cdaa61d9fd51dc57b14e5dca62ea25f053167811b471ddad7ed1fa3cedf9b44f68c7b7486a2cdca1c
SSDEEP 24576:yAFs06+Omlf8NXEbToL4qgQhL9lZ30Yf4Dytqh/vRSNXGWN:rFs060loXufkf4GtqhBS
TLSH
T17E65AF2F66EC00D5D07ED17D8997C91AF2B1786307215ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 cf853eb35ae57a8c36045ce29811ac9ef37569de6e1903863b806d181304bb04
MD5 055644f2f0d07dcf78be62b58723d24a
SHA1 ea2b9c6bf52f6c9d52d82e1378a48bacdd704eb6
SHA512 9fc550e909bd76abe820a5d995666fc5c9f0f1b57f9e10009a2adac9c01720df41e12e5aa4d907f5c9b8e7b6b0763e1151ea26b3768d5abb8b3179bef497279b
SSDEEP 24576:TJnJ5D3Wtk4qgQhL9lZ30Yf4Dytqh/vRSNXGWG:TJnJ5DGtfkf4GtqhBS
TLSH
T1BA15D02DD2A810E4E4B7C274819A2755FE72387D2F226EC72474D5353F22EE09A79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 ce2cc8cc60d2fb0d1ffbaf884bfbf68d786efc0fe891be99cbe0cfe9fe3d96d2
MD5 287fc6105ff479660bddf8158c643bd8
SHA1 f3e63acbd1e091bcf23d5969f697a6f8743b2d5c
SHA512 53466196d49bb027c316a6db735a9004769b1bc915356bd45dff9b9de43426a18bb9d24c7e6ca56df2fca8cafb40c3e968aad4b4bf059226f012aef513d28531
SSDEEP 24576:/EPohm6/7IIXdwcXrif7qQncjlP65i3Vup4qgQhL9lZ30Yf4Dytqh/vRSNXGWk:4o06DIKdwc+eQnSt65aVlkf4GtqhBS
TLSH
T1BA956C15B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 2207acc2726785ed41458bc88d8a5eec0054d96ea23e3d0324d9320faac2327c
MD5 80fb63fe70cacc4317170ddcab41c1e5
SHA1 cff818f37eb8348846482ee45ea8042122a066dd
SHA512 c676d1444a85a153c49361293e6dfc835aff871016a5ea6bb449bf0f4d347eb4faf5080c7d1f10b9e0f62ed107c68e2bd0ad1d03e6cf5e0d1048d6457fd0412f
SSDEEP 12288:uEP3RrN4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaU:NrN4qgQhL9lZ30Yf4Dytqh/vRSNXGWl
TLSH
T1F0E4125D2BEC20D5E13B913C90918245E3B1F8A26B512BEF1191E27D4F37AE96E3CE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 a4d3b8ef4db29446d25ec97deab946d0a345b42c7bfb335cd374cbfd705a95c8
MD5 9ca2be6d6f6498940e79e4b05e7aedc2
SHA1 5bd1826797a26a9c4e528470eb6ad621c99a67f2
SHA512 e68aba17d6b78e4e81dc3446a700ef5ca84de5d403b2f20d91161bce729f4327a40cbb69e88b4b0bbdc63115ce139ebd840842f8e1f3f899e9b1b6268b45e745
SSDEEP 12288:6jkyx4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaH:6Iyx4qgQhL9lZ30Yf4Dytqh/vRSNXGWe
TLSH
T136F4120867E45081E57B4238A5A75194A674BC619F201BEF6080F73E6F3ABD4EE38F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 400a364f644bf502bfabd2ac6da54f01320e17db08562faf5ede65446f46db90
MD5 f880ee45afbbae7f3bf934438eb1508b
SHA1 e3d1b966b478e3f5ce6246e094470ef305e1d524
SHA512 ec189ec765e1ed45453f0a8c689c1c7fe11d6cc2da4fc6f09cbdd6e928d5b6a9000de9b6dd964417ec0b43e0330f7f5604fd95996ffafa41386686281d41b7e8
SSDEEP 12288:aFP4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAaP:YP4qgQhL9lZ30Yf4Dytqh/vRSNXGWa
TLSH
T139D4230D5AF21545F9375278B099669470B03DA7EB601DFB2090F6A4AB3CAD5EB3CC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8e5a360ce74f2ccfdf11409e2ba13588fb248911a167a888723e45e0d9b4886f
MD5 b6d2eb0298d526db5a2bd2ea4b574181
SHA1 e749f181e25c990474fefa0b6f735bad91dc65d5
SHA512 5f114b50b31a819e790aa8dcb86480716207bf66871b90a7cc11e848c60f861c870bba6037fdb096424948b82ef4bd98f1c9955cf5b20f394358c17272930458
SSDEEP 24576:AQ9MxZKdcz97w3K4qgQhL9lZ30Yf4Dytqh/vRSNXGWr:AVKXhkf4GtqhBS
TLSH
T1D3558D2DABF9058AE177D27594A250C3A673B4311B31D6CF2448D03D4D7AEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 70b0099cd23ddfc33ddd4fb4809aaf9c7358d8163203bc11b2a5df411bef0697
MD5 93d1aaa9e58a39b65be7ad145f2731fd
SHA1 aa5f30a2a69ac1a2ecc8aa2d0ea01f4bd60e295b
SHA512 96ee0aded13db4e9b53a2028e073b77a169307b6f85ffcf737202b37d1338c4265c82d344f75d80cb8db826903ab39b06b5f66ee954357e8f3f53adb1291d124
SSDEEP 24576:zyocxApt4qgQhL9lZ30Yf4Dytqh/vRSNXGWI:WocxApukf4GtqhBS
TLSH
T1EFF4E01FBBA94092E176813C88858345E7B3B4715B6217DB6191C33D4F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1f1ae994a09235cc939f0fbbd3d7f6e77136c01df2113f8898f19f7de6f0e57e
MD5 01cd6be349434d07965a4c053c778187
SHA1 9b5c86ef307535492cf59477a494608e3b1cf76f
SHA512 7c89e156e7955a0855ad04799ca9373166b247c5579637e2c7fab76d111c0d58440c6aefea72a3e332028ad7cdb687da1cb5be4ab424829ed0495102bae2fb90
SSDEEP 49152:YWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKukf4GtqhBS:60zuNICkqBS
TLSH
T155A57C3DA2F800A8D9AAC375C54513A5EA71742E3F2059DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b86f9ee7e5dedcc5f9d02ec1ffc0cfe9f9a9aa556865353ad2e253e4b276a982
MD5 b3fdd7212a70cba2f667b267180d7e1b
SHA1 574ce079c1ed5ff6fca100abd05e1998fcd9ff14
SHA512 b4e95ec59dc20563aebcc44a89942b4272fc23e844b9840c2ccd9fb6e71ca176ea3b75dc2b3d9ee96c8df5c89f69c45e72a46a35d553e51b50319abfb3b0a172
SSDEEP 24576:W1QT7EcpfxR+N5AWAz3ooiYzjMqbQ4qgQhL9lZ30Yf4Dytqh/vRSNXGWm:7TDxR+N5YzTBjMMkf4GtqhBS
TLSH
T1B355B02EA7F805E9D17EC5789A23C512FA727861033193CB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 f6e73fd8c8964c2960f79b9a9b4440e14ddc7b767c1e0879a23506a440bc0084
MD5 03f2cd4c2d8f85e43ae82b78b246e3c6
SHA1 dc44143b85334513cab98fc2aa3798a32c439f1d
SHA512 c7af239787ab1d50aa717ed5abaf5478bfb890ed519622568a548f452390bbfaed879b487defcccf72831fdef3044621142ae20c77652d213bba9f4fc99d07bc
SSDEEP 24576:HTMdOz0FFS+UmSL84qgQhL9lZ30Yf4Dytqh/vRSNXGWa:10K+UmSL3kf4GtqhBS
TLSH
T10F15E13EA7AD14E5E47BC27C96438906F572386203216ADB0690C1793F7BEE47A3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 3d9794d06379cf6c36378cef6437cba9ec396c206d20c764f5b2f7c1f352bb8f
MD5 0c5996307bf5e2b155661ee19b59af8b
SHA1 ea420b6518db5226049ab7fa6b5eba687edc8bb6
SHA512 e8f3a219855050654fc4a0dfacaff2c1b97e8952e746da68795a87496989d392d5b2f6e38c719e7b3959c4d1c78ec389be379c4be1a256057cc13ed5451af97c
SSDEEP 12288:I47T4mUU7VW3AhLumFzjNpTldJ1QhOlZ7EDymCqe8NF/vPZSNXuN9znAao:/T4qgQhL9lZ30Yf4Dytqh/vRSNXGWN
TLSH
T17BD4120D27F420C1F4379238A56A5255A1B0BCA267601EFF35D0E6B95F3AAD4DA3CB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/448-491-0x000001C1350B0000-0x000001C1350C0000-memory.dmp

Download

memory/448-493-0x000001C1350B0000-0x000001C1350C0000-memory.dmp

Download

memory/448-488-0x000001C1350B0000-0x000001C1350C0000-memory.dmp

Download

memory/448-485-0x000001C1350B0000-0x000001C1350C0000-memory.dmp

Download

memory/448-484-0x000001C1350B0000-0x000001C1350C0000-memory.dmp

Download

memory/448-490-0x000001C1350B0000-0x000001C1350C0000-memory.dmp

Download

memory/448-492-0x000001C1350B0000-0x000001C1350C0000-memory.dmp

Download

memory/448-489-0x000001C1350B0000-0x000001C1350C0000-memory.dmp

Download

memory/448-487-0x000001C1350B0000-0x000001C1350C0000-memory.dmp

Download

memory/448-483-0x000001C1350B0000-0x000001C1350C0000-memory.dmp

Download

memory/448-486-0x000001C1350B0000-0x000001C1350C0000-memory.dmp

Download

memory/448-482-0x000001C1350B0000-0x000001C1350C0000-memory.dmp

Download

memory/796-271-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/796-128-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/796-134-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/1048-164-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1048-170-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1048-276-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1336-399-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1336-29-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1336-37-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1336-36-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1336-35-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1564-195-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1564-201-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1564-279-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1600-59-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1600-84-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1600-61-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1600-86-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1600-53-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1828-216-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1828-205-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1828-211-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1828-214-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2012-278-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2012-185-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/2012-191-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/2076-218-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/2076-281-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2076-224-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/2304-111-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2304-104-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2304-105-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2304-478-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2528-19-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2528-18-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/2528-10-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2528-270-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/2932-274-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2932-143-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/2932-149-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3028-474-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3028-83-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3028-75-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3028-81-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3048-124-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3048-118-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3048-289-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3432-272-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3500-479-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3500-285-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3500-234-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4100-180-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4100-174-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4100-277-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4304-100-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4304-89-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4304-102-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4304-97-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4304-95-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4308-473-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4308-64-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4308-71-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4308-70-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4356-238-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4356-286-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4356-244-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4364-50-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4364-49-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/4364-41-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4380-114-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/4380-6-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4380-8-0x0000000140000000-0x000000014069D000-memory.dmp

Download

memory/4380-0-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4380-23-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4636-287-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4636-254-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4636-480-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4636-248-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4796-290-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/4796-481-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4796-322-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/4796-265-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4796-259-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4796-306-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/4796-471-0x000000000D0A0000-0x000000000D0A8000-memory.dmp

Download

memory/4796-288-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5056-477-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5056-159-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/5056-476-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/5056-153-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/5056-275-0x0000000140000000-0x00000001401D7000-memory.dmp

Download