dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
Size 6.5MB
Sample261003-p69scazzev
SHA256 dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523
MD5 7b131e279dbb0bc93507b273c8b1cb63
SHA1 c19b5d03f760be8adc3c45887e8001cb866d00ae
SHA512 af325188cc94c2aaa1075a32543664b4757bc4ef10847a6a36846d440406581dc0c2978e04903b8744388f7d0e0e63851285d828dd4c662b7524b545e09b3fa3
SSDEEP 98304:KPItBnqeJC6owb3+U4BamuTpTrhKslgJTIZ5Bgp:KPcfguBrhKsT6p
TLSH
T1B4666A03F19910D8D059C178CB5AA232EB72BC494BB172EF2A5077D52E76AE0BB3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5028	alg.exe
2524	DiagnosticsHub.StandardCollector.Service.exe
5036	fxssvc.exe
4412	elevation_service.exe
3524	elevation_service.exe
3252	maintenanceservice.exe
3576	msdtc.exe
3552	OSE.EXE
2308	PerceptionSimulationService.exe
4380	perfhost.exe
3304	locator.exe
2664	SensorDataService.exe
2092	snmptrap.exe
4576	spectrum.exe
768	ssh-agent.exe
3408	TieringEngineService.exe
3132	AgentService.exe
2184	vds.exe
1520	vssvc.exe
2200	wbengine.exe
3572	WmiApSrv.exe
1892	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\45dce273288da564.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\spectrum.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\AgentService.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\System32\vds.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\System32\alg.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\dllhost.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\System32\msdtc.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000491803cf3653dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2ae9bcf3653dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bcf1dcce3653dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006cb6e1ce3653dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cce7b5cf3653dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
2524	DiagnosticsHub.StandardCollector.Service.exe
2524	DiagnosticsHub.StandardCollector.Service.exe
2524	DiagnosticsHub.StandardCollector.Service.exe
2524	DiagnosticsHub.StandardCollector.Service.exe
2524	DiagnosticsHub.StandardCollector.Service.exe
2524	DiagnosticsHub.StandardCollector.Service.exe
2524	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2932	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
Token: SeTakeOwnershipPrivilege	4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
Token: SeAuditPrivilege	5036	fxssvc.exe
Token: SeRestorePrivilege	3408	TieringEngineService.exe
Token: SeManageVolumePrivilege	3408	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3132	AgentService.exe
Token: SeBackupPrivilege	1520	vssvc.exe
Token: SeRestorePrivilege	1520	vssvc.exe
Token: SeAuditPrivilege	1520	vssvc.exe
Token: SeBackupPrivilege	2200	wbengine.exe
Token: SeRestorePrivilege	2200	wbengine.exe
Token: SeSecurityPrivilege	2200	wbengine.exe
Token: 33	1892	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1892	SearchIndexer.exe
Token: SeDebugPrivilege	4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
Token: SeDebugPrivilege	4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
Token: SeDebugPrivilege	4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
Token: SeDebugPrivilege	4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
Token: SeDebugPrivilege	4812	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
Token: SeDebugPrivilege	2524	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 4812	2932	dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe	88
PID 1892 wrote to memory of 4904	1892	SearchIndexer.exe	117
PID 1892 wrote to memory of 4028	1892	SearchIndexer.exe	118

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
"C:\Users\Admin\AppData\Local\Temp\dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe"
1⤵
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe
  C:\Users\Admin\AppData\Local\Temp\dc879cb1a5ae4fa85114f64d2914cd276cd3601ba053e81c8dec30a89a5cb523.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=125.0.5729.58 --initial-client-data=0x268,0x26c,0x270,0x23c,0x274,0x1405b9b78,0x1405b9b84,0x1405b9b90
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4812

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5028

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:372

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3524

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3252

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3576

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3552

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2308

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4380

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3304

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2664

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2092

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4576

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3800

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3408

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2184

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3572

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4904
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4975cc204b3f76b3697af56953652d53b4519e7ac21f9011e8970bc2eb696e34
MD5 ee7033c03466ee97108a000118697227
SHA1 70a85ba3f7471487c41f05eda4323407f50403d3
SHA512 216a7cc73c6cf626f1bdfd78eb906ffef89b4fd349d228e147e8e55a75f2d11d44c9888ee5077ad6528a5bb88cd976bf7b7f0931f361ec63d89e65da2f49e00f
SSDEEP 49152:Pb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnKb5+Pl6bJTIZ5jdgp1:N3q6mjBdslgJTIZ5Bgp
TLSH
T1F1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 6cefcba1dc4a0e72d0fcfb8beb2d58913180cbf0e23da452f5ee935dc403a25a
MD5 73d2a388e4b4f4e160e71d0a0dd1ee10
SHA1 06e87508c96b7af847d572f9b2af5f3ca9675a77
SHA512 ef4034f1ffc4675b4c13f1a14b81324851d6e648e2cfa9944f6cfe77f7a558c58a6e6aa72e31c29b6b37dcbd0dbfd467d729b0ddd64e1bef1bb55c6f98d20c9c
SSDEEP 24576:DXYfDtczAqmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:Gtc4b5+Pl6bJTIZ5jdgpy
TLSH
T17085F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 9b9e3ac91113073e9c65df221a43d51164e4853db97f990940aa11278a2741ce
MD5 df3c09db4f23bf06d55c28cbf89a482d
SHA1 e16b0cf61fd8687b360c7cbf36e3d4e35d87541a
SHA512 b29f3f978e361ca16eba847a777df49e984751472ba6b7328f53c057b5252d35095361295bfe8fb92f587890469be46580908246a05b55a833fcf2bb8978b5bd
SSDEEP 24576:/0Le5ji0hmxyrMLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:/Pji0AIvb5+Pl6bJTIZ5jdgpP
TLSH
T1B695AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d12c7ca640c260d0b501a0418c62e6941f649871e8e87abe929d7346269c9a50
MD5 a0286a0bd62e7d3069939d9c89be1d11
SHA1 4d11c718fc5d4e792cfb460b08968154066f79c5
SHA512 30c2a68fca953bbe01d24ff6b4afae837e68f21d6dc71af4ba0bc62e8e792c7ebbc63d2c0ffd3beb763ad8466c36e05ff91e207e8108a769e68e9fb21292e2ad
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWj6q8wyulmb57GBiOl6a8JTth/RWZvR6wQQ92pN30:P/ezSC6vUzPv+HjyTb5+Pl6bJTIZ5jdr
TLSH
T15C756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c18ca7cb630288fbcabd1cea797e9e170a6d3dab352c4d1d04d841dcba836786
MD5 ae3fcc31e6262151e66febe7209da84d
SHA1 97439c926e6e8dfe0593eb0878446aa53d5b317c
SHA512 978040d22af864266042cb8e0968d15dc877966a6370c44175dd83da61772f5da0794c233f46bd82e7b50b5a1a9d768d05946e1540fc02917ef1ff14d69b99b8
SSDEEP 24576:BVbqPb88hv/l+BOmb57GBiOl6a8JTth/RWZvR6wQQ92pN30:BVO88hXl+Pb5+Pl6bJTIZ5jdgp6
TLSH
T1FC559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 088b985b63aab6971ec843b5375f4d158b292ad3de95a1471537660128deafec
MD5 1afda2a816d428f7cf00ef6b0bffaf34
SHA1 a1ca9deeff45f382d6648a558e963d42684c44e7
SHA512 53954a53719ff66b15fd02bf832744f33df7a32fbaac142ab668cd81a8dfd1dabce247bc0cc38d22f423e47ba293ec65bc02d89c07c372a89d9d46817362b24c
SSDEEP 24576:kFPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:Bb5+Pl6bJTIZ5jdgpj
TLSH
T1506523834B6A30C5E5AB1739D9CDDB00F879EF55CD866BB6C575282BF034389B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 82193dfeb32c4b4d192545dd7344058112c24857d7fc7f4d5ca3501abd2168cd
MD5 49af873dd43d268861fe675f28fe1283
SHA1 20e714617ae3121867ce717bba335359a4ad47a4
SHA512 abfe930f40edf5db2cc2eca037dbf3092055e23153def9ad7b91617e9081cfacd162a96e94b932f785efac46c0e1cae36d91084571ea53c0e985989212feaf77
SSDEEP 24576:3JIUGmb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:3JIUJb5+Pl6bJTIZ5jdgpZ
TLSH
T1FE85CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f99962aa39f26b2eafb954495a2384e01bef45f02424310fc1c9a8e96b592d81
MD5 0cbdcca52bf2600804395a0d316715b7
SHA1 2dbf1d8eb4f12aab4e131edf47fa4f0fefd09e3b
SHA512 9d0ca12ad0a3627fbc46a6a1bca1bd1d9e86dffb82cc1622cbebdeffdbfc49ec5ef437b768f456c4efeecd6c139f6c2b06a6174ce641a19ef771ea5f44eb8e1b
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH8:+QvGAdlCEL8c/WRNw5C2slgJTIZ5Bgp
TLSH
T1EF266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 69dcff6f9a20a2201d0d8690239d2bd7da0e447131279dae1c34a0eec79c312c
MD5 869fcf5b73eca09f5eafb686c6146b95
SHA1 8bb261ee2eb55064e2483c9852711510990ceacf
SHA512 a7734e291464683ec813829bfa5abc33cccef5f6fa3a584141cb93dd0dfa7baa7a6ed7e7ef0a76282739f44a98d15f58f1e0c8decbec92600736080e48af3937
SSDEEP 24576:2OewsAjomb57GBiOl6a8JTth/RWZvR6wQQ92pN31:lljfb5+Pl6bJTIZ5jdgpL
TLSH
T13285E031FE75E036C2BB0DB65B65C716643DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9917c32b9df830618a2a538de923d68958e02beb6086dccbace0d09142dab0b6
MD5 47e03f9dc73389403599b76a232bdbc6
SHA1 3e4ab75df6ed4add60713c19bb9ddcbbf1bc9db8
SHA512 4e19c0a5cdb19bad427ed9d5858d8fa9d96b16c88c44acc6c13cae8f2ef5a5d6e83cc84346a23a3e2cb7c5928ebd49abb1719895120c93451e77d0c3be74733e
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHbsT6p:8UEtQevvqc2W1cpV20I32bs
TLSH
T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d48d190501f7f0042b26de8a473bbd2c44116d474ac82393fcd18de425c28f22
MD5 c3a3cce180cf96a0d698dbcf4d0b6184
SHA1 14258d6e7f2b6f6e6dfa754ffb42b893d03258e0
SHA512 4dc400e85e08d88ecd1cb6ead7d49cb3d3525e0ef090e5cd861c7c8495bc2748ce32306421cd4a652c10479b4004819b9483d287aa201a93df1f893a11411308
SSDEEP 49152:5CbRquA/m2yL5zQfFiV+XenmE3/z/b5+Pl6bJTIZ5jdgp6:WoqtVjnmqslgJTIZ5Bgp
TLSH
T1DED58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0c1f7bffc8c8fd3cd652b3928f5efdbb76ff2a134c9dac761af81d71b7b97865
MD5 fe05c990549f6debae58346c3db4273e
SHA1 1a0564d380ec40b468f9f47504e1e30aa3203627
SHA512 d52d28c61c4446e849716718608e9aff807e2ec7a5edcee5c694de411f8991bcede78c824a123ce5e11cbd2fd113397f9b9993e4a353bd0be8ca4ac107135648
SSDEEP 24576:JAhGL6IFoiwtA5l7S53Rmb57GBiOl6a8JTth/RWZvR6wQQ92pN30:JAM5Foiq58b5+Pl6bJTIZ5jdgpS
TLSH
T1C7359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 e81422e02931df9bca3645b6eaf73860be7e492bac43dd07ca465119e9603c54
MD5 2525a64f3a54b92c79539753938aed5b
SHA1 02d2e37863ea00231c01d59a85086c79555fa31b
SHA512 aca38b95398b7b50ab712c1e7a109ceba53ae326dbff3bd27154ea08db628c8328af8f57247716f14e717363c9e2736013d47a0575386a515b92a14a5fa0cc1a
SSDEEP 24576:MwuGOWkmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:MwNOgb5+Pl6bJTIZ5jdgpW
TLSH
T1CE75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 c5d992a834d11333f3cf9449f4675c2f3e4f9266acaccca2b098c8da21fcd0f9
MD5 e356065b8f975083c2b2f40c1183c4ed
SHA1 996b864cb259ebb13205c59738aede94cf07f71b
SHA512 25afc5a649b9ffd3e94bb8399e9d0b858667ebf27e785e678a9ece139adb410b5d5e5ecd30f51d386dd37ff2123f08e27e9101a74e98d818ed968d3dac6d2872
SSDEEP 24576:pZujmb57GBiOl6a8JTth/RWZvR6wQQ92pN3z:xb5+Pl6bJTIZ5jdgp5
TLSH
T13965128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 61f2c967b47790f60e664d532949454733fc51fa8dd49493abc13b4ff5778060
MD5 cc114af50cda126fee234ca96b8f50df
SHA1 bbbbcb0f34e2a0a3b530637af93c24c5526cd99d
SHA512 748f432b18887614a9e5ec5307ca00409964a2d45ae6acd1038a1e36563495462b873f47f280a6337120183d57b44047e644dc8c1a0764fd13321d6a1a91b3ad
SSDEEP 98304:1QRQyi36YOcPDLvw2gAf+PN35slgJTIZ5Bgp:MQyiKanX+PNpsT6p
TLSH
T191666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5fd358c1a2a3fd7fa33b032dc9d9c90d90c57d81e206924b47fe05d1b8fb05b3
MD5 87bb9cb6bb5bd360a72ff6017c653e85
SHA1 e363190772ee50c177bd7b095c9edbdfc960e4d2
SHA512 df255b7c4e891f1673e913ebf8ae7683f9df232630c88f115a37801a1e70587c6e404bd422f95cce1f422f3152f4cb294ea748028d8d21155ed52d88884df6e7
SSDEEP 98304:xQRQyi36YOcPDLvw2gAf+PN35slgJTIZ5Bgp:oQyiKanX+PNpsT6p
TLSH
T1B7666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5b7d194972b6d44340c9168c0edd5a03b9d6afd5d70c55cac343cff33fd4c5c2
MD5 b609be2c83176e4d9b9835f3821e35ce
SHA1 482dcce4fe2150c8f9a80906221b53b48bb200a8
SHA512 f77ceb848a46d8b269f45d1648e48e06edad8084c33ec1c3f932e8ad250b6aeb7fbf4a9653a66766644528f38ec97c07f7895cebf4da8021a9ecf01ba265275b
SSDEEP 49152:G68Qg55nhkeWu7PNU3/vb5+Pl6bJTIZ5jdgpS:kthTRc/TslgJTIZ5Bgp
TLSH
T18AB55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6b6fc33dc237bf43e7c54df352733ed6c0bf12046b402d1929ad8abc2e7583af
MD5 145be830ad3c4e0537acfe9d1ab22796
SHA1 cdc0bdc124ab7f714fdaaa3e0c5c8fd18372748b
SHA512 e7e83fea707ffebb238ac71dc43461a1535e82ff207de93ad19dabc7104c1f64644812a5f6576c0e01f061eb416cb871abf5c28111a9ce7a070e0c455fd29530
SSDEEP 98304:ry5112gYy5azzVvU69nLKnhZ0slgJTIZ5Bgp:GLIHRWhisT6p
TLSH
T1D0167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6a16b4cb2fd4c43a4a100c7833f6591ec6d20307be6cd8c0ba2b6724f6afd2da
MD5 b8e6059abe34bc5dc1c53bc4e52a4e1b
SHA1 dc4cd1afd2b396a86af1f8a6f3d5d255113a1ee5
SHA512 7e59ce98fca48707f603410a8b93669a673f6a0dfe8d1c894d5c68ebd788b62ab62d2611d9f029dd4ccb4fd46881d3cebe24f9a764bc1249358e86f9c0b0825d
SSDEEP 49152:iB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gllb5+Pl6bJTIZ5jdgpd:Qu6JmIxd2dhslgJTIZ5Bgp
TLSH
T112D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 433119206f92655ac71c2fe2a4bfcffed60c20a75e82ccbc843246c24a3536b1
MD5 53a2ae99fbdd33c0487485c7e555511d
SHA1 07679646bef80c6eb6151b549c52ee736e2b50b1
SHA512 a87a5a90c52ab8658edf7b1cd0500c1c6a3cb29f63be36536478384461c311ae89b72ae37562b750d68338fabec815a8bbfd659ed1757d710c8d31b71e4d91b6
SSDEEP 49152:z1hpsNoJpF1A67U44CwH7R4xpb5+Pl6bJTIZ5jdgpn:zmifPqRqslgJTIZ5Bgp
TLSH
T16EB5BE13F2D900E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 022d8ce6cfb3f30379fc066123a5045803a70ae7a202117c2351825659634853
MD5 864b3c10432f876eaf3a4dc18be57fc7
SHA1 0941172b6fb081e1084eaaa27b8af5dbfd940f33
SHA512 abd9aef2e6e6b8cd20148b1b54de3b4d3a3a3d30203461587fa077458df082bf0d121b0b11aef68f3336242c765f84427296324794abd99d5410e107ad738d4e
SSDEEP 49152:3SuZQIY0Be2KkRVtOnks6NMHq6b5+Pl6bJTIZ5jdgpg:t5dKqi61QslgJTIZ5Bgp
TLSH
T1ABC5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2a5ffe885423557f2fc920190e648937bcfefceafcfe5e1f79d06c0c650fab52
MD5 4d886fab51131f2abb5d12fdd2d01bdf
SHA1 157014805aef1a6a6c3ba530beb74f416655964e
SHA512 8480afb28d95d667bd7bf138bade16c2eeb5a9978384f8ed6734aed4d9b2a6356d0a8c5929d76f1d541a653aafe99db352564275d24533ec5af23b07b7f0ae14
SSDEEP 49152:khtSn8EApI0figjgiDn0AP5wVb5+Pl6bJTIZ5jdgpS:lX2iWphuslgJTIZ5Bgp
TLSH
T18795BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 cb9001bbcda9691de395e6eab645f6a3e2703cfd40a8df2aaddcdebaaf528af3
MD5 d97d9c5e4c1fa560da479f61c1d1932b
SHA1 b3e60a275e5cc11a026c0432321057a28a217893
SHA512 7dd3a23702f25c8256af00c62d5dcb39730fa95246e440c27e08b588d31a27e8c82245b14bc95d1368078c47b5250679fa3cb5247449d8bf13fbc4ff062aa68b
SSDEEP 24576:cHmb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:bb5+Pl6bJTIZ5jdgpF
TLSH
T1446523828D6B20CAE09B5779D9C9DB00F87DAF57DE8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 4224e601f5fdfb95766bf7aeb2f8f5d989141d84da30066af59e9b0088670078
MD5 a3c27f16e85e159109b29f3382aa83ef
SHA1 bdd3f1dce390184f083ec22030860c3b2eed093a
SHA512 3d7b9103de3aa62ec1150ce5a13a65de295fa481517f345d9487847f89af62184f717f0f0a153e086d1e5bbeba40549b46fbd8b82d289aa83e06fff63a94db1d
SSDEEP 24576:zsmb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:Xb5+Pl6bJTIZ5jdgpF
TLSH
T14B6523828E6B20C6E09B5779D9C9DB00F87DAF57DE8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 3a1ec189eee617aa433f05b6d2fb0d08f5ef35ce1c3ccf7cbcdcc0104a2568e6
MD5 b383210457c15d036d81497f33450d78
SHA1 b96d4f76f4e01de6102704344836b4d99b7fd620
SHA512 63a4b5965154c64d5f88222087dbfa63e667dbe1395e545edc71630d202e6625f6bfce57fad3a9fbbb0e9b9356196baca0eb787681ddd14c37aab80c9ec1173f
SSDEEP 24576:gemb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:Ib5+Pl6bJTIZ5jdgpF
TLSH
T1A56523828D6B20C6E09B5779D9C9DB00F87DAF57DE8727B6C57D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 5d418ba897fce330bf4a76f2123021ecaa50aa510ac5c3e55475fd0fdb69e186
MD5 55f046de1e4eeb75696909124507a334
SHA1 3566ced51aea4dfb765ac3dfabe05f5bd66e08ad
SHA512 7b067f78837a82d4b2693aa4dcf7a15d3c5c18e9c345a7952524a93724accb9113f49321be5f6b1b496d1196683b0af396f2232a172b0313711f450ca04f9ebf
SSDEEP 24576:ymb57GBiOl6a8JTth/RWZvR6wQQ92pN3X:9b5+Pl6bJTIZ5jdgpJ
TLSH
T1806523424B6A20C5E4A79339C9D5D700F5B9BE96DF5367FFC675082BAA31388383134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 19153e03b56b789463d226bdfa866411bf4ce160bc1e4783b5f96efac9313a68
MD5 80ae9459a3a10c8472294d6667f67c56
SHA1 b4e8633312a4146f0eab6f404fd8f3dc574f370e
SHA512 50e1e35e2e18a1b591b8a9a8949e8b70fc6651322c05dd4582d330ad3fc3c8d9aa3f25ad1dda26640e2bf06ff37bd9ecdaa7200e608e2d934277626084c7320c
SSDEEP 24576:qZmb57GBiOl6a8JTth/RWZvR6wQQ92pN3i:hb5+Pl6bJTIZ5jdgpM
TLSH
T1866523828D6B20CAE09B5779D9C9DB00F87DAF57DE8727B6C57D0427F134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 08d3df350ad1390b04da5b039b39730c8b9fbfbe1a772d3e226b4d26bd35ef10
MD5 bbdf3c5debcc6d2e690bc3d958df3c77
SHA1 dc568ad34c0b6654b5a04ca2f9d75b60f5a44c03
SHA512 0827a443776b4b831b42d3cbc2f0fca6d1d643d5d51a83df43a935af316d3297b2fb4819ebce3b4ddd9d1334ca8d8bcb5d6bc7cfb68247ef2184b343c3be0b06
SSDEEP 24576:Ggmb57GBiOl6a8JTth/RWZvR6wQQ92pN3b:6b5+Pl6bJTIZ5jdgpt
TLSH
T1A56523828E6B20CAE05B5779D9C9DB00F879AF57DE8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 7a78a93d883c123d5b8588de0bf2382e5bdc87ea164f4a0e35f9a048e7c89d99
MD5 f3266b7e15976a6498fc776e801ca112
SHA1 47b0e42deba6a3f180775076ce238dabd188b2ff
SHA512 1e4396dae652c41000e7b33d431470ef8fcd12617ea3c2d9ba389fa0db5087dbbaf1420a134f046c8833911ef54e2ef6d3740cd9b7e9cc53a9211caff197351d
SSDEEP 24576:J0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:Nb5+Pl6bJTIZ5jdgp1
TLSH
T1596523868E6B20C6E05B5779D9C9DB00F87DAF97DD8727B6C67D0427F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 786e8465c6df86744dd30610852f6d75b1a29c670fb7ade20e911944ea96f157
MD5 88ca29ad67b653ba38602c603cf36224
SHA1 54f4953ca9def9033cfcfac2b6a405df94e329fc
SHA512 8dc53eea2649f5a828468769a444c4f15f7255d368fdd4ad5a89d53d32b51aafcf399848de7da46e02a6b39becf4e9e69c3c98f881cf1ed48af0f95b5b40b89b
SSDEEP 24576:TZMazFVSOMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3h:TZMazfHb5+Pl6bJTIZ5jdgp/
TLSH
T1DC850295B36018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 e06946b3d2d65749a080d9b9a10c43373f176822ff1dea91c320d2b5bc108a01
MD5 35fe01b752ca87e683c547f558392edf
SHA1 a740fd7301fe3831eecc76844a0541b4e3631979
SHA512 11877aa17cf0e80807c59129a447a0af1d8dfc22dfa3107f3bff315c368bb262396c13f16302a867288b65d5d361e4a9a38f544d288137e5c7d9928e0e359897
SSDEEP 24576:gTmb57GBiOl6a8JTth/RWZvR6wQQ92pN32:lb5+Pl6bJTIZ5jdgpk
TLSH
T190652386496B20C6E09B5739D9C9DB00F87DAF97DE8727B6C57D042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 e7ca1a0427cd0056d7ad0d86c39ac319bbd2acd27aa6f887a1865c81a8e78c25
MD5 b091ae5aa27b016586806c5d91a5dd93
SHA1 de25dc3795b44ddc5a4f62e3794aa7f4bfca115f
SHA512 d8467fe57b232a06e5c1694a5875e2f49c255a1b97b5746a7b94a0c6cdf2d9ef9b969af457d47bf9fead471ab40cd7579c3cd72ee0c010953958f2e3e039fe5a
SSDEEP 24576:h/mb57GBiOl6a8JTth/RWZvR6wQQ92pN32:Mb5+Pl6bJTIZ5jdgpk
TLSH
T1846523874A6B20CAE05B5739D9C9DB00F87DAF57DE8727B6C67D0827F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 5ac0c8f4f69101a669e705fb8307b54579d05c98e9618d8c9f790b6073e45c8c
MD5 6d7b1a0e210db7f1d85b5e057fb17dc2
SHA1 7ec06c5e223221b22c20f78182aaf5cc168e04b3
SHA512 4c99557518c98f9ecb0914b8eb7340d32374c4034bdc552f7ff29a399890730a1b9ce094d6c66c8dd34a91909f0cf428efcb5b204c7dc1435170baeed419d629
SSDEEP 24576:2zyYmb57GBiOl6a8JTth/RWZvR6wQQ92pN36:2Ab5+Pl6bJTIZ5jdgpA
TLSH
T18475024767A630F9D0678239C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 07192094488871e2797ef54a983919fc11ec5b52b4618d2ff71a8a3df8989354
MD5 a27a565f231cf6dc1793b3381a4641bb
SHA1 aaf75de3308a7113560336d79eb59245fdbd7ae8
SHA512 ce97c475af4124ef08e934f122daf8f06f970d81035289dd24f01a60d21a63be53d4d0656cb9cf85d9171b5884d7dd7a33e4615dd9a21ab9e666848c9e3b9bc6
SSDEEP 24576:tTmb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:Ub5+Pl6bJTIZ5jdgpO
TLSH
T153652387896B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 67824fb5754ef35168e20d4fee1d314d4e02d2c27c2b22684de79df6b55ce251
MD5 d3bf929d3f4c3ce883076dcdaee848db
SHA1 25a497e10943720ce09da4d57608314e41e40a91
SHA512 c8a93795c7c96fa891b949f497d69bd8c393bb3b0d46b45b5f653ae0075b274a675f56857cf327f9f4b2c564c3711af37c1cc04ea0d2c04b1dbcabb97ed6f606
SSDEEP 24576:PTmb57GBiOl6a8JTth/RWZvR6wQQ92pN3g:Cb5+Pl6bJTIZ5jdgp6
TLSH
T18B6523868D6B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D042BF130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 2e8ce2e71b49abcb9fb465684aea2110529eba79a7373ba7723452e9f69971d3
MD5 1c68cf042f7308d41ad3f49948e7eb9f
SHA1 18e6f7b57245516c0d3443ad58578540ec32dec4
SHA512 c61ba3450a30782659601cb1f1400320fd604c20ef1c336c72de2362f99170d91eb62535a0a5789a4859c704a80a2f2a83b8d38ab32fd2b6ebfb159bddfb887b
SSDEEP 24576:DcP4mcvIjkGOxhKP2l71nNKbrh/8KBbmb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:4P4m4IpOO67W8KYb5+Pl6bJTIZ5jdgpg
TLSH
T11A65AE2DABDC0096D0BB913885A58A49FAB1742A1F3286CB1170933D7F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 e707171fe9da46528ec86df539e24df3572577a3f0056807de562d6951e9ea16
MD5 d40d6f4876ae2ad84dcfaed3cce656a6
SHA1 4043a4d5b410859ea68c94bc227c9b2186fe2378
SHA512 2f9b6389c175dc221fd933ee4d2bcb6ee9194a13b272cc990a0651650ed1b4193047599b193958ef6a46bbf13114c00aa49e9a4166f37ce11a6e5e7a6a1e91cb
SSDEEP 24576:Cjmb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:zb5+Pl6bJTIZ5jdgp4
TLSH
T15875F14AC29811D9D06E6279CB858A00F7377D65CBE293DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45dce273288da564.bin

Path C:\Users\Admin\AppData\Roaming\45dce273288da564.bin
Size 12KB
SHA256 87e3add56a85613b8a8ea941ea2fa494e58670d282d2ea90740121e1e50bbbee
MD5 6f20bfae8be7fd16952ec4d51afe4ddd
SHA1 e37baecf96cda2c14d39fc93fef4562b9ec612e1
SHA512 5b7d85c1fd1d8eb585a6f2b9c2010d457c95959db1cd83685c17046d7c250766d1dbc61fbb7ecc304a4b6a8792013ae73267cd01ad532d9b6e8ad96310dafb0e
SSDEEP 384:wv+m+tNFe5PXEz9quVk24LoyJSMNl++JiM9H1:WwCXEhkvoyEMNlJ/1
TLSH
T13D42C0CB2E37EEEDB7D8C86B035313F1A18BCE918055961EB85F9E786E12E61D314418
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 a9e1ea32927d0283fd399808870302a464b90d4ab2b4ec6876f60adbc92cdc5d
MD5 5dc665b18569c9228ea8480939e885b7
SHA1 ea2fab412a5e33b4a5fe969a42a8e12f30b9a127
SHA512 4dfe1b0584ff69936f8c1874af324c32f6245b8ae6337adbeed1a50b4ccb10948af8dee11ad7f1bc7d2aca2a5b41edf34c5790439d83219715347bdc3daf4a32
SSDEEP 24576:QDmb57GBiOl6a8JTth/RWZvR6wQQ92pN3A:Qab5+Pl6bJTIZ5jdgpm
TLSH
T1FE6523428B6E6086E0BB5735D8C9D710B83EBF65CF8666A7C579142BF1306897C2230F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e595370404a2f7805118e0a20cef0b2aacfb75b25158eee59cc76b8bf917a556
MD5 8614c977dffada0c3888075b5ccd2288
SHA1 84f9f73671e3eba737c65b89faf78228cce8c0fe
SHA512 db18dad5c5336e6ef599a754c2c22b8a32f556f4d521d1974e8a784e9460a80f6a3ff710bd5f61eeb9898e06a2d27f83954e08a4104ef169067bd772af2d161f
SSDEEP 49152:0a0h2GEkuAe73q3pp46zwwQUb5+Pl6bJTIZ5jdgpC:0a0hNYG4JwbslgJTIZ5Bgp
TLSH
T11485AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 b8e51f573138ff67faefa309064e350f4b41b3c9a1488063d8f29bba09bf5a63
MD5 a2b3242bfe375b8e258a0f729a5c6d62
SHA1 8d38c04bbdcc439f693205ca397468b7958a3290
SHA512 ae258f0c0373acfe668c5f9299be32d90552cc7be142a8f6b4c6bb3e8276a90186501acab1f474ec8bb7fe3a19614e4afbf7212f84332f695e3612dc3936c81e
SSDEEP 24576:AhbHjP8mb57GBiOl6a8JTth/RWZvR6wQQ92pN33:AhbHjDb5+Pl6bJTIZ5jdgpZ
TLSH
T11065126E06AD20C9F076A27DC5C5C606E731BD265B1263EF42E5813E9F37AD82C35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 eed6638278ecd4844941d86b7364aac6d9e3d479e0fb01df91fd6fdbe5bebf52
MD5 cb421752d7802144eb9806589ad09015
SHA1 2a755872b37a3521b4ab8b019a2e90ee9d3d9be8
SHA512 abd81dafa059f2d1eadad05b0b9af5c527f9bba7d5ce1e767d6a59c006385f4015e0285d9445bb017260ff8fb169ffe30590bf320c57b333447235072b71b525
SSDEEP 24576:Q3YgnJcRTk4yti+R5dBR/kmb57GBiOl6a8JTth/RWZvR6wQQ92pN3/:QIgnaTk46pBR/zb5+Pl6bJTIZ5jdgpV
TLSH
T1A545C02EF2B910B9C4AAD236854147B5FB71782D1F209ACB0170C538AF1AED85E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 2b67ab83057b65c5be7c8fc690870c4000664e8348402bd31c6c8850952a15af
MD5 345142f81be353fc3be72ceaacbcb472
SHA1 30f1379741bb6612c715a7daaa4d034414e8f7b9
SHA512 c740af4c706f604fed0d99e89dcffdf5811e267f5ce791c4dea0b5fb2d3cb7a6d96712e1a071bb8e6d040c57878ef830e9f74f56363f104d806e1bc4e3b69271
SSDEEP 24576:4vmb57GBiOl6a8JTth/RWZvR6wQQ92pN36:4ub5+Pl6bJTIZ5jdgpw
TLSH
T1256523864A6A20C6D0AB5779D9C9DB00B879BF55CF8727F7C479142BF1347CA387220A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b3786a247404c804594188a87ff542f61e967a02722918f7174d08b253951d59
MD5 ef94e879c92e2c0ef563cef5963f0c46
SHA1 9314ba00053fd33a07a1ab317b6fcd1111a2f98f
SHA512 f50ab069468835b2c87287e235fa8fb1e8233b9e2896b6d01951439d6469480a39a073f644719010eb95b77816c98cdbd91727a444408a14417945364e86ff9b
SSDEEP 24576:MBL3UTqmb57GBiOl6a8JTth/RWZvR6wQQ92pN3X:MBL3UJb5+Pl6bJTIZ5jdgpl
TLSH
T139850245E7A500F9E87B823CC8A6CA12E672B85D0754E7DF03B84A661F233E55E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 0f4ae59fbc10f7f197e6d42b6150e6e94769581810bf3e85c7ea89b4fcd37b4a
MD5 97ae9837bf2caffe88801cbf41791af7
SHA1 a774f82fb21baa3a563d08ec90ac864a2df2ab47
SHA512 f2d6b69865b245eb31dad4262eba7f468b6ea939a0f96e331cabe8453e77b3f47a3e877b512e374ac5e8232dcd48a6948681c8d240c603071f56a9664c6f61d0
SSDEEP 24576:yOmmb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:yOpb5+Pl6bJTIZ5jdgp/
TLSH
T15C75021A27ED20D5E076A23DC9C68309E771B8668B1257EF46E0407E5F63BE87C36742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 709bd68e24d20737c4b6503fc64ddccddceced2ea30734e4b362fa31f0efb8cb
MD5 33b13b8ac5c87bc8e340b5b8caf251db
SHA1 077acafcec4df5d58eb3f616d1979e18caba01f2
SHA512 d984a89a55898551cdbcd979febb2fd37fda1cc41b6418e91967cf0d1e8090ecd42de2f185b877041fd0f9df6d9b74fd1abdf3025c00da339c6579e592070c70
SSDEEP 24576:h7NM9YqZqmWMUkPjZM48Mv6bEhsTmb57GBiOl6a8JTth/RWZvR6wQQ92pN3W:h7cBWMpPjN8DbEhrb5+Pl6bJTIZ5jdgm
TLSH
T10A65AE2E6BAC81D5D477D13DC9E28205F6B2B4611B318ACB1162833E7F37AE45E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 fae8768cbb8131ba1812067f5543e8afec840cae7939dd783938a63788dbe4d1
MD5 f470955a68b3d08ab4ccdcdde2503992
SHA1 2e5c9aefb652b4049ede47566a3202770aba8824
SHA512 91446c23749a9f7f44c771c69d8c1167e9c63c75067e97c569b5690a2d17ea251c515d7ccbd09914dbe6dbaa376740c3977682405e99d50fec1e45a716bf8ed3
SSDEEP 49152:sF2YuHNETovAvNYf8kmKb5+Pl6bJTIZ5jdgp4:J6BCf8k1slgJTIZ5Bgp
TLSH
T16C858E2A27ED80A4E0BBD27D85F6D246F9B2B8511B3056CF4255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 4cd5e0a126e47bd6dccb5819970663cf712e79384972e115232f220947ebd8f8
MD5 ee359fd1f9530a0fe7d07f5b6aeace09
SHA1 9292c7bde839a0800bd7e7861bb07baf85ad2867
SHA512 4fd37beae6c13fc2c24997712a0ea48e8be5605073783fb6cc5acf846a9410e8e4609d3acbdb2ff259d26c9737b8c85d49c682a91017b5d14afff86c677c209c
SSDEEP 24576:LAFs06+Omlf8NXEbToCmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:EFs060loXu0b5+Pl6bJTIZ5jdgpj
TLSH
T10865AF2F66EC00D5D07ED17D8997C91AF6B1746307256ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 abcc0acd6ca68e4f9f8c111c89ea4a06390f5c55b5716a5adbdf18e6d94bb3e2
MD5 95b9cfaea0e58574d5d6085688167849
SHA1 a3991d8517213490cb516af1a4176bf2d30821e3
SHA512 19a8cf18bdac84cc498565a6d26a09368448a4b7c0116ef85edde6d0451ad9944818ae04026f6dda04979b3bb93ac1729c28e80e887582f7cc738627abf8efb9
SSDEEP 24576:6JnJ5D3Wx5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3p:6JnJ5DGx0b5+Pl6bJTIZ5jdgpj
TLSH
T19985DF2DD2A810E8D4B7C274819A5B45FE72386D2F226AC758B4D4357F12FE0A979F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 49c8b967ab9e51f24717ce020aa184488c5c53329d8ef15f815b8d08da651e06
MD5 a130f270acd3600ba659d4429c2befcd
SHA1 131e2429bd36db6cc3a35cbd80e529a8fb156034
SHA512 a16f6958ec7a83e4469644f1a6162628a8ab0254d70106153a9afb68d21796d4dcae8af272414a337a15a7e0dad25784e51327d43a97e015fb6edc05657577b0
SSDEEP 49152:jg06DIKdwc+eQnSt65aVGb5+Pl6bJTIZ5jdgpw:8+slgJTIZ5Bgp
TLSH
T117956C06BBEA5294E8B3CAB1C96295159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 88282339b59137ed1af52f011bbbb7e130687e91b935493fac65eaca664449ca
MD5 901e26acc3cdfe3f692d02942bc151f1
SHA1 8940ff6d56b8fbb1cc0eb30a4a8319236ef64ed1
SHA512 73fd2072e9aee0d2bea57821ae76e34b0707e11026fd71b4a3bf6e9ae346a5fe3864e1258f9f2efca0a3f720e126d3143eafc86847925befa492989a006cd01f
SSDEEP 24576:r8gmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:r8Xb5+Pl6bJTIZ5jdgp3
TLSH
T1BD65015E1BAD70D9D06BA23DC9D1C704E372F4619B4227EF46A1813E9E33AD92D39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 22755d12d290d4a980fe07cdc1958ab98d0bd22bd16e4e16a14e387b984f16df
MD5 9a7b89512953643e7cf78ff5b2da21ae
SHA1 9c0014b21cc381395480b751d1082347f115e62b
SHA512 072680499a7b9a792dd9659b5c98c7ac6cf445af4865dd23ec01785b197c277bc22eed484c876dd768297ddb17af706e7bf7f11ceb1b6b3af2099ac96139e343
SSDEEP 24576:gIysmb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:gIEb5+Pl6bJTIZ5jdgpm
TLSH
T1D775124557A860C5E5BA4738D9E6C350A979BD21DF1263EF80A0A63FAF32BC47C31706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 c6dbd860706a28f2c56e7cbe59f9fcb445d4a94dc3b1a8272d57b21060348a49
MD5 738f8cf807ccaa1d4aad790ceebe50a1
SHA1 f149fcd338d5a6f566c0a317f1c7fa537b6aac66
SHA512 6f5566969bc31c24c82ac04eef8b1c7a388edf9f9d40e8633e3792e11833b11cae034a7079489e448c1d3d4d437f2dc7a71663c0e059f918735242692b0e74d5
SSDEEP 24576:aWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:aZb5+Pl6bJTIZ5jdgps
TLSH
T11A65234A4A6A30C9E4675779C9C9DB00B479BB65CF8636FB84F8543BE2313C9343260A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 fe75b32a0d4d19010a26e054fdab561f3500c7a2c9bf9447fcc0bcc8767ae65e
MD5 3de940b689ef428875b0fa85bf4d91e7
SHA1 4ad5c8000aec0d492091d09a485fef47fde488e7
SHA512 3845e0986898e8eb12e812ba2da182ad8062be7de307644f9b0b1663c67dbf0170307a3282845f5adf3b24efb730cf41fc3c561b57b6142d979a2897ac94254e
SSDEEP 24576:6Q9MxZKdcz9dw3rmb57GBiOl6a8JTth/RWZvR6wQQ92pN3W:6VKZib5+Pl6bJTIZ5jdgpI
TLSH
T105558C2DABE9058AE177D239D5A250C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 7485e532b7b0baa782b4ff428665fec2e49b7d13a89d4599af98c8a63ce3b50b
MD5 8a5658914f65f77305c4922ed4335496
SHA1 cd1b0b0fe221596a0313157a7d3df9d6c58b4734
SHA512 2701a741a4c32600e23b1deafe4826b783082639a8980aebc4dc96652a176bc68ca63a4021cd8feba8333615e2b7e317bf595b472ed883a11c82dc4ea9da09a0
SSDEEP 24576:WyocwApomb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:rocwApfb5+Pl6bJTIZ5jdgpy
TLSH
T14F75E00FBB6A40D2E066823CC9858745F773B4309B5267DB5591C33E8E27AE97D35B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d79ce260b6690a7fe395f1c2d620d6391e6e367f98fd2d13a972d13d2947f585
MD5 86b2e79df149b67a0b1a67eaba46e80b
SHA1 8d4de63cee1db25229295840c05c6d0217e9b8cf
SHA512 1ca6cba9013831c29ed673f1a3de338b69befb17bd6658fe4f41d53caa28a1342da30ace1acff3b97b2401391ff2199a9b6b15744c393e0dfddf26a6b879ee91
SSDEEP 49152:EWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKfb5+Pl6bJTIZ5jdgpI:u0zuNIxslgJTIZ5Bgp
TLSH
T164A57B3DA2BC00A9D8AAC379C5451365EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 741d72260d87688bd18d11a8f4f3ca134b674e6bb5853dbb5b092f3a851f1372
MD5 218c61fb10186153ad329f8cbaebcf55
SHA1 6364005c1c048f7ff584323b66b9c0f753b3c612
SHA512 db9bbc82793f4b496fd7fbda1efcc7e9aaa4745236b20388e89c62d91105dd6a5c955c4e9e9dd317a54e2abe34212dd8c4ef962101c5ae36f3a7a2eecf787906
SSDEEP 24576:T1QT7EcpfxR+N5AWAz3ooiYzjMqbFmb57GBiOl6a8JTth/RWZvR6wQQ92pN3T:OTDxR+N5YzTBjMJb5+Pl6bJTIZ5jdgph
TLSH
T1ED55B02EA7F915E9D1BEC6799A23C502FA727821073193CB42A0C17E1E375D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 d8088eaefc8135e3b0c9d1ca34322d8e0418b38ae472137c96c75bcce02f2b50
MD5 a0b9ba6638d87a345d51ec95bd743af3
SHA1 7b7235419e875b9c188ac61612369830be46117b
SHA512 e368ef0d9e5ae4b21b56b96bb470c3a25997baa34091d465ce86bf1d183f8256edb88cce947160762de8b5230afa7aa22b81192ad38dee3f1c4a589bf0d53c79
SSDEEP 24576:UTMdOz0FFS+jmSLxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:c0K+jmSLMb5+Pl6bJTIZ5jdgpj
TLSH
T11A85E17EA36D14E5E47BC27DDA838A06F5727462032266DB06A0C07A7F57FD4393AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 f8b595c225e35786bfc5cd97c4928ab03cb37c2a9b8e67fd3c7a7c772f6931b7
MD5 450aea4b118941f7a6ac9479b8a5270a
SHA1 0f9dcfab1216917b0c4af247bc9abc2cd0544984
SHA512 1f80dde8f53780eebde1751b9d34046150e3646cecd0bac5f2c6b1826b6b8d9e47f977a87b5dfde926ab20b3a599238a57c2d7f9da0a48b36393df2035a6f64f
SSDEEP 24576:Cqmb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:CVb5+Pl6bJTIZ5jdgp0
TLSH
T1FC65124A17E930C5E0779339CAEA8701E570BD669B5627FF15F4C83B9B326C8A835702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/768-140-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/768-271-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/768-134-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1520-278-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1892-179-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1892-198-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1892-505-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1892-285-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1892-163-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1892-365-0x000000000CD60000-0x000000000CD68000-memory.dmp

Download

memory/2092-267-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2184-274-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2200-281-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2308-262-0x0000000140000000-0x000000014017E000-memory.dmp

Download

memory/2308-102-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2308-94-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2524-38-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/2524-30-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2524-39-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2664-265-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2664-433-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2932-150-0x0000000140000000-0x000000014069F000-memory.dmp

Download

memory/2932-22-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/2932-6-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/2932-0-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/2932-18-0x0000000140000000-0x000000014069F000-memory.dmp

Download

memory/3132-147-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3252-75-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/3252-66-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/3252-78-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/3252-72-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/3304-264-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3408-273-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3524-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3524-289-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3524-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3552-261-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3552-90-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3552-84-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3572-504-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3572-283-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3576-287-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/4028-382-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-392-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-398-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-396-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-394-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-395-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-393-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-372-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-391-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-390-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-389-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-388-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-387-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-386-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-385-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-397-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-384-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-375-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-400-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-376-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-377-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-378-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-379-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-380-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-381-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-403-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-399-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-405-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-383-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-374-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-373-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-371-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-404-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-370-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-368-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-402-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4028-401-0x0000015D1CDF0000-0x0000015D1CE00000-memory.dmp

Download

memory/4380-107-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/4380-112-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/4380-263-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/4412-503-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4412-52-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4412-46-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4412-260-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4576-123-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4576-269-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4576-129-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4812-367-0x0000000140000000-0x000000014069F000-memory.dmp

Download

memory/4812-10-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4812-21-0x0000000140000000-0x000000014069F000-memory.dmp

Download

memory/4812-16-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5028-369-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/5028-28-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/5036-43-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5036-79-0x0000000140000000-0x0000000140135000-memory.dmp

Download