bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Size 4.9MB
Sample261003-p7e95azzft
SHA256 bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9
MD5 78bde080f042b180d34c357aee299156
SHA1 1792fdd062d7ca06af68c6a9150af78b044b481a
SHA512 028f1528b22e8cee45e8a60d61bd8faf01cf3f16b44243b7316f0e1f98a7159dbb126003edf9697cd155e6900aac49cbaeefa41c9ed1f06fcdab68033cf0ae11
SSDEEP 49152:Rtz8DTC3b2/mrhZ3nGQXAPaZdx5P2xU1woP1mUuS/WRucrQdICHZmWMgpJFpvUFF:X5ZZPe21OQdIREPt2DVU023W
TLSH
T110366B13F19600E9E05DC178DF569231EB72BC4A0BF2A6EF269076152E77AD07B39720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
548	alg.exe
2476	DiagnosticsHub.StandardCollector.Service.exe
516	fxssvc.exe
4876	elevation_service.exe
2540	elevation_service.exe
3124	maintenanceservice.exe
5104	msdtc.exe
1444	OSE.EXE
2052	PerceptionSimulationService.exe
1344	perfhost.exe
5040	locator.exe
4068	SensorDataService.exe
4944	snmptrap.exe
4372	spectrum.exe
4924	ssh-agent.exe
3396	TieringEngineService.exe
4524	AgentService.exe
4516	vds.exe
3840	vssvc.exe
2860	wbengine.exe
948	WmiApSrv.exe
4704	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\55ba2e55862f6ed0.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\AgentService.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\wbengine.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\msiexec.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\vds.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\vssvc.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\spectrum.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\dllhost.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\msdtc.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094ca2cdc3653dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062183bdc3653dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f4fb2dc3653dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ace94dd3653dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
2476	DiagnosticsHub.StandardCollector.Service.exe
2476	DiagnosticsHub.StandardCollector.Service.exe
2476	DiagnosticsHub.StandardCollector.Service.exe
2476	DiagnosticsHub.StandardCollector.Service.exe
2476	DiagnosticsHub.StandardCollector.Service.exe
2476	DiagnosticsHub.StandardCollector.Service.exe
2476	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4204	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Token: SeTakeOwnershipPrivilege	4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Token: SeAuditPrivilege	516	fxssvc.exe
Token: SeRestorePrivilege	3396	TieringEngineService.exe
Token: SeManageVolumePrivilege	3396	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4524	AgentService.exe
Token: SeBackupPrivilege	3840	vssvc.exe
Token: SeRestorePrivilege	3840	vssvc.exe
Token: SeAuditPrivilege	3840	vssvc.exe
Token: SeBackupPrivilege	2860	wbengine.exe
Token: SeRestorePrivilege	2860	wbengine.exe
Token: SeSecurityPrivilege	2860	wbengine.exe
Token: 33	4704	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4704	SearchIndexer.exe
Token: SeDebugPrivilege	4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Token: SeDebugPrivilege	4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Token: SeDebugPrivilege	4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Token: SeDebugPrivilege	4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Token: SeDebugPrivilege	4540	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
Token: SeDebugPrivilege	2476	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4540	4204	bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe	86
PID 4704 wrote to memory of 2676	4704	SearchIndexer.exe	116
PID 4704 wrote to memory of 3944	4704	SearchIndexer.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
"C:\Users\Admin\AppData\Local\Temp\bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Users\Admin\AppData\Local\Temp\bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe
  C:\Users\Admin\AppData\Local\Temp\bf9b74285d3346bb32973377c702592afe4ce05fc5bcee6ee98c2318e6c2b3e9.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=79.0.4143.22 --initial-client-data=0x294,0x298,0x29c,0x264,0x2a0,0x1404341c0,0x1404341d0,0x1404341e0
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4540

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:548

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2020

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2540

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3124

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5104

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1444

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2052

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1344

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5040

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4068

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4944

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4372

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:552

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4516

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3840

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2860

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:948

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2676
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 77bbd9baec7bea21ea249747b744b74d485e9d9189aceb7ccd9ddfeed0aadca0
MD5 b9e1d88b11b35601ffd47d54e5f4aca7
SHA1 5953655ff811d61f2de6051601cf3bc11ab4f3c7
SHA512 f89143bdcd3a6b7343afb71fa32d3352d2bceb73c7c411dd50a92ed0654df8e2bb614dd1e2596ff53e81294de4c8918edec0d27012698b279b9603d46fba16c1
SSDEEP 49152:gb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnEe30jaNf1TWbdz:K3q6mjBZU023W
TLSH
T1C8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 ed546090fafc9ef2a2ce720368ff09def2709a04554b757e0b6566f6309fe733
MD5 42a6d68f410fba5e2bbb75cf7c4da475
SHA1 b91c732738389af0d3609f9163c122fc2d7a000a
SHA512 80667ea10f192328ba63ad8b2821b2177f32bf004e1fd7af25ec50e8252854e0ec12a4bf4727ab18149551d9c4b5698edd81f59a2b96e3dd5a73e0460e4a2ee3
SSDEEP 24576:yXYfDtczAygXe4i7ojhsP5Lgrk1TWb4AN5:ZtcWe30jaNf1TWbdz
TLSH
T1DB85F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 7c18d5f7667ffb40dc0e216500dd7dc30cffee614a6b8074b1bb12d2131084b6
MD5 b0acd7f3018c6cbc02013eb4bd10f4ab
SHA1 43654624081aa8a4950ecaebed7d269dec08a0dd
SHA512 b90aeb5ffb37fb699bbf1d85bf63e0f67c2254bf0bde56388c8199f9131216147f340b10a93d3f75ea7a871a893a9253a507add69525e9ceae6368cc20c5a6ac
SSDEEP 24576:i0Le5ji0hmxfrMRgXe4i7ojhsP5Lgrk1TWb4AN5:iPji0Alze30jaNf1TWbdz
TLSH
T1C695AE26F6748735D073C0B9C5D2A68AED71308257308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 685c76d213d0f1750e6e4a8819dc7db757c003475ef459180ba59d8a5e35efa0
MD5 aea38c1dadf77c5cf6f776e7b355537f
SHA1 29128c2e0fc82bc6ace1a101cbd89034c893790c
SHA512 53205d27fd5ad4b0ffe7bad561111adc651f2305d9202395e61e12e736d348b1b544f184536390ac9b991b55630ad881cbfa420081c2e68915df6d6fd8ec810c
SSDEEP 24576:Sa7/ezSC6vUyD/aqgrvWj6q8wyuPgXe4i7ojhsP5Lgrk1TWb4AN5:1/ezSC6vUzPv+Hjyve30jaNf1TWbdz
TLSH
T19A756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 da8a100225cca4c274d5a731465453a9bcedf70244357e2fb3f9055c5fe704e4
MD5 060736f5962f868f2f46a77cada3e277
SHA1 e533f189b1cc962cceffa5eed5dd387d50f18074
SHA512 d4b699f166766516e680b0f517f305b4047f5b454f50e6864983f86b7245f638e2dc2e9674d4e6c7f521afae2c2c837f80453e3e84fff520f17b89bd58033e6c
SSDEEP 24576:iVbqPb88hv/l+BGgXe4i7ojhsP5Lgrk1TWb4AN5:iVO88hXl+Te30jaNf1TWbdz
TLSH
T171559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 6013083133af2e6c3109480fa53f9c0ec945b44b6c3a81d41f63706b81e4ba72
MD5 1970a02cd6f52e1f4836b00dfb7ab69f
SHA1 3a83d6120c7701d6dabf8f15a188e6be0a649b8b
SHA512 9dc096463fd95c0eeb21a541149ae096d442c3cbf1b8e1789f38ac66a46b8090970850b579fb84682c803ab747223a996b357a2715d54638660b0b3f961c1ed1
SSDEEP 12288:F000DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:F0VgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1556523919F5409C6E38FC3F4A0F7CB91E9E11EC061448D6B47E0BAA319BC899DAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 206b119d82add73cfeb0d9b5514c437f5b81eda0f1b4afab1ae32891d4cdc5b5
MD5 fe5dac861f629187b0a748deb52151d3
SHA1 241fd4c8efd74cecd7330e009d0845f8160e9db3
SHA512 0bab25598b69c4dbf5ddf3a384b58556f897b704cf42e59ddfa71a3f2f98e1344f5ea5fbab6cc4def879e728e04a74167a7e9196b486360fb0a3352142d88f5a
SSDEEP 12288:QeBNUbTVO86UR0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:QJIUegXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15085CF3BEE28FCD2C27E8DB85691C740E7B278704B5193CBD1A4820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bc4dbdfa0ed90568c210d0d820ba45c1e4f832fbb44ed97bf91eddd27a1ab47b
MD5 1da159958567bb962e066bcd0365752f
SHA1 2ecd599fcc16cab39dfe6e5f4eb30c2a0ecbf6fb
SHA512 293685e672d6f6d7034d04e9c0cab547484bee01dc1bbd43fb7c2c0a95d4d9e374a50425814c78f160e1d25e581571c66389d005b534549f0ce80c1bbcef1869
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THj:hQvGAdlCEL8c/WRNw5C2U023W
TLSH
T14F267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 8a66b1d9f8e1e8bf8e4dfad289d3fdcce69fe582aa3bfdfec2b0f67833bacb3b
MD5 3c9c3a43933316c10c1fd2bcecd78bc9
SHA1 7db5ceb188d23ce3dee9e0cd5307b6e33e118f77
SHA512 87bfd9bd0dfe69b41e48f03ca2c8eb72d1a42af5bdf340be4c97bb2314ad8263268a9f49fec38c57f78ae9d718ae7a1523a1532661994ffa40082530802de25b
SSDEEP 24576:GNewsAjsgXe4i7ojhsP5Lgrk1TWb4AN5:Wljje30jaNf1TWbdz
TLSH
T18485E031FE74E036C3BF0DB21B76C706586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a8f55a60c5ae421973b5972f729a7cfd84e8697c06c6321cfc24f476f1d1cb84
MD5 61aa44ae8a009b128db1c502930a1d10
SHA1 1d36a7c7af3d4cefa4b03adcdc2bf6be8a0a5c64
SHA512 6c9dcf00b5ec1e1961fb300bc6d6445a703271edf1ed050993ad865645d9f25d7287f865b9d6f16eb360a80ef165174da8421f9049ced5ae657142053ee575ef
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH7p4W:IUEtQevvqc2W1cpV20I32N4W
TLSH
T184474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 08ffb0ec3458042fea7010b625a02cd90bed5f76c901c62b32490b6d2df4728d
MD5 28f34df6cec4b6b69b4a87fb9107ce4c
SHA1 6070988d3124e7f7aa1ccae3690e6905056c3493
SHA512 f07bfa999eb1cd5ae0bbcae19a1282efb6aca81f205225c28aec274cae3acd4118572687db2983931bb152a57ad98dd7550aceeb725c84b547f646d91fda4c9e
SSDEEP 49152:QCbRquA/m2yL5zLfFiV+XenmE3/zDe30jaNf1TWbdz:5oq2VjnmiU023W
TLSH
T188D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7af73f9d375a2eea43c9a5b8f4dc674a81313e43c4d712f9f782605706fa5f57
MD5 afeabbdfddb8e7db1d11a5b75173a9e4
SHA1 a1108e71d7404de06c497ebeb3381d727acac08f
SHA512 967d34719d4f4e230bf11b492232ee3e3d33dc20b1066c6dc16a13d1899843dc5600c3d34549e66835629c23067454204050c8ab0e5ad71f813e12a4236ede8f
SSDEEP 24576:5AhGL6IFoiwtA5l7S53bgXe4i7ojhsP5Lgrk1TWb4AN5:5AM5Foiq5Se30jaNf1TWbdz
TLSH
T1A1359E81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 44e847d83e5d46366bf39eb2fbfddc850c043d1213798754fdc6b90aebae7cd6
MD5 feaf2b6f588428e66860683e7ffb49cd
SHA1 0b270f991b44dc9d7bd75bc543546a2712aedefc
SHA512 be9d48f9091f3f89d0be38c9389cb30eecc0e8765e82129c1fa77685de727e1a2d81568d47bcb8a408eedf2a27c885f7bfacc765de53bd282353130a2e62694c
SSDEEP 12288:fmw5HEjsChNWBFgl0WDm+C20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:ewu/OW4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A385E14677A40CE9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 9a47925f0a22abff649302d96c132dc9eb12bf3300c253f4ad56932dbbc4bfb5
MD5 19453c7ded27f969cd61f250490aad3d
SHA1 b1f842a3f579c3801a24498b77745349765868b1
SHA512 922a9b6cac53bbbaa0e17dd30fe29352f507c508e8531783ba8597797b9242bf151c3d1f7f3d0bb6eba8e2970cdaa7b19f33f683e388e1272166341198f60054
SSDEEP 12288:GIZ1Iyv0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NZuJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E875129637D421FAE2978278D4F68741E7B23882233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3c50311b82e94394ccf93bbedb3af84ede5d454835c17063ef728c726cc02b43
MD5 44d2ef0b889094ee9541363da9698dda
SHA1 3efbbec3f81ca4311903b2528e9fbfd67a1e1265
SHA512 0198ba03af10ede95b235b28b06836d4cbab8ac3b93ca52e6b43c4cd32431e6378278a2f43fcf3e077182fed2a3061e71fdb112406e2c8b0758e6c987bb0064b
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UX:tQRQyi36YOcPDLvw2gAf+PN3tU023W
TLSH
T149667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 03dc33309cc360c3bd29350553ec484118e9b56a446a86a30776e6e7f35c3889
MD5 3597f7ce1dff2e28db89a0355f2dbc10
SHA1 9ed7cecd967db3eac7a38501889533a201903148
SHA512 6f8e1983f0c9d52a37d8bd9d52061f6fe637eab089ac2b003ce173dd5ae155999f4958e0f41213a93ca738ecd3b445aa2d1b467cbbd20d2fa52ad9344fc540ef
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UX:HQRQyi36YOcPDLvw2gAf+PN3tU023W
TLSH
T16C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 56e855bfc4cb52ee32ce852be9ddf6d109b0d3ab67c4f7b4449ec4610c165020
MD5 bb0919717e1f4227f915adf0c8d071e0
SHA1 ec905901ff2df8bae6adc5f672b5ba167ee94e20
SHA512 11cb8ac67e5c6d53a44a432ac1aefc8c6faa37226388671aa523c08ba777cc4c98d76a5976b17ec692ace9795c8480ebfea29e5148281d10bd4bab0243875915
SSDEEP 49152:B68Qg55nhkeWu7PNU3/ze30jaNf1TWbdz:/thTRc/zU023W
TLSH
T155B55933B2F60099C04DE1769F4A872196E27C718FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d574743dd9673c7faf7ac49fadc9d38d7366968e9aba2afa33d8a164fbf9cd60
MD5 755294843ca256cc66383ca6e2df9bac
SHA1 f512971041ea5fda56cdbbfba4d04a70828de4b2
SHA512 a03a31398167a8eafa17fda58e7739b8c21d1a8f1364720148820d45020a508bc6281162dae38d1f709b9ce354e39d2cff79b553ef215121e251456064d3870d
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99F:Xy5112gYy5azzVvU69nLKnhZAU023W
TLSH
T15B168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f9cf8c6a5292da252cfc7aff3821d97918fbcfe845b008854f01d032b8ab70a7
MD5 8c76e54a2f1eb2fb929d3a47f0efc28f
SHA1 d8da9d85e695c5ad5f5625235acbfd9cffd6b730
SHA512 e08ea62eecf4a38be5e450d4206062bed4b7ba108cb72a8a55efa96d7bdf4a9753a338bbced81078911320a384bcf8b27aaa103291912b619608c609949d690b
SSDEEP 49152:pB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl1e30jaNf1TWbdz:/u6JmIxd2d1U023W
TLSH
T1D8D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d7eeb447e687c5f6236b8a39b7151632cf4270570bd2de05fe012debdd64da69
MD5 e3d14f5cb57b7b47223a8a6f68aeb1d9
SHA1 607c60e9ca2707e74e678505a075ee3ced42b452
SHA512 d0e2a9c53c6074387d82d41061edbadc909e617d41d1d887c7bfa8161df1e96cc75160bae1962f666cdb02b14b86c01d9f577bd23da2b617a5024a55cea580d4
SSDEEP 49152:81hpsNoJpF1A67U44CwH7R4xRe30jaNf1TWbdz:8mifPqRiU023W
TLSH
T113B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bf8e1862d39a5291a05d899a2b4ba5eb5620703199949fc0aa8ebcb760a27303
MD5 1c9b4d1d065a74b2651aa9939479f4e8
SHA1 6ff88b18e1fe14728aed07273e6f6e483ed37d2b
SHA512 972a81d9152135813e163d8bd785b35476e70ae8b91a8b22b7454cb402742f378515268cfdea11a9751237a043c1df30c94bc54fbdf0209e588d8515c20fcc18
SSDEEP 49152:qSuZQIY0Be2KkRVtOnks6NMHq0e30jaNf1TWbdz:05dKqi610U023W
TLSH
T150C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 854b5597af15a5119d05e6bfae4eb772dc9984c833273faffdb93608e359920c
MD5 3ee659eb62aaaccee5679b48aa204cd2
SHA1 fa33c1c6373c0cf68960592c1a649a20a97cfc3d
SHA512 066b08f4839abce7a00b35154abb516cc45456541ce9dd26ce30b34a14bd7428607cef498da818e411a74ff100d0d3c4b74abaf2aac28a15b5bead38fc85401a
SSDEEP 49152:ahtSn8EApI0figjgiDn0AP5wle30jaNf1TWbdz:bX2iWphOU023W
TLSH
T10195BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 4537b65c7b75a65ff13584a9e134076c2132ab248b247d0c404b4de34263adae
MD5 7740f558635d3c5e8bf75c456d559e12
SHA1 ece634762ea19992a6645bf6431fb8ecfe1470aa
SHA512 8c32be111395bc07bacef22b7cc0f6cedb3b30003a2a0ef5cc28f91414ba5af20e65473b4e8d8961755dcdcab2bda6422ad16c3ef64195da28baa178ca33a2f6
SSDEEP 12288:MM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MtgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E16523959E5509CAE34BC3F0D0F787C1E9E01EC672444E6B17E0B6631EBCCDA6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 2780aa1e85a502939850cd8e397df7e4eb97ba1120d63fcd69d13465aab16f7f
MD5 a99e01b68bf3d7d84af4927c5a54cf61
SHA1 033b8ed022edc056b0c49b5dd8efd9f25a6d84e4
SHA512 24dc5db6fab2063075c6578d403244d4d702dcc14813141c0539dd550a98783b8f4bc648ec50ceaf74f76bd7b90f368ba97557666fa547614709f7e360ce1dea
SSDEEP 12288:qD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:qggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17F6523A1AE5509C6E34BC3F0D0F787C1E9E01FC672444E6B57E0F9531ABCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 3d19c572f4833762904d24b48389ffbf05fe5dc288ec406ec2dad0c5e4b19942
MD5 68cb2d6e63094409be229397f37f43b9
SHA1 05621f8409977e8b8582b278dd6d7c2e47655aff
SHA512 fc4607a9292a64d7e98afbb8a2596e3575645edb36b27b8dca320a1f7cd605511579ebf61f54e1433764e92072e42e0e0da5152dd98dd8472f6d7cd81bd5d983
SSDEEP 12288:Vp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:V2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C06523A19E5509CAE24BC3F0D0F787C1E9E01EC672444E6B57E0B9631DBCCD96AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 cc2a12ccb3b4685fc7bcb7359a44d42b3493955bc52e4120c804ce981a653fa3
MD5 3b641fa96ae91b77e51041f51ef5e740
SHA1 0ed5591be0183b23b9d30d80289381abbcbf3414
SHA512 5642e14917c38bfb4c52c2d751022f7e695e4afe0ef8572091b33fc315333b6681cd54e14c2a12d1524a43fe50a409600868424f81e2260a3bfa5dd45d4b51f9
SSDEEP 12288:RVi0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1926523526F5905C6E18BC3F4C0F38791E6F13DC1B3118BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 052ea0c5cc86faac583226105d90e88bb28c6e13258aeee7aea176650dc4bcd4
MD5 488db66235801166a1cc2a90003be2ac
SHA1 bc27fa2f942e5dd68bb2c0413f4544091981e3fb
SHA512 44f9f073f042fca0910708396e322c5b447d446971a468ee9b6cc2533916a34ac322e7805ffaa8c7b9e3d7726f4de216d306e18b05df196a6645b843cc93e76a
SSDEEP 12288:WK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FA652391AE5509CAE24BC3F0D0F787D1E9E01FC272444E6F57E0B5631EBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 d4fb9a42feffd7ff8c05086379044bad720730154c22bdf64964ec939505669a
MD5 35b538d095745f7c1911c1b21fac7c80
SHA1 4780eaa01b2ef6b1bcbac7c9c506ba664e1ca98b
SHA512 764aa4029345aea4f641abb7175aa0a94dd1d6b4fc311e1829e61b4fe38aa812a805437310d29363de49367001ac89d50c1c25f884673fb738a983de088aadf5
SSDEEP 12288:+X0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+EgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1486523A1AE5509CAE34BC3F0D0F787D1E9E01FC672444E6B17E0F5531ABCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 dff7146490ba8d23f8d9f1d75ba4360326e0ad7dc066f4f6867a9d47350a15d2
MD5 7ceaebd76d20e912474735bf720b3708
SHA1 03ead4658ad362723f2fa7657d80477311b43ce3
SHA512 280b2add4163ee0bcfa3905ea5aed359e66e55bc8b33d3989acc388de5decd6562a5fadfbf83c1dc2693aabf72c2200f187f8f14c0c0958da05cca0cb185c8f6
SSDEEP 12288:xL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1836523A19E5509CAE34BC3F0D0E7C7D1E9E01FC672444E6B57E0F9531ABCC996AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 11d3653ac6e152a1c6ab069b5e871a5516253800f0ecd8b08ca05b663cc133cb
MD5 d3dd330843bb9d1d7412beef239f6f24
SHA1 d4a685fbf0be03b6731b4e434c58c74cbbc9a06d
SHA512 45facd211b0dbe3bec67afd33c11f40342d1f746e611414a25e19485a7d4570c6f1f899653d91cc82b97a43d6962917ada7ec80ae1f9b884cfcb9ae2fe21ddde
SSDEEP 24576:4ZM9zFVSOAgXe4i7ojhsP5Lgrk1TWb4AN5:4ZM9zfbe30jaNf1TWbdz
TLSH
T167850195B3900CF8ED67827DC8A68A02D6B27C561760CA1F03F436671F773A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 c836333e4c34043dcd065312da724ffbf32e90a48634429dd448fb8c43e39835
MD5 4a285d05d87b63014e82b08067bad087
SHA1 ede45c09f47b07d88393f8a397424dcbad48e25f
SHA512 0c1a48076c636dab5c7259a40def81b19a497113c7be5d1090fe2501159a28648e5918be39722dbabaed3186072ee2dd50119a41dcda6d7339b1c0feb59d878e
SSDEEP 12288:3Y0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3ZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T150652395AE5509CAE34BC3F4D0E7C7C1E9E01FC672404E6B57E0B9631DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 08d2ab4ac6697eda5602d49d9644ba35f32fccb8185729835a0cd89634fc7a8e
MD5 d960542f7c7615f7a0a464aa5f3f6e5c
SHA1 f65d320eb2019a2d93d9f497585da060a5e8699d
SHA512 6bb7e0b7c40e5f52ef8f2c6843ec786df29492c8084a8eb4b5c806e485ff1971f4ac1dd7abfef726ac501fd38484ab72454f24c1dab1e26d924e7c6d0eed9dfd
SSDEEP 12288:Yk0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:YlgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15A652395AE5509CAE34BC3F0D0F787D1E9E01FC672404E6B57E0F9531ABCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 51d173c7a5101ac2b8b5577e4e25c17874abdea9e4fc04dfadd66668a66f0e7b
MD5 a5bb5d653cb48b5a71d3c295f39868e3
SHA1 48614dfd91464b6745a5a2b4e8246e7433c59aa9
SHA512 6e963b694958e98775a54a3554a888982a3bee86c7110453d2031b67b731fc3b6ec6c8df35d2f944b05cb67d2c3a34f20a7e27e3df65da352f86b92c123e59c8
SSDEEP 12288:OyPz5L8v0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Tzy8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CE75025777A120E9D16B8278C4E24B42F7B17C7217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 b59acafb2535434c8459ac7fa4f078da29404f7fccf1f45a87e004edb6116a50
MD5 51de8b6986580b623dd7d3b433176723
SHA1 f54d7a064e360e06b4153234ac16f642f0325ac9
SHA512 652d84d28cae3c7af5b6d54956119ca4b17a3d728b1b3551c19d0efaecde729ec333028457ac52c935df658749a44ce88a3f18b30794deb532da34bd23e1cea9
SSDEEP 24576:5cP4mcvIjkGOxhKP2l71nNKbrh/8KBBgXe4i7ojhsP5Lgrk1TWb4AN5:OP4m4IpOO67W8K2e30jaNf1TWbdz
TLSH
T19765AE2DABDC0096D0BB917485A58A49FAB1742A2F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 b465c559be347cc840a2f4775167f809092be03c5f28ac537d8e30bb72b49157
MD5 971b26f1f29c5a6159393faca6f86485
SHA1 e40dfa1f450ed89517175c3520e03ca1ed11f144
SHA512 15fd94f95fe63fe8d433e28bb7faedf0fcfe232d735d3a3eba0940d2d5dd9590e83c2baecb5888f4e0a40384858ba75390cdd898c355e395199614ba963f9910
SSDEEP 12288:WDsfo0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16675F15AD29802D8D05E92B5C3968A81F3733C9193E1C7CB13D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55ba2e55862f6ed0.bin

Path C:\Users\Admin\AppData\Roaming\55ba2e55862f6ed0.bin
Size 12KB
SHA256 63e08466dfd58ad6d6f0cd83619afb0c6ef86082a2205ef90e20753ce92f3dc0
MD5 da3d1e3f835380d5e317bcbe512c4b45
SHA1 307fc1ebd9ff0255bbb1f0637ad1a1dc5e321880
SHA512 e77479ed4ad04ada405838493b5a75ebe37decccb7ab2a7aad3ba4e54d4b07799cd438347c9b3aa8c166f572210465bbb7cfcb4be42b9201e889c2a1e7fe7831
SSDEEP 384:q/t/rF0L+i3bj9wixxRVsZbRHoMFOWM7Yx0QZY4w:q/t/rw3f9wixxRV8RrQWTx0QZYF
TLSH
T1A642C0235EA1EA7FDD689AC64E739640F4D4257113C736C1427CBC83EBF95014AD5287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3bce2c1-7408-48dd-830a-96be48561745.dmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\reports\c3bce2c1-7408-48dd-830a-96be48561745.dmp
Size 320KB
SHA256 3d6553f32b9493333c054c286447e9765b636d8b1a1451d7b2e2e3f17fc1bbcf
MD5 b190dde0bb7e9ca5ca3b7d2ba0fbf36e
SHA1 c255c779d7b66576ad390baa08b527fc34121e7a
SHA512 0c0061eef89f475704b678a7cf954eb36d32c21f8f370eb5542fc5737c47240b570ce3634b0d52dfe7eeac0a7591e9d9016a20b6df8b09f5d3ffca2b9d192f33
SSDEEP 3072:joS8KVUwALjWGyCm8tXFD7ZW5ra0Oyy3/CyIXf498VPWdMqZfSyYUeP:CRjav8tXFPZWdaSy3/RIXg96udMq1t1q
TLSH
T1C3641916A3D818E7E17EC23185C75725BBF1F891276267CF039282791D67BC0AE36B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 82869073210ec72cd87fabb54ff610c6e9c326f48e069ae3873e75843ef4de85
MD5 8c338a2866ce2d6f7b53a460b562c5f7
SHA1 7eabb0afceee47e1c35b20196923e303bc1d038f
SHA512 b7be0329a2119e2864046465320fa847e877d1b5c3e70e4ec9fe94cf7cecb644c1adbd709ade00f4fb6ca9ebdcaef30a9d7719eba8799e71211bbba0d71dd077
MD5 SHA1 SHA512

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 4cb38970d45283ea40f15a4328a0f4235dbf1badd3f7f7d0ef6abc327bd10ed1
MD5 955d13e36914f5af7653603b11596fd8
SHA1 04b495a04de531f5784f628471735465117bc2e9
SHA512 4cf54b0ca67b319ada38d17c3d15919501a657f994ebd22668c667ca2b85a70bffde20a856e8460f6a898371097b02ce50907adba2e8727576e70f42f8e55971
SSDEEP 12288:iI0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ipgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14F6523629B5809CBF29FC3F090F7C760F5653FC06B00899B66D0B66319B8CD59EA8529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4aaa9d697b7b62d354181a14e13eea91efe80ffdf14e4d5fe16883008b87e911
MD5 69a656d04fd03be1f9f2d1540a0a5e3c
SHA1 7c5b78bd537db6c54bf592ca4f81d7f5d1ceb937
SHA512 a1f93a14d1b55cb725f718291aa1e849e8008c0fe6a91770e03e20a30019bac01cd363cd78027cb325798d45656b7079259dbbfd56bdf35be43374bca856b96f
SSDEEP 49152:+a0h2GEkuAe73q3pp46zwwQ6e30jaNf1TWbdz:+a0hNYG4Jw7U023W
TLSH
T19585AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 5d840d7f24261eb730378a1f6e956edd0af094a6518a35ff8ae6edb77b68a830
MD5 1f8161ab064e95e03c8be9423bb7321f
SHA1 0e2c9a7b5219dbda2e906c8dfeb477cbc2642676
SHA512 e6ea5a47da14c703bf61f87ed5bfe30b39c4b1a667217fe5ebc16be91159b467f50856082aed73156f59b497e19eee989551fe04a789400712918ed9ca1dab44
SSDEEP 12288:ZhbHjfXT0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZhbHjPQgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12175127E2AAC10C9F276D2BC91E28646D371BC55270187EF13D1927A0F3AEE85D38E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c446da466a231b486f65c04eeb57c3b1515bdb9d82cd669be22485016123c6bc
MD5 8e994484847e7fb38fd80f676eea05c8
SHA1 f01cec73ae206603a29b7b0c1e7aebaf0edb93a5
SHA512 2673d422b963dd9f61070598116503d91ef8c864cf4b15a8a217a35bbe6b3b7782e5305d283dc98b88b8c626f9b859b5ed4cec2ab2bf6c4c087dce82d609ebb7
SSDEEP 24576:/3YgnJcRTk4yti+R5dBR/4gXe4i7ojhsP5Lgrk1TWb4AN5:/IgnaTk46pBR/Pe30jaNf1TWbdz
TLSH
T12845BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 2433ffb237f9b38352e986b2b97e9c4753f9e3a0eec4beff7b3c41477880817e
MD5 56d8f0c64631c8202933082a9e2c6ea0
SHA1 17def2adcd1cc27960a198bd92ced96266d4e04c
SHA512 2c7acfa92702eae17cce390df4c52353f7205f2823152cebd521282b814ff96c53bad6884ac811d0491ec1a3a7774c92cc438ab154f6e0adbc0fd0c3c0bd856c
SSDEEP 12288:QU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Q1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19D6523959E550DCAE24BC3F490E7C791E5A02FC133014EEB56E0F6631ABCCEA6EB4458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d8d7828894d4ba70c8a4d42517bb6ca1a52dff2d91ae3e81d4aecd417c382ad7
MD5 3d93122234226b47a22d659314a90dab
SHA1 a8a2ba85965e29fa8d1830cd5865ec113fb3ea01
SHA512 4f37bfa3c11e9a4c02d5e4920be815fd5b2ee490db129b64a024b167625ef6a7462d34e25feeb91ee6f853590d61f7d927aa24a9f434f5efa716de1603e4e429
SSDEEP 12288:WObeA4LWOsvAYFTF0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:/uL3UTygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F895F155F79400F9E96BC27CC4A28A12E2B2789D1364E7DF03A84B661F637E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f807d419db64db7cec83d8c5e0e8482f52f6a282a60f9b5c6585b8c648854442
MD5 3a7e023bce06e53882a1997410dbea21
SHA1 97d0c331dd477e53f5b97d0e5e6e0dbd22d87229
SHA512 ccd8d4205aff5aade54c7c2057e64ac5a689e8fd21a7c9bca4166161152a4f0873071cc781ef1e3a3ce82c2ee0f3e6eb78aee19ed76793af12ac987c639ec224
SSDEEP 12288:ApFtBOx0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:uO+gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16475026A37EC10D5E16AD27C85D38349E3B17892171147EF02E081BA1FB7EF86C79A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8865175117a1a63e583d50cbed65b5715bf33d6693de9faeb909a827c483b7c1
MD5 78c6db3a72cee14642d91783f391cd8e
SHA1 087a7cb3251d7084b443dd168da0b98f95cea0a1
SHA512 a6b3d3c3389be56ea02c97c5a845804b53c5a12acd73ba5cf2bafaedc505b40b2d965d8458cdb5167277b4fbee3b518e8a71dd88c95ca08f276ac211f12c84d7
SSDEEP 24576:47NM9YqZqmWMUkPjZM48Mv6bEhsZgXe4i7ojhsP5Lgrk1TWb4AN5:47cBWMpPjN8DbEhXe30jaNf1TWbdz
TLSH
T1B7659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 140f42a8e2fb172f81ebbd9088382fa0bd828793d15c32186b7fa7e3b225258e
MD5 66ebb80ff70d79553c87c51770b29df3
SHA1 d9cb196760baa13fdb5716e3507da0718b113b3c
SHA512 b565fa09a8621d016342b3d5148a516b223e99db5c313773c8a1828e6d02abd338de2fafedb93c31f0daed2b93b74edd207ae46303070cacb166e9b2b6d93522
SSDEEP 49152:FF2YuHNETovAvNYf8kmEe30jaNf1TWbdz:g6BCf8kRU023W
TLSH
T1A8857E6927ED80A4E0BBD27D45F6D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 66bb36bf6ea29013d6cb6fed9c0a6ff0ed3d2efb7d354fedd29db6096afd8ec7
MD5 97050953897151a5c611214bd560332c
SHA1 185930059c01e1e28d36f213274972db2cc9900d
SHA512 78e4026dabdd739255c6186b9b3de8d9ab567ff0266bb0901d48a87e0aa75ef8a1bf60ec43962cbfc75fa1205e7fbc61fdf8275dcef8b0103802eed97e3b13ac
SSDEEP 24576:iAFs06+Omlf8NXEbToqgXe4i7ojhsP5Lgrk1TWb4AN5:bFs060loXuae30jaNf1TWbdz
TLSH
T12165BF2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 41aceb6ff3fd4a3ed5cb5c2ff2a7aedb2c2bf534679422151b8b2105076c878a
MD5 65c9e3f8666785a9a9703138f172c12e
SHA1 24db54075a939687c816b978f43a9496a3772e41
SHA512 9020c446121144e496a8d1a0c0c2d7a3e3da644a2edfbeb0fcd7e21f009830aa6e4e1d242741c0ab3d10c3d24db05606f3eefa2f7080716069cf49fb493640a3
SSDEEP 24576:9JnJ5D3WhjgXe4i7ojhsP5Lgrk1TWb4AN5:9JnJ5DGhae30jaNf1TWbdz
TLSH
T19A85D02DD2A810E8D0B7C3B4819A5795FE72386D2F226ECB14B4D5353F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3bef35b5a11c065e3c92f176308bb16c9a5cfa01a8647d7eff48c3bc971413fe
MD5 1bc2b1f5a63c97aab1fd3ee2dcca12f7
SHA1 a62f1d3c33320d177c78968e63144ecab7db9eb5
SHA512 cc0e80bc094aecb43020b42b294cf58ef10b8ccc585a0637f0720efd3052a4dd3104baaf22c594b51e560707867851afaec31bb9552b97409560b463688234da
SSDEEP 49152:6g06DIKdwc+eQnSt65aVoe30jaNf1TWbdz:T+U023W
TLSH
T1B4955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 3b86df69aab5b8b04cf8f94ec2a50733015cd084ecd389084f4a7221be6a398b
MD5 6a0e292530d5e1b3b456c8649e500216
SHA1 40211ff508f25adcd9cb232e8b97ff4e61c78142
SHA512 e72aec54055073c77fddb93e6872c7dde617705ed7b1764226167cf3812d9d57f326c50951df226236debb996a7e9222e2101f89ad082b2f8357948948871eb4
SSDEEP 12288:SEP3RFp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:RF2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13B75126D6B9C60D9D16BD17C91E28741D3B2F4A127411BEF02E0D27E4E7B9E92E3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 b927f95bc84baffdfd01be6f7cc3b6387b23f2e5570168f181129b921f94eba8
MD5 ae97e8894ed29d196acde2453d01ae7a
SHA1 0ce8e170b1c774b35fcdaf3422a3671389ebe9a1
SHA512 b182ae58323a1ad610e0372347e608f7a683b71e3d60be1c9cea94ce460719dc9780b7d03f943149ef0f404fc3be47487ba3c2edf5fa6d34cb32fd8b9745e0f6
SSDEEP 12288:JjkyD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JIyggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DF751204679814C9E2AB8278D5F38390DA70BC606B1087EF51D0FA3F6F7AAD4AD74B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 e8404e8981d1111a8ce359c8b93149d42324f93b5a9eddb7e121b1b2804ec1fd
MD5 ae9bd6e586bad91016be717794e60247
SHA1 1e5c35246af8fa051e011f6b602d0ae121cfcb24
SHA512 bd2f0cd6c07eb7de769fcff1a7c4d2bed1c40cd4b2b637e706fed6cc7e50c7e790f2d480e2b32cab5ac7ae08dc79df357e65e7f16824a73c109e88140ac96c93
SSDEEP 12288:mQh0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:lOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BD6523695A5519CAE24BC3F490F78B91E5B03ED137004DFF12E0F6734EB88DA6AB4858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7d81421a996e5e6ba87024a07553f4d5ba162fa84c74f67c7a91900287001a90
MD5 9c962bc19afdfb31595d37e707d671b7
SHA1 0d4d806b274cb69a590224c54f5054c4a5e4930e
SHA512 0d1cd327b0a884f69610129424634517646da66c492a510a38d7b09b469c643155f378246958c095e5002a1404a53171af56ac427869db5d01aadfd8c2c78a94
SSDEEP 24576:nQ9MxZKdcz9dw3xgXe4i7ojhsP5Lgrk1TWb4AN5:nVKZMe30jaNf1TWbdz
TLSH
T11C557C2DABE909CAE177D27595A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 34b278f3e75b6583b2130d16303a806f7f6bb5c2c0b4142c14e29930b8605b42
MD5 fef3af887fd28428dd9fd871b733dfc2
SHA1 fe8b7d018c2f07ac5f7301dc2468fd22bdf592fa
SHA512 847348cf090300b970a053fa9fe27b2a0e6f656c76fbcc845428c0a9ffd68c3e52256c9c5b4759fa2ecc89a8b08cf857fc5152fc3389cdc28e5e5f2ce1b581ba
SSDEEP 24576:syoc9ApsgXe4i7ojhsP5Lgrk1TWb4AN5:Roc9Apje30jaNf1TWbdz
TLSH
T10285E01FBB6900E2E166823C88868741E7B3B4702B5257DB56D1C33E4E779E9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 92622ee792c0f30cfb22a8097cfed657a7badbc19f8a2ae9888f504306b1ef22
MD5 7cfbc76b85dc5c7a65a250fc596f57b8
SHA1 21a231f619ae6d3e25a3c21c120f4e582d66b0f7
SHA512 e2338334cfb7fae12870e05b9b0bb5f6509b6950e57a0ffac361e1db8bf6b0205c599fe714e1a92d07e076c945c95085e725e611ed0a01027fa652cecb5fb72c
SSDEEP 49152:/WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKje30jaNf1TWbdz:n0zuNIlU023W
TLSH
T166A57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 17c5060ec54ee71fda3800a600de51d966d222da849041827215fd2fe75481ff
MD5 72a69723a7744acfc4f817ad4d526732
SHA1 e8ac32518f1c522345f4920a0d5a7af1172a7b90
SHA512 6e10c1c198f15d3f397b8549015ebfc0503885f71c7534f6c6f86bb2d206ab45c854e4b36ffb8fcfa0e85e10991936e149f94f6598f3be54ee939deaff0100be
SSDEEP 24576:B1QT7EcpfxR+N5AWAz3ooiYzjMqbvgXe4i7ojhsP5Lgrk1TWb4AN5:ETDxR+N5YzTBjMxe30jaNf1TWbdz
TLSH
T1A855B02EA7F815E9D1BEC5789A23C512FA727851033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 8e66e07886ee99d7c9a0496e8624411228485d0e33d784c2ddddac30e9b56c18
MD5 34c9a46762a8bd873b7f0ba327ef4242
SHA1 b23767e32b3a95c5201f836896c34cd7fbe8fe94
SHA512 d24c61fa2b496aecea181ededc0ac8557754e1e28aeff8950b4c3517fbe076487e508b6fdf55bc5abf40a4d32549f05516f512ffdca88a0a38bd8456d1ce4460
SSDEEP 24576:wTMdOz0FFS+ymSL7gXe4i7ojhsP5Lgrk1TWb4AN5:40K+ymSLie30jaNf1TWbdz
TLSH
T1E085F17EA76D14E5E17BC27CD6938A06F672386103116ADB06D0C17A2F6BEE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 87b56de102034a44b7df5ac8fe655971c86d8b72873e9edac974cdbabaaa5e85
MD5 46492b26d4e3a08197e212e4130fa941
SHA1 a69e564b9ee29c5b2d45b2f7a33b502bf71c8066
SHA512 c50557df0c277b89fe9233784fa22178355d7a90d9b4b703e15db953e292964f38f7347519b138353f3b57acb5de4f8c7452e01e1f8c4de637b9fa1c51940a44
SSDEEP 12288:y40F0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2ygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17975125D67E824C5F167C2B491F78381D6707CA123104AFF26E0EA770F7A9D89978B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/516-58-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/516-57-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/548-26-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/548-383-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/948-406-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/948-337-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/1344-133-0x0000000000840000-0x00000000008A7000-memory.dmp

Download

memory/1344-327-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1344-128-0x0000000000840000-0x00000000008A7000-memory.dmp

Download

memory/1444-104-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1444-98-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1444-325-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2052-326-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2052-108-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2052-114-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2476-52-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2476-43-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2476-51-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/2540-339-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2540-77-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2540-71-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2860-336-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3124-93-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3124-81-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3124-91-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3124-87-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3396-333-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/3840-335-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3944-411-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-400-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-403-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-402-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-399-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-398-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-396-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-395-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-391-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-390-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-389-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-430-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-429-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-428-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-427-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-426-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-425-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-424-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-423-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-422-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-421-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-420-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-419-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-418-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-417-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-416-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-415-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-414-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-413-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-412-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-394-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-410-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-409-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-408-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-393-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-401-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-404-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-397-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/3944-392-0x0000014857570000-0x0000014857580000-memory.dmp

Download

memory/4068-382-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4068-329-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4204-6-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4204-39-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/4204-8-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/4204-0-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4372-150-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4372-331-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4372-144-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4516-334-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4524-168-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4540-11-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/4540-21-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/4540-381-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/4540-20-0x0000000140000000-0x00000001404F3000-memory.dmp

Download

memory/4704-387-0x000000000CCF0000-0x000000000CCF8000-memory.dmp

Download

memory/4704-407-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4704-338-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4704-201-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4704-185-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4704-219-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4876-323-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4876-405-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4876-67-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4876-61-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4924-332-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/4924-161-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4924-155-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4944-330-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5040-328-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5104-324-0x0000000140000000-0x0000000140199000-memory.dmp

Download